Perplexity published the code for SPACE on 15 October, the software that builds and manages the isolated virtual computers its Computer agent does its work inside. The company’s own security testing found no way out of one of those machines to the host computer in 108 attempts. It also found that some attacks got around the restrictions on what the sandbox could reach over the network.
That second result deserves more weight than the first. Keeping an agent inside its machine is the headline figure, and the company printed it first. But an agent that cannot leave the machine and can still reach the network has not been contained in the way that matters, because sending data out requires no escape at all. Per its blog post, Perplexity says it repaired the weaknesses, and when it tested again, neither of the two attack routes it had identified worked. The post does not say how many of the 108 attempts found a route around the network limits, what the two methods were, or who judged the retest. Those details sit in a security evaluation the post says Perplexity has published, which this article has not reviewed.
What is new today. The code, and only the code. SPACE is not a new product: according to Perplexity, it replaced a commercial sandbox vendor in July and has run every Computer session since. Perplexity launched Computer in February. What changed on 15 October is that anyone can now read it, run it, and build on it. The post does not name a licence, which for an open-source release is a real gap. Without one, developers cannot tell what they are allowed to do with the code, and the post defers to the repository and documentation for supported configurations.
How it is built. Every sandbox is its own miniature virtual computer, running a separate operating system, so the machine underneath sits behind a wall from anything the agent does. A central coordinator controls each workspace’s life, from start to deletion. Network access and credentials are held outside the sandbox, so an agent can use an approved service without holding the password. SPACE also snapshots running state, so a paused job returns with its files intact and a workspace can be copied to try two approaches.
The speed claim. On the same production traffic, Perplexity says, spinning up a sandbox took a third to a fifth of the time it did with the vendor it dropped, and SPACE now handles millions of new sandboxes a day. That is Perplexity measuring itself against a vendor it chose to drop, on its own load. The post names no independent evaluation.
A competitor’s incident, used as a selling point. The post says a barrage of testing showed SPACE held up against techniques for slipping past network controls “like those used in the OpenAI/Hugging Face incident.” That equivalence is Perplexity’s characterisation. The post is not a source on what happened in that incident, and nothing here confirms the techniques match.
The argument underneath. Most of the industry’s response to agents misbehaving has been to train the model to behave better. Perplexity concedes that model safeguards lower the odds of unsafe behaviour. Its argument is that separate controls built into the system around the model limit the damage when those safeguards fail. Its reasoning is that agents pursuing legitimate tasks cross boundaries when they hit a missing file or a denied permission and try to work around it. A model that is persuaded it should try harder is not stopped by a better prompt. It is stopped by a machine that has nothing to steal and nowhere unapproved to send it.
The network bypasses show why that argument needs the testing behind it. Walls built outside the model only help if they hold when the agent is trying to get past them, and the first round of Perplexity’s tests found that one of them did not.
Who can run it without building it. Akamai has tested SPACE and put it live on its own cloud. Crusoe is adding it to its managed AI services. CoreWeave, for its part, has written setup instructions for developers who want to try it on CKS.
For any team letting an agent run code, the first test to copy from this release is the network one: give an attacking agent a locked-down sandbox and see what it can still reach, before trusting the escape-proof figure.
Based on Perplexity’s blog post “Open-sourcing SPACE, the sandbox platform behind Computer” of 15 October 2026
