SPACE confines each Perplexity agent to its own virtual machine

Perplexity's SPACE infrastructure isolates each agent session within a virtual machine—a hardware barrier that protects customer data.

Perplexity has equipped itself with a new infrastructure layer to run its agents, dubbed SPACE (Sandboxed Platform for Agentic Code Execution). Its purpose: a sandbox where an agent can execute code, modify files, and chain tasks for hours or days, without exposing the rest of the system if it were to be compromised.

Container-based sandboxes, designed for short, stateless tasks, share a single kernel that becomes a single point of failure. SPACE takes the opposite approach: each session lives in its own virtual machine, with the kernel isolated behind a hardware boundary. A hostile workload that breaches this guest kernel remains confined to its VM, without contaminating its neighbors. It takes crossing two barriers—VM isolation and host process isolation—for one sandbox to reach another.

As for secrets, they never pass through the sandbox: a dedicated store lives outside and injects them at the network level or via a browser agent, while a single gateway filters all outbound traffic. For stored data, the company offers BYOK (Bring Your Own Key), where the key remains with the customer and its revocation renders the data unreadable.

Perplexity ran SPACE alongside its legacy system on the same production traffic. Median creation latency dropped from 185 to 60 milliseconds, and the 90th percentile from 447 to 89 milliseconds—a startup three to five times faster, driven by the btrfs file system and a warm pool of preloaded sandboxes. The layer now handles 100% of Perplexity Computer sessions, with millions of creations and tens of millions of reconnections in the past week alone.