Perplexity Open-Sources SPACE: Rust & Firecracker microVM Sandbox Platform Powering Perplexity Computer Under Apache 2.0

Background and the Problem

As autonomous coding and computer-use agents execute arbitrary shell scripts, compile untrusted repositories, and interact with authenticated external APIs, securing multi-tenant execution environments has become a critical bottleneck. Standard container sandboxes share the host OS kernel, while passing user API keys or OAuth tokens into the sandbox environment exposes credentials to exfiltration whenever an agent encounters an indirect prompt injection attack.

Architecture and How It Works

Perplexity open-sourced SPACE (Sandboxed Platform for Agentic Code Execution) under the Apache 2.0 license, releasing the exact Rust infrastructure powering Perplexity Computer:

1. Per-Task Firecracker microVM Isolation: Written in Rust with a pluggable runtime architecture, SPACE assigns each individual agent task its own hardware-virtualized Firecracker microVM, combining KVM-level kernel isolation with sub-second boot times;
2. Out-of-VM Credential & Egress Traffic Control: Rather than injecting secrets into the guest environment, SPACE enforces credential management and outbound network policy strictly outside the microVM boundary. Guest processes never hold raw credentials, neutralizing secret exfiltration even under complete guest compromise.

Benchmarks and Measured Results

Battle-tested across Perplexity's production fleet and validated by the open-source ecosystem:

• Production Backbone of Perplexity Computer: Runs 100% of live agentic tasks in Perplexity Computer with strict tenant and network isolation;
• Rapid Open-Source Adoption (1,130+ GitHub Stars): Released under the permissive Apache 2.0 license at github.com/perplexityai/SPACE, surpassing 1,130 stars immediately after launch.

Getting Started for Developers

Developers building cloud coding agents or enterprise MCP tool runners can deploy SPACE immediately (https://github.com/perplexityai/SPACE):

• Self-Hosted Agent Sandbox: Clone https://github.com/perplexityai/SPACE on KVM-enabled Linux hosts to replace insecure Docker-in-Docker execution pools;
• Externalize Secret Injection: Configure SPACE's host-side egress proxy to attach authentication headers only to allowlisted destination domains outside the guest VM.