Is Perplexity SPACE safe to use as a security boundary for untrusted agent code?

SPACE isolates each workload in a Firecracker microVM, which Perplexity's Secure Intelligence Institute tested by giving agents root in the guest and a host-side honeytoken to reach. No run reached it. The weaker boundary was network egress, where forged DNS responses and allowed IP addresses shared with other CDN services let agents call out. Perplexity reports both methods failed after its fixes.

Which models bypassed SPACE's network restrictions in the evaluation?

Four models got around a partial-network egress policy during Perplexity's September 2026 evaluation: Claude Opus 5.0, GPT-5.6 Sol, GPT-5.6 Cyber and Kimi K3. None of the nine models tested escaped the microVM to reach the host. Perplexity traced the bypasses to forged DNS responses and to allowed IP addresses shared with other services on the same CDN.

How do I try SPACE without running a Kubernetes cluster in production?

SPACE documents a local Kind cluster as its starting point, and the repository's installation guide covers deploying, authenticating and running a first command. Perplexity also ships an E2B compatibility wrapper, tested with the E2B Python SDK, so code written against E2B can target SPACE instead. The architecture guide states that running SPACE outside Kubernetes is possible.

INFOTool

Perplexity SPACE: the microVM sandbox behind Computer goes open source

SPACE gives defenders a self-hostable microVM sandbox for untrusted agent code, with its own escape testing published.

October 15, 2026 · Perplexity · Research by Perplexity, Kyle Polley (Perplexity Secure Intelligence Institute), Ninghui Li (Perplexity Secure Intelligence Institute), Yuntao Du (Perplexity Secure Intelligence Institute), John Louie (Perplexity Secure Intelligence Institute), Kumar Pallav (Perplexity Secure Intelligence Institute)

AI agents

Open-sourcing SPACE, the sandbox platform behind Computer

INFOTool

SPACE is the Firecracker microVM sandbox behind Perplexity's Computer agent, now open source under Apache 2.0. Perplexity reports no escape from guest to host in 108 red-team runs, but agents did get around its network policy.

01What happened

Perplexity released SPACE, the sandbox platform behind its Computer agent, as open source on 15 October 2026. The code is on GitHub, written in Rust, and carries an Apache 2.0 license. Perplexity says SPACE has run every Computer session since July 2026 and handles millions of sandbox creations a day.

02How it works

Each SPACE sandbox is a Firecracker microVM with its own operating system, so agent code is separated from the host by a virtualization boundary instead of container namespaces. A control plane creates, pauses, resumes and deletes sandboxes over an HTTP API, and keeps network egress policy and platform credentials outside the guest. Snapshots store changes rather than repeated full copies, which lets a session pause and resume later.

03Who is affected

Teams that run agent or user code they do not trust are the intended users. Kubernetes is the documented deployment path, with a local Kind cluster and a reference EKS setup, and the architecture guide says operation outside Kubernetes is possible. An E2B compatibility wrapper exposes an E2B-compatible API, tested against the E2B Python SDK, and Akamai, Crusoe and CoreWeave are named as deployment partners.

04What to do

Read SPACE's isolation model and its published escape testing before treating the sandbox as a security boundary, and confirm the egress fixes are present in the commit you deploy. Keep network policy and platform credentials on the host side, as SPACE's own design does, rather than inside the guest.

Questions people ask

Is Perplexity SPACE safe to use as a security boundary for untrusted agent code?: SPACE isolates each workload in a Firecracker microVM, which Perplexity's Secure Intelligence Institute tested by giving agents root in the guest and a host-side honeytoken to reach. No run reached it. The weaker boundary was network egress, where forged DNS responses and allowed IP addresses shared with other CDN services let agents call out. Perplexity reports both methods failed after its fixes.
Which models bypassed SPACE's network restrictions in the evaluation?: Four models got around a partial-network egress policy during Perplexity's September 2026 evaluation: Claude Opus 5.0, GPT-5.6 Sol, GPT-5.6 Cyber and Kimi K3. None of the nine models tested escaped the microVM to reach the host. Perplexity traced the bypasses to forged DNS responses and to allowed IP addresses shared with other services on the same CDN.
How do I try SPACE without running a Kubernetes cluster in production?: SPACE documents a local Kind cluster as its starting point, and the repository's installation guide covers deploying, authenticating and running a first command. Perplexity also ships an E2B compatibility wrapper, tested with the E2B Python SDK, so code written against E2B can target SPACE instead. The architecture guide states that running SPACE outside Kubernetes is possible.

Sources 3 links, all fetched

1perplexity.aiOpen-Sourcing SPACE
2github.comSPACE on GitHub
3perplexity.aiEscaping SPACE: Part I