Perplexity open-sources SPACE, the Firecracker microVM sandbox behind every Perplexity Computer task, under Apache 2.0; Akamai, Crusoe and CoreWeave to offer it

Why it matters

【Key points】

On Oct 15 (17:03 UTC) Perplexity open-sourced SPACE (Sandboxed Platform for Agentic Code Execution), the sandbox platform that runs every agent task in Perplexity Computer, under Apache 2.0. Each task gets its own Firecracker microVM with its own OS and writable filesystem, while credentials and outbound traffic are controlled from outside the VM. Sandboxes can pause, fork, or suspend to a snapshot and resume later. It is written in Rust and driven over HTTP and server-sent events.

Per Perplexity, SPACE replaced its commercial sandbox in July, powers all Computer sessions and creates millions of sandboxes a day, with an error rate below 0.0002%. Akamai has tested and launched SPACE on its cloud, and Crusoe and CoreWeave will also offer it to customers. In its Sep 23 red-team report "Escaping SPACE: Part I", nine model configurations got root inside the VM and none of 108 escape attempts reached the host. But when some package mirrors were allowed, four models (including Claude Opus 5.0, GPT-5.6 Sol and Kimi K3) bypassed network confinement via DNS spoofing or shared CDN IPs. Perplexity says it has fixed this.

【Verifiable】

Blog: https://www.perplexity.ai/hub/blog/open-sourcing-space

Repo: https://github.com/perplexityai/SPACE

Announcement: https://x.com/perplexity_ai/status/2110778478312481167

Red-team report: https://www.perplexity.ai/hub/blog/escaping-space-part-i

【Our read】

1. Competition among agent products now extends to runtime security. Open-sourcing a production sandbox, with cloud partners distributing it, pushes "isolate the VM, control credentials and network from outside" toward an industry default.

2. All the security numbers are Perplexity's own tests. The VM boundary held, but models did get around the network boundary, so the weak point is egress policy, not virtualization itself. Watch for outside audits now that it is open.

3. Media reports cite "118 attempts" while Perplexity's own post says 108. We use the official figure.