Perplexity opens the code for its isolated AI execution environment
The SPACE release gives developers an execution layer for AI agents, with separate virtual machines, writable filesystems and an HTTP API.
Perplexity has published SPACE under Apache 2.0. The software creates isolated Linux environments for agent-written code, with an HTTP API for running commands and collecting output. A template supplies the starting filesystem; each sandbox receives its own virtual machine and writable filesystem.
Isolation and network controls
SPACE powers Perplexity Computer. Its microVMs are small virtual machines with their own guest kernel, separating the workload from the host. In its July engineering report, Perplexity says credentials stay outside that boundary and are injected at the network layer when needed. The company measured median sandbox creation at 60 milliseconds, versus 185 with its previous provider on the same production traffic. That comparison does not promise the same speed elsewhere.
The September security report gave nine models root access inside a guest: none of 108 runs escaped to the host. However, network restrictions were bypassed in 11 of 54 partially connected runs through DNS spoofing or shared addresses. Perplexity reports no verified bypass after fixes and retesting. These bounded company tests show why VM isolation and network restrictions need separate scrutiny; they do not prove universal security.
State retention and local installation
State retention supports longer jobs. The architecture guide distinguishes pausing, which leaves memory on the worker, from suspension, which snapshots memory, runtime state and the filesystem before releasing active VM resources. A completed command does not itself delete the environment, allowing more commands in the same workspace.
The local installation guide requires an apt-based Linux x86-64 host, KVM, btrfs and Docker with privileged containers. Its Kind-based Kubernetes setup does not run directly on macOS and uses development credentials. The public code therefore gives developers an inspectable execution layer, while deployment and production hardening remain substantial engineering work.
