Perplexity just gave away its most valuable agent infrastructure. Perplexity SPACE open source is now a fact — the sandbox behind its Computer agent, free on GitHub under Apache 2.0, handling millions of sandbox creations per day.
We covered the announcement when it broke. This is the practical follow-up: what developers actually get, how to deploy it, and how to profit.
What Perplexity just gave away
SPACE stands for Sandboxed Platform for Agentic Code Execution. Every agent session gets its own isolated Firecracker microVM — a tiny virtual machine with its own OS — instead of software boundaries inside a shared system.
Your app talks to SPACE over a plain HTTP API: create a Linux environment from a template, run commands, stream the output. No Rust knowledge needed — Perplexity’s own walkthrough runs on standard-library Python alone.
The trust model is the part that matters. The sandbox is treated as untrusted by default:
- Credentials live outside the VM. Agents call authorized services without API keys entering their workspace.
- Network access is host-controlled. The sandbox can’t reach places you didn’t approve.
- State survives. Snapshots and checkpoints make pause, resume, and branching cheap — long-running agents stop for review and pick up where they left off.
The official numbers
Perplexity published the figures in its announcement — and they are why this release matters:
Honesty check: Perplexity also disclosed that its red team did find ways around some network restrictions — fixed since, with no successful follow-up attacks. It even reported related weaknesses in other sandbox platforms to their vendors. That transparency is why open source matters: the claims are now auditable by anyone.
SPACE key specs (from the official repo)
| Spec | What the docs say |
|---|---|
| Isolation | AWS Firecracker microVMs — one VM per sandbox |
| Interface | HTTP API + server-sent events; lifecycle calls return an operation ID you poll |
| Implementation | Rust — but apps never embed the library |
| License | Apache 2.0 — free for commercial use |
| Migration path | E2B compatibility wrapper works with the tested E2B Python SDK |
| Docs | Hosted guide + API reference, auto-updated from the repo |
How it works: from clone to first sandboxed run
The official install guide walks you through this path:
The host requirements are concrete: apt-based Linux x86_64 with KVM (/dev/kvm, /dev/net/tun), btrfs, and Docker with privileged containers. No macOS.
How to profit: the freelancer and agency playbook
Free, production-tested agent infrastructure changes the math for anyone selling AI work. Sandbox bills were a real line item for agent shops; SPACE zeroes it out.
- Ship client agents with real isolation. Run every client agent in its own SPACE sandbox so a compromised agent can’t touch the host or your API keys. Enterprise clients already ask for this.
- Offer “sandboxed agent hosting” as a service. Deploy SPACE for a client, wrap the HTTP API in a dashboard, charge a monthly retainer. Akamai and Crusoe are already moving this direction.
- Migrate off paid sandbox bills. The E2B compatibility wrapper works with the tested E2B Python SDK, so existing projects move with minimal rewrites. Quote the client the savings; keep part of the margin.
- Sell the security story. Perplexity published its red-team methodology. Run the same escape-attempt playbook against your deployment and hand the client a report. Auditable safety is a premium feature.
- Start local, scale when revenue lands. The official guide deploys SPACE in a local Kind cluster — no cloud bill while you prototype. Move to cloud only when a paying client needs it.
FAQ
What is Perplexity SPACE?
The Sandboxed Platform for Agentic Code Execution — each AI agent session runs inside its own Firecracker microVM. Open-sourced October 15, 2026.
Is Perplexity SPACE really free?
Yes — Apache 2.0 permits commercial use. Your only cost is the compute you run it on.
What hardware do I need?
Linux x86_64 with KVM, btrfs, and Docker (privileged) — no macOS.
How is SPACE different from Docker?
Docker isolates processes with software boundaries in a shared kernel. SPACE gives each sandbox its own microVM with its own OS — hardware-level isolation — plus agent features like pause/resume and external credential management.
Can I migrate my existing E2B-based agents?
The repo ships an E2B compatibility wrapper that works with the tested E2B Python SDK. Check the wrapper’s documented limitations in the repo first.
Didn’t Perplexity find security holes in SPACE?
Its red team found ways around some network restrictions — not VM escapes; there were zero of those in 108 attempts. Perplexity says it fixed them, confirmed with follow-up testing, and disclosed related issues to other sandbox vendors. Cloud partners tell the rest of the story: Akamai has tested and launched SPACE on its cloud, Crusoe is adding it to Managed AI Services, and CoreWeave published setup guidance for CKS.
Sources
- Perplexity official blog: Open-sourcing SPACE — the October 15, 2026 announcement; source of the production figures, red-team results, and cloud partnerships.
- SPACE on GitHub — official repository, Apache 2.0; README documents the architecture, HTTP API, E2B wrapper, and license.
- Perplexity: Escaping SPACE, Part I — the published September 2026 red-team security evaluation.