Perplexity SPACE

Perplexity SPACE (Sandboxed Platform for Agentic Code Execution) is an open-source sandbox platform that runs AI agent code in isolated Firecracker microVMs. It is for platform and security teams that need to self-host agent execution with pause, resume, snapshots and credentials kept outside the sandbox, instead of renting a commercial sandbox service.

SPACE is the sandbox layer Perplexity built for Computer, its long-running agent product, which launched in February 2026 on a commercial sandbox provider and moved onto SPACE in July. Perplexity open-sourced it on October 15, 2026 under the Apache 2.0 licence at github.com/perplexityai/SPACE. Each sandbox is a Firecracker microVM that boots its own Linux kernel with a minimal device model, so agent code is treated as untrusted and does not share a kernel with other tenants the way container sandboxes do. A stateless control plane exposes one HTTP API to create sandboxes from templates, run commands, stream output over server-sent events and manage the lifecycle; lifecycle calls are asynchronous and return an operation ID to poll. Node-level services inject scoped credentials from outside the VM only when needed and enforce egress policy, so an agent never holds long-lived secrets. Storage uses copy-on-write Btrfs, which makes snapshots, pause and resume, and session branching cheap; reports put snapshot retention at up to a week and median creation latency at about 60 ms. The services are written in Rust, and the repo ships a Kind-based local Kubernetes setup, a reference AWS EKS deployment, warm pools, and an E2B compatibility wrapper for code written against the E2B Python SDK. Perplexity says SPACE handles millions of sandbox creations a day, created sandboxes three to five times faster than the provider it replaced, and showed no VM-to-host escape in 108 red-team attempts by frontier models given root, although testers did find network-policy bypasses that were later fixed. Akamai and Crusoe are bringing it to their clouds, and CoreWeave has published setup guidance.

Category

Infrastructure & Cloud

Pricing

Free

Target Market

CTOs, Platform Engineering Teams, AI Infrastructure Engineers, Security Engineers, Enterprise Developers

Deployment

Open-source, Self-hosted

• ✓
  Firecracker microVM isolation

  Every sandbox boots its own Linux kernel with a minimal device model, giving a stronger boundary for untrusted agent code than containers that share the host kernel.

• ✓
  Snapshots, pause, resume and branching

  Copy-on-write Btrfs storage lets long tasks pause and resume, recover from interruptions and branch into multiple sandboxes without copying whole environments.

• ✓
  Out-of-sandbox credentials and egress control

  Node-level proxies inject scoped tokens only when a request needs them and enforce destination policies, so agents never see API keys or long-lived secrets.

• ✓
  HTTP control-plane API

  One API creates sandboxes from templates, runs commands, streams output over server-sent events and manages lifecycles, with a generated OpenAPI reference.

• ✓
  E2B compatibility wrapper

  Lets code written for the E2B Python SDK run against SPACE, lowering the cost of trying a self-hosted backend, within the documented limits of the wrapper.

• ✓
  Warm pools and reference deployments

  Pre-booted sandboxes on Kubernetes cut start latency, and the repo ships a Kind local setup and a reference AWS EKS deployment to start from.

• •
  Code execution backend for an internal agent platform

  Give every agent task its own microVM to run generated code, collect output and destroy the environment when the task ends, so one bad run cannot reach other tenants.

• •
  Long-running research and data-analysis agents

  Agents that work for hours can be paused, snapshotted and resumed after failures instead of restarting from scratch, as Perplexity Computer does in production.

• •
  Replacing a hosted sandbox vendor

  Teams on E2B can point existing SDK code at a self-hosted SPACE fleet through the compatibility wrapper and compare cost and latency on their own traffic.

• •
  Agents that call authenticated services

  An agent can sign in to an internal or third-party service through node-level credential injection without the token ever being stored inside the sandbox it controls.

• •
  Managed sandbox offering on a cloud platform

  Infrastructure providers can package SPACE as a customer-facing agent runtime; Akamai has launched it on its cloud and Crusoe is adding it to Managed AI Services.

SPACE is free under Apache 2.0, so the real cost is the infrastructure and staff to run it: Firecracker hosts with KVM support (bare metal or nested virtualisation), a Kubernetes cluster, and engineers for patching and on-call. Perplexity sells no hosted SPACE plan; managed versions are coming through partners such as Akamai and Crusoe, at their own prices.

This page was written from 6 sources, 5 on domains other than github.com.

1. 1.perplexity.ai — open sourcing space
2. 2.github.com — SPACEvendor
3. 3.cryptobriefing.com — perplexity open sources space agent sandbox
4. 4.techstrong.ai — perplexity unveils space a secure sandbox platform for ai ag
5. 5.explainx.ai — perplexity open sources space firecracker agent sandbox apac
6. 6.gigazine.net — 20261016 perplexity space