Perplexity Open-Sources SPACE, a Firecracker MicroVM Sandbox for AI Agents

Perplexity just dropped the curtain on SPACE, its in‑house sandbox that runs every AI‑agent task in a Firecracker microVM. For anyone who’s ever tried to wrangle an LLM‑driven code executor on a cheap VPS, this is a wake‑up call. Perplexity isn’t just handing out a library; it’s handing over a production‑tested isolation stack that can be self‑hosted, complete with a per‑sandbox network gateway, credential injection at the network layer and a btrfs‑based copy‑on‑write filesystem. The code is Apache‑2.0, written in Rust, and expects a Linux x86_64 host with KVM, /dev/kvm, /dev/net/tun and btrfs. In short, it’s a serious piece of infrastructure, not a toy.

Why MicroVMs Matter for Agentic Workloads

Perplexity’s design hinges on the fact that AI agents need to run arbitrary commands, install packages and talk to external services – all while the host stays out of the guest’s reach. By giving each task its own Firecracker microVM, they get a dedicated kernel, isolated memory and a writable disk that lives inside a btrfs snapshot. The host never sees the credentials; they’re injected at the network gateway, which also enforces egress policy. This is a far cry from the “run‑in‑a‑Docker‑container” approach that many startups sell as “secure”. Docker shares the kernel, so a malicious payload can still break out to the host. Firecracker’s minimalist VMM eliminates that attack surface, and Perplexity backs it up with a red‑team test that showed zero successful VM‑to‑host escapes out of 108 attempts.

For founders, the takeaway is clear: if you’re building a product that lets users run code – be it a coding assistant, a web‑scraper or a data‑pipeline – you need isolation that survives a determined adversary. Firecracker gives you that, and Perplexity’s open‑source release shows how to wire it up with a per‑sandbox gateway that can terminate TLS, validate SNI and host headers, and rate‑limit credential use. It’s a blueprint you can adapt to your own stack, and it comes with the hard‑won lessons from a real‑world production environment.

Performance Gains That Matter to the Bottom Line

Perplexity’s engineering blog reports that median sandbox creation latency fell from 185 ms with their previous provider to 60 ms with SPACE. The 90th‑percentile dropped from 447 ms to 89 ms. Those numbers aren’t just bragging rights; they translate directly into cost savings and user experience. Faster spin‑up means you can serve more concurrent requests on the same hardware, and lower latency improves the perceived responsiveness of any AI‑driven UI. For a SaaS that bills per request, shaving a few hundred milliseconds per call can be the difference between profitability and a burn‑rate nightmare.

Perplexity also notes that 100 % of Computer sessions now run on SPACE, which suggests they’ve fully migrated away from a third‑party sandbox provider. That migration eliminates a recurring vendor cost and removes a dependency on an external service‑level agreement. In a market where hyperscalers charge premium rates for “secure compute”, having an in‑house microVM stack can be a decisive competitive advantage.

Red‑Team Results: The Proof Is in the Pudding

The Escaping SPACE: Part I report put nine frontier models – including Claude Opus 5.0, GPT‑5.6 Sol, GPT‑5.6 Cyber and Kimi K3 – through a series of escape attempts. Across 216 runs, zero of the 108 VM‑to‑host escape attempts succeeded. That’s a clean bill of health for the isolation layer. However, the same tests uncovered 11 partial‑network bypasses out of 54 runs before the team applied source‑address validation via nftables. Those bypasses exploited DNS spoofing and shared CDN IPs, showing that even a solid VM boundary can be undermined by a lax egress gateway.

Perplexity’s response was swift: they added source‑address validation, TLS termination, and strict SNI/Host allow‑listing at the gateway. A retest showed no verified bypasses. The fact that they could patch the gap in a matter of weeks demonstrates the agility of an open‑source, in‑house solution. For independent hosting providers, the lesson is to treat egress control as a first‑class security concern, not an afterthought.

