Perplexity open-sources SPACE agent sandbox: test your own

Perplexity is giving away SPACE, the sandbox it uses to contain its own AI agents. Semafor reported on October 15, 2026 that the company will release the agent sandbox as open source, and that CoreWeave, Akamai and Crusoe will offer it to their customers. The headline number: Perplexity told nine frontier models to break out, and none did in 118 tries.

What actually happened

From Semafor's report:

• What SPACE is. The sandbox runtime Perplexity uses to keep agents contained while they run code and use tools. It runs Perplexity's Computer agent.
• The test. Perplexity instructed nine frontier models to escape. Zero escapes in 118 attempts.
• The comparison. Perplexity says the same models could break out of other sandboxes that are not open source. It did not name them, so outside researchers cannot check that claim.
• Distribution. CoreWeave, Akamai and Crusoe agreed to offer SPACE to customers.
• The pitch. Perplexity's Zibi Braniecki compared the effort to the shared security guardrails that made web browsing and online payments safe.

The escape results are Perplexity's own red-team numbers. We have not seen an independent audit, and we could not confirm the license terms from a primary source at publish time. Read the license in the repo before you build on it.

Why an agent sandbox matters for your business

If you run an AI agent that executes code, browses or calls tools, the sandbox is the actual security boundary. The model's good behavior is not. This year has been full of reports of agents getting out of weak containment, and almost none needed a zero-day. They walked through network rules, mounted credentials or a host folder someone shared for convenience.

A free, production-tested sandbox lowers the bar for small teams. But "zero escapes for Perplexity" does not mean zero escapes for your config. Here is the short checklist we use:

• Credentials stay outside. The agent never sees a raw API key. A broker outside the sandbox makes the authenticated call.
• Network is deny-by-default. Allow the exact domains the job needs. Block everything else, including internal IPs and cloud metadata endpoints.
• One disposable environment per task. Tear it down when the job ends. Nothing persists that you did not choose to save.
• Red-team it yourself. Point a current model at your sandbox with the instruction to get out. Log what it tries. Repeat after every config change.

Sources: Semafor.