How Do You Sandbox an AI Agent? Perplexity SPACE Explained

Hey hey hey, welcome to Agentic Pod! I'm Liam.

And I'm Stella! Liam, on October 15, Perplexity open sourced the sandbox behind its Computer agent. Each task gets its own fresh microVM, in about 60 milliseconds.

Yep. And that's the safest way to let an agent run code. Today: what SPACE is, how to copy the idea for your own agents, and the honest verdict.

Good, because my agent has my API keys. Which, now that I say it out loud, sounds bad.

It does. Let's fix that.

First, what does SPACE stand for?

Sandboxed Platform for Agentic Code Execution. It's Apache 2.0 licensed, and the code is on GitHub.

And what's a microVM? Is that a tiny computer?

Basically, yes. It's a small virtual machine, built on Firecracker, the tech AWS made. It boots fast and walls the task off from everything else.

And the fresh part?

Every task gets a new one, and it's destroyed when the work ends. Nothing from one task leaks into the next.

Okay, so what about speed? Isn't that slow?

Perplexity says the median creation time is about 60 milliseconds, down from 185. That's their number, and I haven't seen independent benchmarks.

Fair. So why do I care, if I'm not Perplexity?

Because the idea travels. That's next.

Step one. One disposable box per task. Don't let an agent run in the same place as your real project.

And my keys?

Step two. Keys never live inside the box. SPACE injects credentials only at the moment they're needed, and never stores them in the sandbox.

So if the agent goes rogue, there's nothing to steal.

Right. For your own setup, use short-lived keys with the smallest scope, like read-only on one repo. Not your master key.

Step three?

Separate test from live. A test agent should never be able to reach production data, even by accident.

And step four?

Limit the network. Perplexity's own red team found some network policy issues, and they fixed them. So even the pros treat the network as a weak spot.

Wait, what red team?

In September, testers made 108 attempts to break out of the sandbox. None got out.

Hold on. If every box is destroyed, how does a long job keep going?

SPACE can pause and resume a sandbox. It keeps rolling snapshots for up to a week.

So I can rewind if the agent breaks something.

Exactly. Step five for your own agents: snapshot before any risky step. Install, migrate, delete. If it goes wrong, you roll back, and your laptop never knew.

I like that. What about step six?

Keep a log of every command the agent ran. When something looks odd, you can see exactly what happened.

Okay, but is SPACE something I run tonight?

Honestly, let's talk about that.

Perplexity says it runs on Firecracker and Kubernetes. So this is infrastructure for a team, not a one-click app.

So if I'm a solo builder?

Use the sandbox your agent tool already gives you, and apply the six steps. Disposable box, no keys inside, short-lived scoped keys, test apart from live, limited network, snapshots and logs.

And if I'm a platform team?

Then read the repo. Perplexity also says it has used SPACE for its own agent in production, so it's been tested on real traffic.

Verdict time. Is the hype real?

The idea is real and useful. The speed numbers are Perplexity's own. I'd say trust the design, and test the claims yourself.

Okay, so a recap, Liam.

Quick recap. SPACE gives every task a fresh Firecracker microVM, creates it in about 60 milliseconds, injects keys only when needed, and snapshots for up to a week. For your own agents: a disposable box, no keys inside, scoped short-lived keys, test apart from live, limited network, snapshots and logs. The sources are in the description. What does your agent have access to right now? Tell us in the comments. See you next time!