Perplexity details SPACE, the sandbox runtime that isolates every AI agent action

Perplexity has published a technical account of SPACE, the sandboxing platform it built to run every code execution and file operation its AI agents perform, revealing that the system already handles all production traffic for Perplexity Computer, the company's agentic-browsing product.

What's new

In a research article titled "Making SPACE: Secure and Efficient Runtimes for Long-Running Agents," Perplexity describes the underlying architecture: "The sandbox itself is a virtual machine (VM) with its own guest kernel, running the user's workload behind a hardware isolation boundary." Each agent task runs inside its own microVM rather than a shared container, so code one agent executes cannot see or affect another agent's environment or the host machine.

Credential handling is a central design point. Perplexity writes that "credentials never live where an agent can steal them. The credential store sits outside the sandbox boundary and is responsible for the credential lifecycle," meaning API keys and tokens are injected only at the moment a task needs them rather than persisted inside the sandbox where a compromised or misbehaving agent could read them.

The article also discloses performance work behind the system: median sandbox-creation latency dropped from 185 milliseconds to 60 milliseconds, a 3.1x improvement, while 90th-percentile latency fell from 447 milliseconds to 89 milliseconds. Perplexity attributes the gains partly to a btrfs-based copy-on-write snapshot scheme that lets new sandboxes boot from a pre-warmed image instead of a cold VM, and to a space daemon running inside each guest that mediates network and file access through controlled channels instead of open access to the host.

For long-running agent sessions that need to survive interruptions, SPACE wraps each sandbox in a session object that can be paused, resumed, or branched into parallel sandboxes without losing state — a capability aimed at multi-step agentic workflows that can run for minutes or hours rather than a single request-response turn.

Context

SPACE was built, according to Perplexity, in roughly ten weeks and now underpins Perplexity Computer, the company's product for running autonomous browsing and coding agents on a user's behalf. As rival products from OpenAI, Anthropic, and Google increasingly let models execute code, browse the web, and manipulate files autonomously, the industry has converged on microVM-based isolation (popularized by AWS's Firecracker) as the baseline safety architecture for agentic execution, rather than trusting a model's own judgment about what actions are safe to take.

Why it matters

Agentic AI products only became broadly deployable once vendors could contain the blast radius of a misbehaving or manipulated agent — a concern underscored by recent public incidents of agents taking destructive unauthorized actions during coding sessions. By publishing the internals of SPACE, including concrete latency numbers and its credential-isolation model, Perplexity is making an implicit argument that agent safety is now as much an infrastructure and systems-engineering problem as a model-alignment one. The specificity of the disclosure — hardware isolation boundaries, credential lifecycle management, sub-100-millisecond sandbox creation — also signals that the operational cost of running agents safely at scale is becoming a competitive differentiator among AI companies building autonomous products, not just an internal engineering detail.