On Thursday, October 15, 2026, Perplexity reportedly open-sourced space on GitHub, taking aim at a serious weakness in autonomous AI agents: running untrusted code. The release remains unconfirmed.
Overview: Perplexity SPACE Targets Unsafe Code Execution
When an AI agent runs Python or JavaScript provided by a user—or generated during a task—the code may need access to computing resources. Without isolation, a bug or malicious instruction could reach beyond the process meant to run it.
For agent developers, safe code execution is a practical infrastructure concern. Perplexity’s answer is SPACE, short for Sandbox for Processing AI Code Safely. It uses AWS Firecracker microVM technology to isolate code execution. Perplexity has reportedly released the repository under the Apache 2.0 license. Open-sourcing the system lets developers inspect its implementation, but doesn’t prove how it performs across different workloads.
Key Details: How Perplexity SPACE Is Designed
SPACE is built for lightweight virtualization, with reported boot times of under 5 milliseconds. That speed matters when an agent runs code as part of a larger task. Slow setup could add friction when execution happens repeatedly. The figure is a stated design target, not an independent benchmark across hardware or workloads.
Perplexity uses the sandbox in internal agentic workflows that execute untrusted Python and JavaScript. Rather than assuming the agent’s code is safe, SPACE isolates it in Firecracker microVMs. The separation aims to limit what a running task can affect outside its environment. Network access is restricted by default. If code needs to communicate externally, traffic passes through a host-managed proxy instead of getting unrestricted access. That gives the host a control point, though the available details don’t say which destinations or requests the proxy allows.
Context: Why Tesla Roadster Does Not Fit the SPACE Story
Developers have several broad options for handling code they don’t trust. Each comes with trade-offs.
| Approach | Boundary Strength | Operational Complexity |
|---|---|---|
| Direct Execution | Weak separation from host | Simple |
| Containers | Lighter boundary, shares kernel | Moderate |
| MicroVMs | Strong virtualization boundary | Higher setup and management |
SPACE’s reported design combines microVM isolation and network controls. The controls address separate risks: what code can affect in its execution environment, and where it can send or retrieve data.
Neither measure guarantees that every threat will be stopped. Configuration, host protections and proxy rules still matter. The Apache 2.0 release could help developers inspect and adapt the implementation. But a license doesn’t establish security quality or show how easily teams can deploy the system beyond Perplexity’s workflows. Developers will need clear documentation, security reviews and evidence from real-world deployments to judge those questions.
What’s Next for Perplexity SPACE
Technical documentation would be a useful next step, especially details on setup, isolation boundaries, proxy policy and supported environments. Independent security analysis could also show how SPACE handles attempts to escape a microVM or misuse allowed network routes. The available project details include no such findings.
For teams running untrusted agent code, the right choice depends on risk and operational capacity. If a stronger boundary matters and the team can manage virtualization, a microVM sandbox with controlled networking is the more cautious option. Lighter isolation may be easier to operate when workloads are trusted and simplicity matters more, but it comes with a different security trade-off. Perplexity SPACE’s promise lies in pairing fast microVM startup with restricted networking; independent scrutiny will show how much confidence developers can place in that design.
What is Perplexity SPACE?
SPACE is a Firecracker microVM sandbox designed to isolate code execution for AI agents.
Which programming languages does it support?
Perplexity says its workflows use SPACE to execute untrusted Python and JavaScript code.
What license does the open-source repository use?
The SPACE repository was reportedly published on GitHub under the Apache 2.0 license.
Does SPACE allow unrestricted network access?
No. Network access is restricted by default, and traffic passes through a host-managed proxy.
Source: Marktechpost
Was this article helpful?
Your feedback directly improves future articles on this site.
