# EP 18: How Do You Sandbox an AI Agent? Perplexity SPACE Explained - URL: https://www.agenticpod.net/episodes/ep18-perplexity-space-agent-sandbox/ - Watch on YouTube: https://www.youtube.com/watch?v=W97uhhINoq4 - Published: 2026-10-17 - Length: 4 min - Hosts: Stella (asks), Liam (answers). Both are AI hosts with AI-generated voices. ## Summary On October 15, 2026, Perplexity open sourced SPACE, the sandbox platform behind its Computer agent: a fresh Firecracker microVM for every task, created in about 60 milliseconds by Perplexity's own numbers. ## Key takeaways - Perplexity open sourced SPACE on October 15, 2026, under Apache 2.0, with a fresh Firecracker microVM for every task. - Perplexity reports about 60 ms median sandbox creation, down from 185 ms. These are its own numbers. - Credentials are injected only when needed and never stored inside the sandbox. - You can copy the idea with six steps: disposable box, no keys inside, scoped short-lived keys, test apart from live, limited network, snapshots and logs. - SPACE runs on Firecracker and Kubernetes, so it suits platform teams more than solo builders. ## Chapters - 0:00 Intro - 0:43 What SPACE actually is - 1:37 Copy the idea for your own agents - 2:29 Pause, resume and snapshots - 3:10 Who it's for and the verdict ## FAQ **What is Perplexity SPACE?** Sandboxed Platform for Agentic Code Execution, the open source sandbox platform behind Perplexity's Computer agent, released under Apache 2.0. **What is a microVM?** A small virtual machine. SPACE uses Firecracker microVMs, so each task runs walled off from everything else and is destroyed when the work ends. **How do you sandbox an AI agent?** Run each task in a disposable box, keep keys out of it, use scoped short-lived credentials, separate test from live, limit the network, and snapshot before risky steps while logging every command. **Can a solo builder use SPACE?** It is infrastructure built on Firecracker and Kubernetes, so most solo builders should use the sandbox their agent tool already provides and apply the same six steps. ## Resources - [Step-by-step checklist](https://github.com/asly-97/ai-automation-workflows/tree/main/sandbox-ai-agents-safely) - [Sources](https://cryptobriefing.com/perplexity-open-sources-space-agent-sandbox/) ## Transcript ### Intro Liam: Hey hey hey, welcome to Agentic Pod! I'm Liam. Stella: And I'm Stella! Liam, on October 15, Perplexity open sourced the sandbox behind its Computer agent. Each task gets its own fresh microVM, in about 60 milliseconds. Liam: Yep. And that's the safest way to let an agent run code. Today: what SPACE is, how to copy the idea for your own agents, and the honest verdict. Stella: Good, because my agent has my API keys. Which, now that I say it out loud, sounds bad. Liam: It does. Let's fix that. ### What SPACE actually is Stella: First, what does SPACE stand for? Liam: Sandboxed Platform for Agentic Code Execution. It's Apache 2.0 licensed, and the code is on GitHub. Stella: And what's a microVM? Is that a tiny computer? Liam: Basically, yes. It's a small virtual machine, built on Firecracker, the tech AWS made. It boots fast and walls the task off from everything else. Stella: And the fresh part? Liam: Every task gets a new one, and it's destroyed when the work ends. Nothing from one task leaks into the next. Stella: Okay, so what about speed? Isn't that slow? Liam: Perplexity says the median creation time is about 60 milliseconds, down from 185. That's their number, and I haven't seen independent benchmarks. Stella: Fair. So why do I care, if I'm not Perplexity? Liam: Because the idea travels. That's next. ### Copy the idea for your own agents Liam: Step one. One disposable box per task. Don't let an agent run in the same place as your real project. Stella: And my keys? Liam: Step two. Keys never live inside the box. SPACE injects credentials only at the moment they're needed, and never stores them in the sandbox. Stella: So if the agent goes rogue, there's nothing to steal. Liam: Right. For your own setup, use short-lived keys with the smallest scope, like read-only on one repo. Not your master key. Stella: Step three? Liam: Separate test from live. A test agent should never be able to reach production data, even by accident. Stella: And step four? Liam: Limit the network. Perplexity's own red team found some network policy issues, and they fixed them. So even the pros treat the network as a weak spot. Stella: Wait, what red team? Liam: In September, testers made 108 attempts to break out of the sandbox. None got out. ### Pause, resume and snapshots Stella: Hold on. If every box is destroyed, how does a long job keep going? Liam: SPACE can pause and resume a sandbox. It keeps rolling snapshots for up to a week. Stella: So I can rewind if the agent breaks something. Liam: Exactly. Step five for your own agents: snapshot before any risky step. Install, migrate, delete. If it goes wrong, you roll back, and your laptop never knew. Stella: I like that. What about step six? Liam: Keep a log of every command the agent ran. When something looks odd, you can see exactly what happened. Stella: Okay, but is SPACE something I run tonight? Liam: Honestly, let's talk about that. ### Who it's for and the verdict Liam: Perplexity says it runs on Firecracker and Kubernetes. So this is infrastructure for a team, not a one-click app. Stella: So if I'm a solo builder? Liam: Use the sandbox your agent tool already gives you, and apply the six steps. Disposable box, no keys inside, short-lived scoped keys, test apart from live, limited network, snapshots and logs. Stella: And if I'm a platform team? Liam: Then read the repo. Perplexity also says it has used SPACE for its own agent in production, so it's been tested on real traffic. Stella: Verdict time. Is the hype real? Liam: The idea is real and useful. The speed numbers are Perplexity's own. I'd say trust the design, and test the claims yourself. Stella: Okay, so a recap, Liam. Liam: Quick recap. SPACE gives every task a fresh Firecracker microVM, creates it in about 60 milliseconds, injects keys only when needed, and snapshots for up to a week. For your own agents: a disposable box, no keys inside, scoped short-lived keys, test apart from live, limited network, snapshots and logs. The sources are in the description. What does your agent have access to right now? Tell us in the comments. See you next time!