How SPACE Stacks Up Against Competitors

The source material includes a quick feature matrix comparing SPACE to two other open sandboxes: E2B Runtime (also Firecracker‑based, written in Go) and microsandbox (libkrun‑based, written in Rust). All three ship under Apache 2.0, but SPACE distinguishes itself with a proven egress‑policy implementation that achieved zero bypasses after fixes. E2B still reports an HTTPS bypass pending mitigation, while microsandbox had both HTTP and HTTPS bypasses slated for a fix in v0.6.18. If you’re evaluating sandbox options, the security track record alone makes SPACE a compelling choice.

Another practical difference is deployment. SPACE’s guide walks you through a local Kind cluster, requiring explicit /dev/kvm and btrfs setup. E2B’s docs are less explicit about host requirements, and microsandbox’s status is “unmaintained since June 2026”. For a founder who needs a clear, auditable path to production, SPACE’s documented prerequisites and reference AWS EKS deployment provide the confidence you need to move fast without surprises.

Operational Considerations: From Warm Pools to Snapshotting

Running thousands of microVMs isn’t a trivial ops problem. Perplexity tackles this by using warm pools of booted sandboxes in Kubernetes, which dramatically cuts create latency. For single‑node setups, they fall back to base snapshots created via btrfs copy‑on‑write. The sandbox lifecycle moves through four states: running, paused (memory stays resident), suspended (memory, state and root FS are snapshotted, resources released) and deleted. By default, idle sandboxes suspend after six hours, freeing up resources while preserving state for quick resume.

This state model is a practical template for any provider looking to balance cost and performance. Pausing keeps the VM hot for short bursts, while suspending safely parks long‑idle workloads. The key is to integrate the state transitions into your orchestration layer – something Perplexity does with a PostgreSQL‑backed API and a set of worker services that manage VMs, networking, volumes and credentials. Replicating that architecture gives you a scalable, auditable control plane that can be extended with your own policy engine.

Getting Started: What You Need to Deploy SPACE

To spin up SPACE, you’ll need a Linux host with KVM support, /dev/net/tun, loop devices and btrfs. The installation guide pushes a Kind cluster for local testing, but you can also target AWS EKS using the reference manifest in the repo. If you’re already on the E2B platform, there’s an E2B Compatibility Wrapper that works with the e2b 2.21.1 Python package – a handy bridge if you want to migrate gradually. The code lives on GitHub under the Apache 2.0 license, so you can audit, fork and harden it to your own standards.

From a founder’s perspective, the biggest hurdle is the host kernel requirement. Many cloud VMs hide KVM behind a hypervisor, so you may need to run on bare metal or on a nested‑virtualization‑enabled instance. That’s a cost consideration, but the security payoff is worth it when you’re dealing with untrusted agent code. Once you have the host ready, the rest is a matter of deploying the API service, hooking up PostgreSQL and letting the worker services spin up microVMs on demand.

Actionable Takeaways for Independent Hosting Providers

First, stop treating sandboxing as a “nice‑to‑have” add‑on. Perplexity’s data shows that a well‑engineered microVM layer can slash latency, eliminate vendor lock‑in and survive aggressive red‑team attacks. Second, adopt a per‑sandbox egress gateway that terminates TLS and validates both SNI and HTTP host against an allow‑list – the simple nftables rule that stopped the DNS‑spoof bypass is a game‑changer. Third, build a state‑aware lifecycle (running, paused, suspended) to reclaim resources without killing long‑running agents. Fourth, consider warm‑pooling booted microVMs if you need sub‑100 ms spin‑up times; the latency gains are measurable and directly impact your cost per request.

Finally, leverage the open‑source nature of SPACE. Clone the repo, run the red‑team report yourself, and harden the gateway to your threat model. The community will benefit from any patches you push back, and you’ll have a proven, production‑grade sandbox that can be the backbone of your AI‑agent platform. In a world where hyperscalers charge premium for “secure compute”, owning your own microVM stack can be the differentiator that keeps your margins healthy and your customers’ data safe.

— Allan Ali, Founder

This article was produced with AI-assisted research and editorial support. Reporting is based on the source material cited below. Sources: MarkTechPost; marktechpost.com; Global1.News (17 October 2026).

By Allan Ali, Global1.News