Perplexity introduced SPACE on July 15, a sandbox architecture that destroys the virtual machine running an AI agent’s task the instant that task finishes. The system already powers Computer, Perplexity’s own agent product, and it determines whether a hijacked agent can reach a user’s stored credentials at all. That design choice drops Perplexity into an unresolved problem across the agent industry: tools that need broad file and code access are also the tools most exposed to prompt injection and credential theft.
SPACE splits the job across three layers. The Control Plane sits on top, running the sandbox’s lifecycle from one API endpoint: it decides when a task needs a new environment and when an existing one gets shut down. Because that layer is stateless and centrally hosted, Perplexity says the same API call works whether the backend is its own cloud or a customer’s local machine.
Node-level Services sit beneath the Control Plane, and this is where the security design does its real work. Outbound network traffic is restricted at this layer, so a compromised agent cannot reach anything outside its assigned scope. Credentials follow the same rule. Perplexity says they only enter the environment at the instant a task actually needs them, handed in from outside the sandbox, such as during a Google Account sign-in, rather than stored inside it.
The bottom layer places each task inside its own Firecracker microVM, the lightweight virtualization technology AWS built for Lambda. Nothing that happens inside one task can reach the host machine or another task running beside it. A single internal process, the Space Daemon, is the only channel that talks back to Perplexity’s control systems, which keeps that communication auditable.
Long agent sessions do not vanish when the underlying sandbox is destroyed. A session layer sits above every sandbox, letting work pause, resume, or fork into several parallel environments, while rolling snapshots capture memory and files as often as once a minute. Perplexity says a person can step away from a task and pick it back up as much as a week later, working from the saved state even though the original virtual machine no longer exists.
Enterprise customers get an extra lever: encryption keys they control themselves. If a customer revokes its key, Perplexity says new sandboxes tied to that account cannot start and previously encrypted data becomes permanently unreadable. SPACE can also run entirely on a customer’s own servers or fully offline, an option most agent platforms built around hosted cloud inference cannot match.
Perplexity says engineers built SPACE in ten weeks, ran it internally for two months, and now use it to serve every Computer user. Over the past week alone, the company reports sandbox creation counts in the millions and sandbox reconnections in the tens of millions. On an early Nvidia Vera CPU test, Perplexity says the same Computer-style workflows ran about 1.5 times faster than its current production setup, with concurrent sandboxes starting as much as 1.9 times quicker. All of those figures come from Perplexity’s own measurements; the company has not published comparisons against the off-the-shelf sandbox providers it says it evaluated before deciding to build SPACE itself.
The bet underneath SPACE is that agent security needs to be solved at the infrastructure layer, not the model layer, a wager that matters more as agents get more autonomy over real files and accounts. Coding agents with broad system access, from Cognition’s Devin to OpenAI’s Codex, have already drawn scrutiny over what happens when a long session goes wrong. Perplexity is now marketing directly against that gap, betting that credential isolation and disposable execution environments become a purchasing criterion before a security incident forces the issue.
Any team piloting an agent product with access to real credentials, files, or codebases should ask its vendor the same two questions Perplexity is answering with SPACE: how long a credential lives inside the execution environment, and what happens to that environment the moment the task ends.
Perplexity detailed the SPACE sandbox architecture in a July 15, 2026 post on its own company blog.
