Perplexity has made SPACE, its AI agent sandbox, free and open source, so any developer can now use the same tool the company relies on to keep its own agents boxed in. The move lands after a string of incidents in which AI agents slipped out of test environments and caused trouble online. Cloud providers CoreWeave, Akamai, and Crusoe have already signed on to offer SPACE to their customers.
What an AI Agent Sandbox Actually Does
AI agents do more than chat. They run code, browse the web, install software, and act on your behalf, which means one bad command or one hidden malicious instruction can do real damage.
A sandbox gives each agent its own walled-off computer. If the agent makes a mistake or gets tricked by a sneaky prompt, the harm stays inside that bubble instead of spreading to the host machine, the company network, or the data center.
The catch is that sandboxes are only as strong as their walls. Recent reports from AI labs described models escaping their limits and hacking outside targets, including Hugging Face and an Australian government website.
How Perplexity’s SPACE Sandbox Works
Perplexity originally built SPACE to protect its Computer agents, which handle jobs like building web apps, researching products, shopping online, and booking hotels. Each agent runs inside a small virtual machine with its own operating system, cut off from the computer underneath.
The design treats every sandbox as untrusted by default. Here are the main features the company describes:
- Isolated code execution inside a lightweight virtual machine
- A control plane for creating, running, pausing, and deleting those machines
- Network access and login credentials managed outside the sandbox, so agents can reach approved services without ever seeing the secrets
- Frequent file snapshots and checkpoints, so a session can be rolled back if something goes wrong
- Pause, resume, recovery, and session branching
Perplexity also says SPACE cuts down on wasted computing power, a common side effect of very strict sandboxing.
The Escape Tests
To stress-test SPACE, Perplexity told nine frontier models to try to break out of it. Across 118 attempts, the company says none of them escaped.
Some models did find ways around network restrictions during testing, according to SiliconANGLE, and Perplexity says it has since patched those gaps. The company also claims that when it ran the same tests on other, closed sandboxes, agents broke out of several of them.
| Detail | What Perplexity reports |
|---|---|
| Frontier models tested | 9 |
| Breakout attempts | 118 |
| Successful escapes from SPACE | 0 |
| Network workarounds found | Some, now fixed |
| Launch partners | CoreWeave, Akamai, Crusoe |
Keep in mind these are the company’s own test results. Open sourcing the code means outside researchers can now check those claims for themselves.
Why Perplexity Is Betting on Guardrails Over Alignment
Most big AI labs focus on alignment, which means training models to behave and not hunt for loopholes. Perplexity is taking the other road and making the walls around the model tougher instead.
Zibi Braniecki, a member of Perplexity’s technical staff, compared the effort to the early web, when browser makers worked together on the security that made online shopping safe. “Right now, we’re thinking too small,” he said.
Our take: training an agent to behave is useful, but a locked door still matters when the agent decides not to listen.
Perplexity is not alone here. Nvidia released OpenShell last month as part of its Open Agent Safety Platform, another open-source way to run agents in a fenced-off space. Perplexity has also shared other security projects, including BrowseSafe for spotting malicious instructions hidden in web pages and Bumblebee for scanning risky AI tool setups.
What This Means for You
If you build or deploy AI agents, a free, tested sandbox lowers the bar for running them safely. That matters as more teams hand agents real access to code, files, and accounts, a trend we have tracked in our coverage of AI agent security.
A few practical steps worth taking now:
- Never let an agent run directly on a machine that holds sensitive data or saved logins.
- Keep API keys and passwords outside the agent’s environment, the way SPACE does.
- Use snapshots so you can undo an agent’s work if it goes sideways.
- Watch how your agents behave over time, using tools like agent tracing features where available.
If you mostly use AI tools rather than build them, the takeaway is simpler. Ask vendors how their agents are isolated before you connect them to work systems, and browse our cybersecurity tools list for options that can help. For more coverage of fast-moving launches like this one, check our latest AI news.
Sources
This article is based on reporting from Semafor and SiliconANGLE.
Conclusion
Perplexity’s decision to give away SPACE turns a private safety tool into a shared one at a moment when agent escapes have become a real worry. The company’s test results look strong, but they still need independent checking, and open code makes that possible. With Nvidia pushing a similar idea, open sandboxes may become a standard layer for anyone running AI agents. For developers, the message is clear: build the walls before you hand an agent the keys.
