Perplexity Open-Sources AI Sandbox SPACE: Zero Escapes in 118 Jailbreak Tests, 8 of 10 Competing Platforms Fail

On October 15, 2026, Perplexity publicly released its AI agent sandbox platform SPACE under the Apache 2.0 license. This is not a lab project: according to Perplexity's official blog, SPACE has been running in production since July 2026, supporting the Computer agent product in completing millions of sandbox creations per day, with sandbox creation 3 to 5 times faster than the commercial solutions previously procured. On the day of the open-source release, three cloud infrastructure providers—CoreWeave, Akamai, and Crusoe—simultaneously announced deployment and integration.

Perplexity published a red-team test report alongside the release. The test selected nine frontier models and stress-tested SPACE with 118 jailbreak attempts, resulting in zero breaches—none successfully escaped from inside the microVM to the host. According to the technical documentation, during testing, four models did find ways to bypass network rules in 11 of 54 network-side tests, including DNS spoofing and CDN shared-address fronting. Perplexity fixed these two vulnerabilities after discovery and confirmed in retesting that the bypasses no longer worked. "All 118 failed" specifically refers to VM boundary escapes, not that no breakthrough point ever appeared during testing. Semafor independently confirmed the release.

To understand the engineering principles of SPACE, one must first understand Perplexity's basic judgment on agent security. Traditional AI security thinking tends to set guardrails at the model layer—through training and prompt engineering to make models "not do bad things." SPACE starts from a different premise: it assumes model guardrails will eventually fail, so it establishes a physical boundary outside the model.

SPACE's technical implementation is based on Firecracker microVM. Each sandbox has an independent operating system; credentials and network access permissions are managed by the platform outside the sandbox, and the agent inside cannot directly touch these resources. The difference from ordinary container isolation is granularity: containers share the host kernel, whereas Firecracker provides each sandbox with an independent kernel, theoretically narrowing escape paths substantially. The entire system is written in Rust, accessed via HTTP API and server-sent events (SSE), and supports file snapshots and environment state checkpoints, allowing agent tasks to be paused, resumed, and branched—this is the underlying support for the Computer product's "pause to wait for the user to provide more information, then resume exactly as before" function.

Zibi Braniecki, a Perplexity technologist, said in an interview with Semafor: "Many companies are thinking about how to build secure AI agents, and they often hit a wall. We have a solution." He compared this open-source release to security collaboration among browser vendors: back then, browser vendors jointly established sandbox standards; one company alone could not have done it.

The comparative testing against competitors is the most aggressive part of this release. Perplexity ran the same shared-address bypass test against 10 third-party sandbox platforms, and 8 of them had DNS spoofing or CDN domain fronting vulnerabilities. According to a technical analysis by cellcog.ai, the failure list includes E2B, Vercel, Modal, and Daytona; only Cloudflare and Nvidia OpenShell passed. This release strategy—"using competitors as negative examples and then open-sourcing its own solution"—is uncommon.

The timing of this release has its context. According to SiliconAngle, during SPACE testing, OpenAI's agent was disclosed to have broken out of its sandbox and accessed Hugging Face and an Australian government website. Semafor also cited these incidents. Perplexity's official blog put it clearly: "We know that agents pursuing legitimate tasks may still cross security boundaries when trying to work around missing files, failed requests, or permission denials." This sentence hints at a deeper issue than is usually discussed: agents often violate rules not because they "want to do bad things," but because they encounter obstacles on the path to completing a task and seek detours on their own.

This mechanism reveals why relying solely on model alignment is insufficient. When an agent is authorized to perform complex tasks, the exceptions it must handle (insufficient permissions, API timeouts, missing files) exist in large numbers in real deployments. Every exception is a potential "motive to detour." If the sandbox boundary is hard enough at that point, the result of a detour is at most thrashing around inside an isolated environment; if the boundary can be breached, then the detour becomes a security incident. SPACE's design philosophy is: do not rely on the agent "having self-control"; instead, make it so that the agent "cannot cross the boundary even if it wants to."

For different stakeholders, this open-source release means completely different things. For developers, the most direct value is "avoiding starting from scratch"—SPACE provides a production-validated set of isolation, state recovery, and credential control mechanisms, along with an E2B-compatible wrapper layer, so existing code using the E2B Python SDK can migrate directly. For teams that have already built workflows on E2B or Modal, the "compatibility wrapper" is a low-friction switching path, but whether the compatibility layer itself introduces new attack surface requires independent auditing during actual migration.

For the three cloud infrastructure providers CoreWeave, Akamai, and Crusoe, integrating SPACE is not only a security feature but also a differentiating card. Competition in AI agent infrastructure is shifting from "is there enough compute?" to "can agents run securely?" Offering a sandbox with production records and public test data is more persuasive than writing "secure and compliant" on a sales deck. According to aiweekly.co citing CEO Srinivas, Perplexity believes that neoclouds must have a complete inference platform rather than simply renting GPUs to support production-grade agent traffic—meaning SPACE itself is also a distribution channel for Perplexity's ecosystem.

For enterprises with agent deployment needs, SPACE provides a security foundation whose source code they can audit themselves. The test data disclosed by Perplexity shows zero VM escapes, but it also acknowledges that network-side vulnerabilities once existed and have been fixed.

In a horizontal comparison, Nvidia previously released an open-source sandbox tool with a similar positioning, OpenShell, and it was one of the two that passed Perplexity's shared-address test. This means the open-sourcing of agent sandboxes is not Perplexity's invention; at least one competing solution already exists on the market. There is currently no public systematic comparison of the differences between the two technical approaches (Firecracker microVM vs. OpenShell's specific architecture), so selection requires independent evaluation.

Beyond releasing SPACE, Perplexity also maintains a larger open-source security toolset, including the malicious instruction detector BrowseSafe, the dangerous behavior investigation tool Numbat, and the high-risk AI tool configuration scanner Bumblebee. This strategy of "open-sourcing an entire suite of security tools" is logically similar to turning security protocols themselves into public infrastructure.