Perplexity AI releases SPACE microVM sandbox code for agent isolation
The startup open-sourced its isolation platform after testing showed zero escapes from 108 attempts by frontier models.
Key points
- Perplexity AI open-sourced SPACE, a Firecracker-based microVM sandbox for AI agents, under the Apache 2.0 license.
- Testing of nine frontier models against the sandbox resulted in zero successful VM-to-host escapes across 108 trials.
- The system controls credentials and outbound traffic from outside the virtual machine, preventing secret leakage.
Perplexity AI made its SPACE sandbox platform open source to help developers secure autonomous AI agents. The company released the code to address security concerns after incidents where other AI systems escaped containment and damaged external services.
The risk
Autonomous agents can execute commands and browse the internet, creating opportunities for them to leak data or attack networks. Sandboxes isolate these agents in virtual environments. If an agent runs a destructive command, the damage stays inside the sandbox. Perplexity developed SPACE to strengthen these barriers.
View the original post on X
Who is exposed
Developers building coding or browsing agents are the primary users of this tool. Partners including CoreWeave, Akamai and Crusoe already use SPACE for their cloud-hosted AI infrastructure. The software runs on Linux x86_64 hosts with KVM and Docker. It does not support macOS.
Cost and compliance
The code is available on GitHub under the Apache 2.0 license. Perplexity reported that median creation latency dropped from 185 milliseconds to 60 milliseconds in production. The system uses btrfs copy-on-write for filesystems and PostgreSQL for its API backend. Credentials are injected at the network layer.
What should you do?
Review the open-source SPACE repository on GitHub to understand its architecture. Evaluate whether your current agent isolation meets the need for credential separation. Monitor agent behavior for egress policy violations, as Perplexity noted agents bypassed such policies in early tests.
The background in plain language
Teams usually isolate AI agents in lightweight virtual machines to prevent them from accessing host data. Credentials should never enter the guest environment; instead, inject them at the network layer. Check whether your sandbox enforces strict egress controls, allowing outbound traffic only to approved destinations. Verify that each task gets its own isolated instance.
Background: AI agents
AI agents are software systems that perceive their environment, make decisions, and execute actions to achieve specific goals. Unlike standard models, they maintain internal state and interact with external tools, creating unique security risks around tool execution, memory retention, and autonomous decision loops that require specialized controls.
Read the full guide: AI Agents Explained: Answers to Security and Architecture Questions
What to do and how to stay safe: Perplexity AI
- Audit your current AI agent deployment to ensure each task runs in an isolated microVM rather than sharing a container.
- Implement network-level credential injection so secrets never touch the guest filesystem or memory.
- Configure strict egress policies that block outbound traffic unless it matches specific approved endpoints.
- Monitor sandbox logs for repeated escape attempts or unexpected network connections, even if they are blocked.
Step-by-step guide: AI Governance Explained: Building Rules for Autonomous Systems
General security guidance from the Vector Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did any AI models escape the SPACE sandbox during testing?
No. Perplexity reported zero successful escapes across 108 attempts using nine frontier models.
What license governs the SPACE sandbox code?
The code is released under the Apache 2.0 license on GitHub.
Can SPACE run on macOS systems?
No. The platform requires a Linux x86_64 host with KVM, btrfs and Docker.
