Perplexity open sources SPACE, its sandbox for AI agents

Perplexity AI has released the code behind SPACE, the internal sandbox that keeps its AI agents in a locked room while they work. The company announced on October 15, 2026, that the platform is now available on GitHub under the Apache 2.0 license.

The name stands for Sandboxed Platform for Agentic Code Execution. The job is simple: let autonomous software run code without letting it touch anything it shouldn’t.

What SPACE actually does

Under the hood, SPACE is built on Firecracker microVMs, a virtualization technology developed by AWS. A microVM is a stripped-down virtual machine that offers the isolation of a full computer while starting up far faster than a traditional one.

Rather than relying only on software boundaries inside a shared operating system, each sandbox is separated at a deeper layer of the stack.

Perplexity reports a median sandbox creation latency of approximately 60 milliseconds. That is down from 185 milliseconds previously, roughly a two-thirds cut in wait time.

SPACE also supports stateful features: sandboxes can be paused and resumed. The platform also keeps rolling snapshots for up to one week, so a long-running task does not have to start from scratch after an interruption.

On the credentials front, SPACE supports bring-your-own-key (BYOK) encryption. Credentials are injected only at the moment they are needed and are never stored inside the sandbox itself.

Stress-tested before release

Perplexity did not open source SPACE straight out of the lab. The platform first went into production in June 2026, powering Perplexity Computer, the company’s product built around long-running AI agents.

Since that rollout, SPACE has handled millions of sandbox creations and tens of millions of reconnect events.

The company also put the system through a red-team exercise in September 2026. The testers made 108 attempts to exploit the platform. None of them produced a successful escape from the sandboxed environment. A small number of network-policy issues did surface during the exercise, and Perplexity says those were promptly addressed.

Why open source, and what comes next

Releasing internal infrastructure under Apache 2.0 is a notable choice. The license is permissive, allowing developers and companies to use, modify, and build on the code, including in commercial products.

Perplexity indicates it plans to expand SPACE as part of a broader Agentic Runtime Platform. It has also pointed to future collaboration with Nvidia and other partners aimed at establishing safety standards for this kind of infrastructure.

What this means for developers building agents

SPACE offers a reference implementation that has already run at production scale. Teams can adopt it outright, borrow its patterns, or use it as a benchmark for their own designs. The 60-millisecond median and the red-team results give them concrete numbers to measure against.