@ScarletKc: Perplexity has open-sourced SPACE, the sandbox platform behind Computer, under Apache 2.0. I think this is pretty signi…

Perplexity has open-sourced SPACE, the sandbox platform behind Computer, under Apache 2.0. I think this is pretty significant for folks building agent harnesses. The toughest part of a harness to get right on your own is the environment for running agent code—now you can just take the exact setup Perplexity uses online and deploy it yourself.

Before, you’d either hook into a commercial sandbox like E2B or cobble something together with Docker, handling isolation, state recovery, and key management all yourself. SPACE now runs all of Computer’s sessions, spinning up millions of sandboxes every day.

Each sandbox is a Firecracker microVM with its own kernel. They specifically tested escape attempts with models like Opus 5.0, GPT-5.6 Sol, Kimi K3. The agent had root in the guest, and some even got source code and network access—out of 108 tries, not a single one escaped to the host. The network restrictions got bypassed 11 times, though. One way was forging DNS responses inside the guest, the other was leveraging a CDN’s shared IP to hit blocked services. Both holes got patched, and retests didn’t succeed again.

Opus actually thought of the shared IP angle too. But the task prompt said not to touch other external systems, so it figured using a third-party service to get around would violate the constraints and didn’t try it. In the end, it bypassed via forged DNS.

They tested 10 other sandbox platforms with the same method, and 8 could bypass network restrictions. Some have already fixed it, E2B is still working on it, and Modal and Vercel see it as a known limitation. Keeping the VM from escaping and locking down the network are two different things—rolling your own egress allowlist doesn’t necessarily stop a determined agent.

SPACE keeps credentials out of the sandbox too. Keys stay in an external credential store, injected at the network layer, with all outbound traffic routed through a gateway for policy-based approval. Even if the agent falls to prompt injection, it can’t read the keys from inside the sandbox.

Suspend snapshots memory, processes, and filesystem together, so you can recover on a different node later. Agents can pause for human review and pick right back up. If a long task crashes midway, you can resume from the latest checkpoint without rebuilding the environment from scratch.

It also supports rollback and fork. If an agent runs a destructive command, you can just revert—or duplicate the workspace into two, letting it test both approaches in parallel.

It even includes an E2B compatibility layer. A harness written with the E2B Python SDK just needs a tweak to the domain and API key to switch over to your self-hosted SPACE.

The bar is Linux x86_64 plus KVM; the official guide runs on Kubernetes. Won’t work on Mac, and VPSes without /dev/kvm are out too.

Perplexity (@perplexity_ai): We’re open sourcing SPACE, the sandbox platform that runs every task in Perplexity Computer.

SPACE gives each agent task its own Firecracker microVM and controls credentials and outbound traffic from outside the VM.

Available now under Apache 2.0: