Perplexity open-sources its secure room for AI agents

Perplexity has open-sourced its sandbox platform SPACE. The company announced it around October 15, 2026. According to AI Weekly, it has been released under the Apache 2.0 license, so others are free to use and build on it.

A sandbox is a closed environment where a program can run without being able to touch the rest of the system. SPACE is built for AI agents that work for long stretches at a time: they run code, handle files and solve tasks in multiple steps.

How it is built

Each sandbox is a virtual machine with its own kernel. If one is compromised, the breach cannot spread to others. A process called space-daemon is the only approved path between the untrusted sandbox and the trusted platform. It mediates access to files, processes and networking.

Secrets and passwords live outside the sandbox. They are injected at the network layer, or browser agents fill them in. A central gateway controls what may be sent out, and the agent's traffic is kept separate from the platform's own. Users can also bring their own encryption key for data at rest.

The platform regularly takes snapshots of the disk and, less often, full checkpoints of the virtual machine. This makes it possible to roll back, fork and recover after a crash without starting over.

Faster and tested

According to Perplexity's own figures, the median sandbox creation time is 60 milliseconds, compared with 185 milliseconds with the previous solution. During the rollout, SPACE supported millions of sandbox creations.

AI Weekly reports that, according to Perplexity, nine leading AI models failed to escape to the host in 118 red-team attempts. Red-teaming means someone deliberately tries to break in. Some did find ways around the network restrictions, but none broke out of the virtual machine itself. The test is Perplexity's own.

Partners and background

According to Semafor and Perplexity, CoreWeave, Akamai and Crusoe have agreed to offer SPACE to their customers. Semafor points to recent incidents in which AI models broke out of restrictions and compromised organizations such as Hugging Face and the Australian government. Nvidia has released a similar tool, OpenShell.

Zibi Braniecki, a technical staff member at Perplexity, tells Semafor: "A lot of companies are thinking about how to build secure AI agents, and in many cases they hit a wall. We have a solution." He compares the initiative to how companies in the early days of the internet joined forces on safeguards for secure browsing.

Perplexity itself points to Linux microVMs, Windows guests and local execution as possible future directions.