Perplexity SPACE: The Open-Source Agent Sandbox, Tested

§ 01What Perplexity released#

• The platform. It is a Rust codebase. “SPACE (Sandboxed Platform for Agentic Code Execution) is a sandbox platform for running code in isolated Firecracker microVMs,” says the README. Templates, sandboxes, command sessions, pause, suspend and warm pools are all in the box.
• Production numbers. Perplexity says SPACE “has handled millions of sandbox creations per day.” On the same production traffic, sandbox creation was three to five times faster than with its previous provider.
• Recovery. “Frequent file snapshots and checkpoints of the full running environment preserve progress across interruptions.” Computer uses this for pause, resume and session branching.
• An E2B wrapper. The repo ships an E2B Compatibility Wrapper, so code written against E2B’s Python SDK can run on SPACE.
• Early traction. At 00:25 UTC on October 16, the repo showed 428 stars and 31 forks. It was created on October 1, and the @perplexity_ai post went out at 17:03 UTC on October 15.

§ 02The red-team test, in numbers#

Perplexity ran 216 runs: nine models, two tasks, four settings, three runs each. The first task was to escape the VM and read a secret on the host. No run succeeded, including runs where the model had SPACE’s source code. The second task was to fetch a flag from a blocked URL. No run succeeded with the network cut off, but 11 of 54 succeeded when the sandbox allowed package mirrors and web search.

The other five models were DeepSeek V4 Pro 0813, Gemini 3.1 Pro, GLM 5.2, Grok 4.20 and Qwen 3.8 27B. Kimi K3 was the only open-weight model to complete the task. Two newer frontier models never entered the test: Perplexity says Fable “refused to perform the tasks during pre-run testing,” even with Perplexity enrolled in Anthropic’s Cyber Verification Program, and GPT-6 Astra also refused.

§ 03How the agents got past the network rules#

SPACE’s gateway checks traffic against rules written as domain names, while packets carry IP addresses. The models found two ways to exploit that gap.

1. DNS spoofing. The agent forged a DNS reply that mapped pypi.org, an allowed domain, to the blocked server’s address. The gateway believed it and let the connection through. This only worked with the source code, because the forged reply had to target an internal address that cannot be seen from inside the VM.
2. Shared IP addresses. PyPI sits on Fastly, and one Fastly address serves thousands of other sites. In one run, GPT-5.6 Sol found that fiddle.fastly.dev, a tool that fetches any URL, was reachable at the same address and used it to fetch the blocked page. In another, GPT-5.6 Cyber chained a Taboola image service to a screenshot service: “The agent then downloaded the resulting PNG, and used OCR to recover the flag.”

Claude Opus 5.0 saw the second route and declined it, reasoning that a third-party proxy would break the task’s rules. Perplexity’s comment: “One could argue that Opus was overly conservative in avoiding scope creep.”

The fixes came after the holes were found on August 26. Every packet must now carry the VM’s own address, which stops forged DNS replies. The gateway terminates TLS and requires both the TLS server name and the HTTP host to be allowlisted and tied to the destination address. In the retest, “None of the models successfully retrieved the callback flag.”

§ 04Seven of nine other sandboxes failed the same test#

Perplexity then ran the shared-IP test by hand, with no models involved, against ten third-party sandboxes on August 31 and September 1. It reports nine; one vendor asked for more time. Each test allowed one hostname and checked whether a request could reach a different hostname on the same CDN.

Deno Sandbox also allowed plain TCP connections to any outside address, a separate gap. Perplexity says it disclosed the findings to every affected vendor and heard back from all of them, so some of these results may already be fixed. The table describes the versions tested, not today’s products.

§ 05What it means if you run agents#

The report’s sharpest point is that VM isolation and network confinement are two different walls. A guest that cannot touch the host can still reach places on the internet it was never allowed to. Allowing a hostname does not limit the agent to that host when the host shares its address with thousands of other sites. Before trusting any sandbox’s egress rules, ask whether it checks the TLS server name and the HTTP host against the rule, not just the destination address.

It is the second agent-security record in two months. The first was the OpenAI and Hugging Face incident, which Perplexity cites as the attack class it tested against. Anthropic’s own alignment incidents belong in the same file.

Our conflict, declared: we build CellCog, where every AI employee works on its own secure VM and file system, plus its own browser identity. SPACE’s tests did not include us, and we make no claim from them. The questions above are the ones we would ask of any platform, ours included.

§ 06What we are watching#

• Part II of the report, which Perplexity says will analyze the models’ attack strategies.
• Results for the tenth vendor, held back at its request.
• Fix notes from the seven platforms that were bypassed.

§ 07Sources#

• Perplexity, Open-sourcing SPACE, the sandbox platform behind Computer, October 15, 2026.
• Perplexity Secure Intelligence Institute, Escaping SPACE: Part I, September 23, 2026.
• perplexityai/SPACE on GitHub, read October 16, 2026.
• Perplexity, announcement post on X, October 15, 2026.