Perplexity open-sources SPACE, the infrastructure that isolates Computer agents

Perplexity open-sources SPACE, its sandboxed execution infrastructure for AI agents, featuring network controls, access protection, and session resumption.

An AI agent capable of executing code, inspecting files, and interacting with external services can also attempt to access unauthorized resources. To govern these operations, Perplexity is open-sourcing SPACE, the infrastructure used by its autonomous assistant, Computer. Deployed internally since July 2026, the platform relies on isolated virtual machines, network controls, and backup mechanisms that allow agents to work across long sessions without direct access to the host system. Infrastructure Built for Perplexity Computer

Since the launch of Computer in February 2026, Perplexity has been developing an environment that enables its agents to perform file operations, execute programs, and resume interrupted tasks.

These capabilities require independent workspaces. An agent tasked with analyzing data, generating a report, or modifying a document must be able to use tools without compromising other sessions or the provider's infrastructure.

Perplexity initially used a commercial solution to create these isolated environments. In July, the company replaced it with an internally developed infrastructure: SPACE, short for Sandboxed Platform for Agentic Code Execution.

Since this migration, SPACE has handled all Computer sessions. Specifically, the platform manages code execution, interruptions, task resumption, and the creation of multiple branches from a single environment.

Its release now allows other developers to inspect and reuse this infrastructure, rather than rebuilding their own isolation and session management mechanisms. A Separate Virtual Machine for Each Agent

SPACE uses lightweight virtual machines powered by Firecracker, a virtualization technology originally developed by AWS.

Each environment has its own operating system, separated from that of the host machine. An agent can create files, install tools, and execute commands within it without automatically inheriting the permissions of the server on which it runs.

A central management layer coordinates the creation, suspension, resumption, and deletion of these environments.

This separation is specifically designed to contain the consequences of a dangerous command, a malicious program, or an unexpected action by the agent.

The value of this approach lies in the fact that restrictions do not rely solely on the instructions given to the AI model. Even if an agent attempts a forbidden operation, the technical environment is designed to prevent its execution beyond the defined permissions. Credentials Stay Outside the Workspace

Access management is another central component of SPACE.

To perform certain tasks, an agent may need to connect to external services, consult data, or use enterprise applications. These interactions sometimes require API keys, authentication tokens, or other sensitive information.

SPACE keeps platform-managed credentials outside the environment in which the agent executes its code.

Communications pass through control mechanisms that verify authorized destinations and associated rights.

The workspace is thus treated as potentially untrusted, even when executing a legitimate task.

This architecture limits credential exposure if an agent generates malicious code or if external content attempts to hijack its behavior. Pausing a Task and Restoring Its Environment

SPACE does more than just isolate programs. The platform is also designed to preserve their state during extended tasks.

An agent can be paused to await human validation, additional information, or a new instruction, and then resume its work with the files and execution context already in place.

The system uses file snapshots and full-environment restore points.

Rather than systematically copying all data, SPACE retains the changes made since previous states. This method reduces the operations required for backup and restoration.

The platform also allows for creating multiple branches of a session. For example, an agent can experiment with two methods of processing a file in separate environments, and then revert to a previous state if an operation fails.

These features are particularly relevant for agents assigned to tasks involving multiple execution phases, verification steps, and human interventions. Millions of Environments Created Daily

Perplexity reports that SPACE handles several million isolated environment creations per day since its deployment.

The company also announces a speed gain of three to five times for creating these environments compared to its previous commercial provider.

According to Perplexity, the comparison was conducted on the same production traffic.

These results apply to the creation of workspaces, not to the reasoning speed of the models or the time required to complete a full task.

The transition to SPACE allows the company to directly manage its execution infrastructure, including backup operations, session resumption, and the enforcement of security restrictions. 108 Escape Attempts, Zero Virtual Machine Breakouts

SPACE's security was also subject to offensive testing designed to examine the behavior of agents deliberately attempting to bypass their restrictions.

In an initial campaign of 108 escape attempts, Perplexity observed no successful breakouts from the virtual machine to the host system.

However, researchers identified other weaknesses. Some attempts managed to bypass network restrictions without crossing the virtual machine boundary.

These issues were resolved and subjected to further testing. According to Perplexity, the two identified bypass methods failed during subsequent verifications.

The results are detailed in the research work dedicated to escaping SPACE.

The absence of observed escapes across the 108 attempts does not constitute an absolute guarantee of security. It reflects the outcome of a defined testing protocol under specific configurations.

Perplexity states that it also shared the vulnerabilities discovered during its investigations on competing platforms with other providers. Released Under the Apache 2.0 License

The