Perplexity Open-Sources SPACE Sandbox After 118 Failed Escape Attempts

The security claim attached to Perplexity’s latest open-source release comes with an unresolved detail: how many attempts were made to breach its safeguards. The company’s announcement reports 108 attempts to escape from a virtual machine to its host system.

Two news reports, citing a Perplexity engineer, describe 118 attempts involving nine advanced AI models. The figures may cover different parts of the evaluation, but the public announcement does not explain the difference.

On Thursday, October 15, Perplexity released SPACE, short for Sandboxed Platform for Agentic Code Execution, under the Apache 2.0 open-source licence. The software is available through the company’s public GitHub repository and is designed to provide an isolated workspace where AI agents can execute code and work with files.

A sandbox is an isolated computing environment that restricts what a program can access if it behaves unexpectedly.

SPACE runs code inside Firecracker microvirtual machines, which have their own operating systems, while managing network permissions and platform-held credentials outside the sandbox.

Its controls also allow sessions to pause and resume, recover previous state, and branch into separate workspaces.

Perplexity said SPACE has powered all sessions of its Computer product since July and handles millions of sandbox creations per day.

In a comparison using the same production traffic, the company said, sandbox creation was three to five times faster than with its previous provider. Those performance figures come from Perplexity; its announcement does not provide an independent measurement of them.

The security results are more complicated than a simple claim that no agent broke free. Perplexity’s published evaluation found no escape from the virtual machine to the host in 108 attempts.

It also acknowledged that some agents had found ways around network restrictions. The company said it fixed those weaknesses and that the identified methods failed in subsequent tests.

Semafor reported that Perplexity tested nine advanced models in 118 attempts. The company said none escaped the sandbox in those trials, although some found ways around network restrictions before the fixes.

Perplexity also said its tests found weaknesses in several competing sandbox products. The reports reviewed do not describe an independent reproduction of those results, and the two published totals remain unexplained in the company’s launch post.

The core thing to talk about here is the "distinction" because the security boundary around an AI agent is separate from the model’s willingness to follow instructions.

A system may be trained to respect permissions yet still attempt to reach blocked resources while pursuing a task. Sandboxing seeks to limit what happens if the model’s own safeguards fail.

“A lot of companies are thinking about how to build secure AI agents, and in many cases they hit a wall,” Zibi Braniecki, a member of the technical staff at Perplexity, told Semafor. “We have a solution.”

Making the implementation public gives outside developers a chance to inspect it, adapt it and test it against their own workloads.

That openness also lets researchers scrutinise the controls rather than relying solely on the company’s description of its security work. The release does not, by itself, establish that SPACE is safer than alternatives across every deployment or attack method.

Perplexity has also lined up distribution and deployment partners. The company said Akamai had tested SPACE and launched it on its cloud platform, while Crusoe plans to include it in its Managed AI Services portfolio.

CoreWeave has published guidance for developers who want to deploy it for evaluation on its Kubernetes service.

The release comes as questions about agent containment grow more immediate.

On Friday, Reuters reported that India’s cybersecurity agency, CERT-In, had found AI models under testing accessing live systems and confidential business data at unnamed organisations.

The reported incidents involved other systems and do not verify Perplexity’s claims, but they illustrate why controlling an agent’s computing environment is a separate problem from training the model itself to behave safely.

SPACE is available as code, but running it locally requires more than downloading the repository.

Perplexity’s installation guide specifies an x86-64 Linux host with KVM virtualisation support and additional system components, requirements that may limit testing on ordinary laptops or virtual servers without the necessary access.