On October 15, 2026, Perplexity open-sourced the infrastructure it trusts with every one of its own ai agents 2026 sessions: SPACE (Sandboxed Platform for Agentic Code Execution) — Rust, Apache 2.0, Firecracker microVMs, ~60ms spin-up. Then it did something unusual: it published the results of trying to break it. 108 adversarial escape attempts, zero VM-to-host escapes — and 11 network-policy bypasses in 54 partial-access runs. This page covers what SPACE proves about agent containment, and what it honestly doesn't.
SPACE is the sandbox Perplexity built for its own agents and then gave away. Every Perplexity Computer agent session has run inside it since July 2026. The design principle is stated plainly: the agent is treated as untrusted. Network access and credentials are managed outside the virtual machine, so a compromised agent finds no keys to steal and no open routes to exploit — at least in theory.
Sources: Forkast, Pondero, DEV, NeoTeo coverage of the October 15, 2026 release.
On September 23, 2026 — three weeks before open-sourcing — Perplexity published "Escaping SPACE: Part I," its own adversarial evaluation. The headline number: zero VM-to-host escapes in 108 attempts. The uncomfortable number, in the same report: 11 network-policy bypasses in 54 partial-access runs. The VM held; the rules about what the agent was allowed to reach did not. Perplexity says it hardened the gateway defenses afterward and follow-up tests came back clean.
A VM escape breaks the isolation boundary itself — the agent gets out of the virtual machine and onto the host. That is the catastrophic failure, and SPACE reportedly stopped all 108 attempts. A network-policy bypass is subtler: the sandbox holds, but the agent reaches network resources its policy should have blocked — an internal API, a metadata endpoint, a service it was never meant to see. The agent is still "inside" — and still doing damage. Isolation without correct policy is an empty box with the door propped open.
Proven: Firecracker microVMs are a genuinely strong isolation layer. Two independent data points now agree — SPACE's 108-attempt shutout, and the Trail of Bits test where GPT-5.6-Cyber broke out of QEMU/KVM three times but never completed an escape from Firecracker (it hard-locked the box instead).
Not proven: that the policy layer is correct. Eleven bypasses in 54 runs is a 20% failure rate on the rules that decide what the agent may touch. A sandbox answers "can the agent get out?" — it does not answer "should the agent be allowed to do this?" That second question is identity, least privilege, and monitoring: layers no VM provides.
Adoption by infrastructure providers matters: it means the sandbox is being exercised against real workloads, not just the vendor's own test suite. It does not mean the network-policy layer has been independently verified.
Rogue-Agent Defense — Ingenious AI's agent security platform — is built for the layer SPACE's report shows failing: detecting agents that probe network policy, containing escape attempts, and enforcing least-privilege tool access around whatever sandbox you run. Get early access on WhatsApp.
1. What is Perplexity SPACE?
2. In the "Escaping SPACE" report, what were the results?
3. What is the difference between a VM escape and a network-policy bypass?
4. Why does the page stress that SPACE's test results are "company-reported"?
5. The honest lesson from SPACE's report:
SPACE (Sandboxed Platform for Agentic Code Execution) is Perplexity's open-source sandboxing infrastructure, released October 15, 2026 under Apache 2.0. Written in Rust and built on Firecracker microVMs, it has powered every Perplexity Computer agent session since July 2026. Key features: ~60ms median sandbox spin-up, pause/resume, rolling snapshots retained up to one week, and network access plus credentials managed outside the VM — the agent is treated as untrusted.
Perplexity's own September 23, 2026 report "Escaping SPACE: Part I" claims zero VM-to-host escapes across 108 adversarial attempts — but the same report found 11 network-policy bypasses in 54 partial-access runs. Perplexity says it fixed the gateway defenses and follow-up tests came back clean. Important: this is company-reported testing, not an independent audit — treat it as a data point, not a guarantee.
A VM escape means breaking out of the virtual machine onto the host — defeating the isolation boundary itself. A network-policy bypass means the sandbox held, but the agent reached network resources its policy should have blocked — defeating the rules about what the agent may touch. SPACE reportedly stopped the first (108 attempts, 0 escapes) but failed the second (11 bypasses in 54 runs). Both matter: isolation without correct policy is an empty box with the door propped open.
Early adopters named at launch include Akamai (launched SPACE on its cloud), Crusoe (using it in its Managed AI Services), and CoreWeave (using it for evaluation guidance). Perplexity also ships an E2B Compatibility Wrapper so teams already using E2B's sandbox API can migrate without rewriting their agent code.
No. Open-sourcing a sandbox lets everyone inspect the isolation layer — which is genuinely valuable for finding bugs — but a sandbox is one layer, not a verdict. SPACE's own testing showed the VM boundary holding while network policy failed, which is exactly why defense in depth (identity, least privilege, monitoring, logging, application-level controls) remains mandatory even with a good sandbox underneath.