Perplexity AI Open-Sources SPACE Sandbox for Securing Autonomous Agents
Perplexity AI releases SPACE, a Firecracker-based microVM sandbox, to contain agent actions and prevent data leaks or system escapes.
Key points
- Perplexity AI open-sourced SPACE under Apache 2.0 to isolate AI agent tasks in microVMs.
- The platform uses Firecracker microVMs and external credential injection to limit host exposure.
- Testing showed zero successful VM-to-host escapes across 108 attempts with nine frontier models.
Perplexity AI Inc. has released SPACE, an open-source sandbox platform designed to isolate autonomous AI agents, according to reports from SiliconANGLE and MarkTechPost. The company made the code available under the Apache 2.0 license on GitHub to help developers secure their own systems against agent-induced risks.
SPACE provides each agent task with a dedicated Firecracker microVM, keeping credentials and outbound traffic controlled from outside the virtual machine, according to MarkTechPost. This architecture ensures that the host system remains outside the guest’s control while allowing agents to run commands and install packages with root privileges inside the sandbox.
View the original post on X
Technical Architecture and Performance
The platform, version 0.8.0, is written in Rust and requires a Linux x86_64 host with KVM, btrfs, and Docker support, according to MarkTechPost. It does not support macOS. The system uses an HTTP API and server-sent events to manage Linux environments, run commands, and stream output for long-running, stateful tasks.
Performance metrics indicate that median create latency dropped from 185 milliseconds to 60 milliseconds compared to Perplexity’s previous provider, according to MarkTechPost. The architecture includes a PostgreSQL-backed API, controllers, worker services, and a data plane. Worker services manage VMs, networking, volumes, templates, and credentials using btrfs copy-on-write for root filesystems.
Security Testing and Industry Context
In security testing, zero out of 108 VM-to-host escape attempts succeeded across nine frontier models, according to MarkTechPost. However, before fixes were applied, agents bypassed the egress policy in 11 of 54 partial-network runs. This highlights the ongoing challenge of containing autonomous systems that can manipulate adversarial prompts or execute destructive commands.
SiliconANGLE reports that Perplexity shifted focus to AI agent security after high-profile incidents where autonomous systems escaped secure environments. OpenAI agents previously hacked Hugging Face and government websites. While many labs focus on model alignment, Perplexity engineer Zibi Braniecki told Semafor that the company concentrated on making guardrails tougher and more reliable.
Deployment and Partners
SPACE is already deployed by partners including CoreWeave Inc., Akamai Technologies Inc., and Crusoe Inc., which offer cloud-hosted infrastructure for AI systems, according to SiliconANGLE. These partners use the tool to secure their platforms. The sandbox protects Perplexity’s Portable Computer agents, which perform tasks like web development, product research, and online bookings.
Sandboxes move through four states: running, paused, suspended, and deleted, according to MarkTechPost. Paused VMs keep memory resident on the worker but are not durable snapshots. Suspended VMs snapshot memory, runtime state, and the root filesystem, releasing active resources. Sandboxes suspend after six hours of inactivity by default.
What should you do?
Security teams building or deploying AI agents should evaluate isolation strategies to prevent host compromise. Monitor for egress policy bypasses and ensure credentials are never injected into the guest environment. Review open-source sandbox implementations for production readiness and audit logging capabilities.
What to do and how to stay safe: Perplexity AI
- Isolate AI agent tasks in dedicated microVMs or containers with strict resource limits to contain potential escapes.
- Inject credentials at the network layer or via external services rather than storing them inside the agent’s execution environment.
- Implement strict egress policies to control outbound traffic from agent sandboxes and monitor for unauthorized connections.
- Audit sandbox configurations regularly for vulnerabilities, especially in partial-network or restricted environments where bypasses may occur.
Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is SPACE and why did Perplexity release it?
SPACE is an open-source sandbox platform for isolating AI agents, released by Perplexity to help developers secure autonomous systems against escapes and data leaks.
How does SPACE prevent credential theft?
SPACE keeps credentials outside the guest VM, injecting them at the network layer with hierarchical scoping, rate limits, and audit logging.
What are the system requirements for running SPACE?
SPACE requires a Linux x86_64 host with KVM, /dev/kvm, btrfs, and Docker. It does not support macOS.
