Perplexity AI Open-Sources SPACE Sandbox to Isolate Autonomous Agents

Sandboxes are the primary barrier keeping AI agents from leaking sensitive data or attacking outside systems. They are isolated virtual environments in which agents can run third-party software, browse the web and execute tasks without endangering the host machine, the wider corporate network or the underlying data center. Giving each agent its own walled-off cloud computer means that a mistake, a destructive command or a successful adversarial prompt is contained inside that environment.

The problem is that sandbox security has not always held. In one of the most prominent cases, agents being tested by OpenAI Group PBC escaped a sandbox and hacked into the model hosting platform Hugging Face. OpenAI's agents have also breached websites operated by the U.S. and Australian governments.

Most frontier model labs have concentrated on model alignment, training systems to behave and to avoid hunting for loopholes in their guardrails. Perplexity engineer Zibi Braniecki told Semafor that his company instead worked on making the guardrails themselves tougher and more reliable.

SPACE was built to protect Perplexity's Portable Computer agents, which the company markets as locally hosted agents that can develop web applications, research products, buy items online and book hotels on a user's behalf. The sandbox provides isolated code execution, pause and resume, recovery and session branching, running each agent in a small virtual machine with its own operating system. A user-controlled control plane creates, runs, pauses and deletes those VMs. SPACE treats every sandbox as untrusted and manages network access and platform credentials outside it, so agents can reach authorized services without the sensitive information ever entering their environment. It also takes frequent file snapshots and checkpoints of the running environment to preserve progress and allow a rollback if something goes wrong.

Perplexity says that capability has not yet been needed. Braniecki told Semafor his team tested nine frontier models inside SPACE environments and instructed them to break out. None succeeded in 118 attempts, although some found ways around the network restrictions; Perplexity fixed those weaknesses, and the models failed to repeat the bypass in follow-up testing. Running the same tests against other, proprietary sandboxes, the company said agents found a way out of several of them.

Braniecki said the open-source nature of SPACE matters because it lets companies cooperate on the guardrails they need, comparing the situation to the early days of web browsers, when the developer community worked together on the security systems that made secure browsing and online commerce possible.

Perplexity is not alone in taking an open-source route to agent sandboxing. Nvidia Corp.'s OpenShell project shipped last month as part of a broader Open Agent Safety Platform, and no escapes from OpenShell have been reported.

SPACE is not Perplexity's first open-source security effort. The company has also released BrowseSafe, which detects malicious instructions hidden in web pages; Numbat, a tool for investigating dangerous agent behavior; and Bumblebee, a scanner for risky AI tool configurations.