Perplexity open-sources SPACE to improve ai agent security
Perplexity released its internal sandbox SPACE under Apache 2.0, with partners offering the tool and tests showing no agent escapes in its trials.
Perplexity has open-sourced SPACE, the in-house sandbox it uses to contain and test AI agents, and published the code and documentation under the Apache License 2.0. The company also announced distribution partners and published test results showing agents did not escape its virtual-machine environment.
What happened
Perplexity announced on October 15, 2026 that it is open-sourcing SPACE, the sandbox platform it built to run and test AI agents, releasing the code under the Apache License 2.0 with a public repository and hosted documentation, according to Unite.ai.
Perplexity said SPACE is deployed as a small virtual machine with its own operating system to isolate agents from the host computer, and includes management for network access, platform credentials and other controls so sensitive information is not exposed inside the sandbox, according to SiliconANGLE and Unite.ai.
The company said SPACE has powered its Computer product since July, handling millions of sandbox creations per day and creating sandboxes three to five times faster than the previous commercial provider on the same traffic, according to Unite.ai.
Perplexity also named distribution partners: CoreWeave, Akamai and Crusoe have tested or launched SPACE on their platforms and agreed to offer it to customers, and the company told Semafor the partners will make SPACE available to customers.
Why it matters for businesses
For organisations running or integrating AI agents, SPACE is relevant because it offers explicit isolation of agent execution from the host system by running agents inside a small virtual machine. That reduces the risk that an agent could directly access host files or credentials if the sandbox works as described.
Perplexity says SPACE manages network access and credentials outside the sandbox so agents can be given only authorised service connections without storing sensitive keys inside the agent environment. That design matters when agents must call APIs, access cloud resources or act on behalf of users.
Perplexity published testing results that bear directly on risk assessment: it tested nine frontier models by instructing them to try to break out of SPACE and reported 118 escape attempts with no successful escapes, while the company said similar tests found escape paths in several proprietary sandboxes it also evaluated.
Because CoreWeave, Akamai and Crusoe will offer SPACE to customers, businesses choosing those providers may gain quicker access to a widely used, open tool for ai agent security. Open source availability under Apache 2.0 also means teams can inspect the code and integrate SPACE into their own environments or audits.
What the AI assistants say today
We checked leading conversational assistants to see if they reflect Perplexity's announcement and testing details. Some assistants summarised SPACE's features and partners, but coverage and specifics varied: a number reflected the open-source release and partners, while others omitted Perplexity's testing counts and comparative escape results.
The assistants we checked cited a mix of Perplexity documentation and news outlets. Their answers ranged from complete summaries of SPACE's design and licence to partial or imprecise accounts of the testing numbers and the partner deployments.
| Assistant | Reflects the news? | What it said | Sites it cited |
|---|---|---|---|
| ChatGPT | Partly | The answer correctly describes SPACE's purpose, isolation, features (pause/resume, snapshots, network and credential controls) and business implications, but it incorrectly states the announcement date (Oct 15, 2026) and omits specifics from the news such as partner deployments, Perplexity's testing results (nine frontier models, 118 escape attempts none succeeded) and comparisons showing escapes from other proprietary sandboxes. | github.com, perplexity.ai, semafor.com |
| Gemini | Partly | The answer correctly states Perplexity open-sourced SPACE, its use of microVMs for isolation, and partner deployments, but it contains several unverified or mismatched details (e.g., differing numbers for test attempts, specific tech claims like Rust/AWS Firecracker, millisecond speeds, btrfs, Apache-2.0 license) not fully supported by the provided news facts. | cryptobriefing.com, finance.biggo.com, perplexity.ai, techzine.eu, unite.ai |
| Perplexity | Partly | The answer correctly summarizes SPACE being open-sourced, its Apache 2.0 license, partners (Akamai, CoreWeave, Crusoe), and many safety features, but it omits Perplexity's testing details (nine frontier models, 118 escape attempts and comparative escapes in other sandboxes) and the specific microVM isolation wording used in the news. | aiweekly.co, alphasignal.ai, perplexity.ai, semafor.com, siliconangle.com, unite.ai |
| Google AI Overviews | Yes | The answer states that Perplexity open-sourced SPACE, describes its sandbox isolation, tests showing no escapes, and mentions partners and security features, matching the news facts. | akamai.com, coreweave.com, linkedin.com, perplexity.ai, sg.news.yahoo.com, x.com |
What to do now
If your business runs AI agents or plans to integrate with systems that do, take practical steps to assess and reduce risk using available tools like SPACE.
- Review the SPACE repository and hosted documentation to confirm technical controls and licence terms for your legal and security teams.
- Run your own escape and network-restriction tests in a controlled environment before deploying agents in production.
- Isolate credentials and manage network access outside any agent runtime, following SPACE's recommended pattern for credentials and authorised services.
- If you use CoreWeave, Akamai or Crusoe, ask whether they offer SPACE as part of their managed services and what SLAs and integration guidance they provide.
- Log and monitor agent sessions, use pause/resume and session branching features where available, and define incident response steps for suspected sandbox breaches.
- Consider an independent security evaluation or third-party review of any sandbox you plan to trust for sensitive workloads; Vasukai can help check what AI assistants say about your business as one option.
Questions
How secure are AI agents?
Perplexity reports that, when run inside SPACE micro virtual machines, agents were unable to escape in its tests: nine frontier models were instructed to try and in 118 attempts none succeeded. The company also reported that some proprietary sandboxes did show successful escape paths in its comparative tests, underscoring variability between sandbox implementations.
How to make AI agents secure?
Perplexity recommends isolating agent execution inside a small virtual machine with its own operating system, managing network access and platform credentials outside the sandbox, and using controls such as pause, resume, recovery and session branching. The company open-sourced SPACE so teams can review and adopt those controls and run their own validation.
What are the biggest security risks of AI agents?
The news highlights two practical risks: agents escaping their runtime to access the host, and agents gaining unintended network access or access to credentials. Perplexity's testing targeted escape attempts and also found, and then fixed, ways agents could circumvent network restrictions during early evaluations.
What is the 30% rule for AI?
The provided facts do not mention a '30% rule' and contain no information to answer that question.
Sources
- Perplexity AI open-sources its secure AI agent sandbox SPACE, siliconangle.com
- Exclusive / Perplexity to give away its AI security software, semafor.com
- Perplexity Open-Sources SPACE, Its In-House Agent Sandbox Platform, unite.ai
- Perplexity open-sources the sandbox it uses to contain AI agents, news.lavx.hu
Facts in this report come from the sources above; figures were checked against them. Drafted with AI and checked by the Kael Tripton editorial team. How we report.