Perplexity open-sources SPACE for safer AI agents
Perplexity has open-sourced a persistent sandbox designed to contain computer-using agents while preserving state across long-running tasks.
Perplexity has open-sourced SPACE, a sandboxing component for agentic products that execute commands, install packages and call external services. The company presents it as the first component of its Agentic Runtime Platform, aimed at making computer-using agents safer to deploy.
SPACE is designed for agents whose work is long-running, stateful and branching. A sandbox can outlive the request that created it and the connection that initiated it, allowing an agent to resume after interruptions rather than restarting from scratch. Inside the guest environment, agents receive root access; the host system remains isolated from that guest.
Perplexity says it tested the design against frontier models. Its report evaluated nine model configurations across 216 total runs. The VM-escape task accounted for 108 of those runs, and no model reached the host from the guest VM. The report separately tested network confinement, where some partial-network bypasses were initially observed and then reevaluated. The company’s accompanying security write-up argues that isolation has to be treated as a persistent runtime property, not merely as a permission attached to a single tool call.
The release arrives as more products move from chat responses toward computer operation. That shift changes the security problem: an agent can install software, manipulate files and interact with third-party services over a period long enough for a small mistake or malicious instruction to compound. A disposable request container is poorly suited to that pattern.
Why it matters: SPACE tackles a foundational bottleneck in agent deployment rather than adding another model interface. Open-sourcing the component could give developers a common reference for durable agent isolation, but the public evidence remains narrow. Testing across the reported VM and network boundaries does not establish safety against every host, kernel, supply-chain or credential failure, so adoption will depend on independent audits and operational evidence.