Perplexity Open-Sources SPACE MicroVM Sandbox for AI Agents

The SPACE codebase, written in Rust and released as version 0.8.0, is available under the Apache 2.0 license on GitHub. It features an HTTP API and server-sent events, and requires a Linux x86_64 host with KVM, Docker, and btrfs. macOS is not supported.

In production, Perplexity observed a significant performance improvement, with median create latency dropping from 185 ms to 60 ms compared to their previous provider. Across 9 frontier models, zero out of 108 VM-to-host escape attempts were successful.

SPACE, which stands for Sandboxed Platform for Agentic Code Execution, is Perplexity’s solution for running agent code within isolated microVMs. Applications can utilize its HTTP API to establish Linux environments, execute commands, and stream output. A template provides the initial filesystem, and each sandbox is an instance of this template with its own VM and writable disk.

The architecture ensures that agents can run commands, install packages, and call services with root privileges inside the sandbox, while the host system remains outside the guest’s control. This design is crucial for long-running, stateful, and branching agent work that needs to survive restarts.

Isolation is achieved through Firecracker microVMs, each equipped with its own guest kernel. A per-sandbox network gateway on the host enforces egress policies on all outbound connections. Secrets are never exposed to the guest VM; instead, credentials are injected at the network layer with hierarchical scoping, rate limits, and audit logging.