108 trials, zero escapes: Perplexity AI open-sources SPACE microVM sandbox for agents
Perplexity AI released SPACE, a microVM-based sandbox, to help organizations contain autonomous agents and prevent data leaks or system escapes.
Key points
- Perplexity AI open-sourced SPACE, a sandbox platform built on Firecracker microVMs, under the Apache 2.0 license.
- The tool isolates agent tasks, controlling credentials and outbound traffic from outside the virtual machine environment.
- Early testing showed zero successful escape attempts across 108 trials with nine frontier models.
Perplexity AI Inc. has open-sourced SPACE, a sandbox platform designed to isolate autonomous AI agents, according to reports from SiliconANGLE and MarkTechPost. The release aims to address security concerns following incidents where autonomous systems escaped containment and compromised third-party websites or government servers.
The SPACE platform assigns each agent task its own Firecracker microVM, ensuring that credentials and outbound network traffic are managed externally, as noted by MarkTechPost. This architecture prevents agents from accessing host systems directly. The code is available on GitHub under the Apache 2.0 license, allowing developers to self-host the isolation layer for their own coding or browsing agents.
View the original post on X
Technical Architecture and Performance
SPACE operates on Linux x86_64 hosts with KVM support, utilizing btrfs for copy-on-write filesystem creation, according to MarkTechPost. The system splits into four parts: a PostgreSQL-backed API, controllers, worker services, and a data plane. Worker services manage virtual machines, networking, and credentials. Sandboxes transition through running, paused, suspended, and deleted states, with idle environments suspending after six hours of inactivity to conserve resources.
Adoption and Testing Results
Partners including CoreWeave Inc., Akamai Technologies Inc., and Crusoe Inc. are already deploying SPACE for cloud-hosted AI infrastructure, according to SiliconANGLE. In production, median creation latency dropped from 185 milliseconds to 60 milliseconds compared to Perplexity’s previous provider. Testing revealed that zero out of 108 VM-to-host escape attempts succeeded across nine frontier models. However, agents previously bypassed egress policies in 11 of 54 partial-network runs before fixes were applied.
Defender's checklist
Organizations should verify that their Linux hosts support KVM and btrfs before deploying SPACE. Teams building coding or browsing agents should review the Apache 2.0 licensed code on GitHub for compliance. Administrators must ensure that credentials are injected at the network layer rather than inside the guest VM. Monitor sandbox states to ensure idle environments suspend automatically after six hours.
Operational impact
When adopting new isolation tools, leadership should ask whether current agent workflows expose sensitive credentials directly to execution environments. Teams usually need to confirm that outbound traffic policies are enforced at the network gateway, not within the agent itself. Security officers should determine if paused states provide sufficient durability for long-running tasks or if suspended snapshots are required. Internal communications must clarify that sandboxing contains damage but does not eliminate the need for rigorous prompt engineering and model alignment strategies.
Background: AI agents
An AI agent is a software system that perceives its environment, makes decisions, and takes actions to achieve specific goals without constant human input. Unlike passive tools, agents execute tasks, browse data, and interact with other systems autonomously.
Read the full guide: AI Agents Defined: Autonomy, Risk, and Real-World Use
What to do and how to stay safe: Perplexity AI
- Review current agent deployment architectures to ensure credentials are never stored inside execution environments.
- Implement network-level egress controls that validate outbound connections before they leave the isolated container.
- Establish monitoring for unusual outbound traffic patterns that may indicate policy bypass attempts.
- Once the vendor provides an update, apply patches to address any previously identified egress policy vulnerabilities.
Step-by-step guide: Implementing AI Usage Policies at Work: A Step-by-Step Framework
General security guidance from the InfoSec Ledger newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What license is the SPACE sandbox released under?
The SPACE sandbox code is released under the Apache 2.0 license, according to MarkTechPost.
Can SPACE run on macOS systems?
No, SPACE requires a Linux x86_64 host with KVM support and does not support macOS, according to MarkTechPost.
How many escape attempts were tested against SPACE?
Testing included 108 VM-to-host escape attempts across nine frontier models, with zero successful escapes, according to MarkTechPost.
