---
type: "post"
id: "perplexity-open-sourced-the-sandbox-that-keeps-its-10afd0"
slug: "perplexity-open-sourced-the-sandbox-that-keeps-its-10afd0"
title: "Perplexity open-sourced the sandbox that keeps its AI agents boxed in : in Perplexity's own testing, agents failed to escape it in 108 tries, though some slipped past its network rules before a fix."
description: "Perplexity’s SPACE release makes the runtime boundary inspectable: the company has open-sourced the sandbox platform it says supports agent work in Computer."
retrieval_nugget: "Perplexity’s SPACE release makes the runtime boundary inspectable: the company has open-sourced the sandbox platform it says supports agent work in Computer."
published_at: "2026-10-19"
updated_at: "2026-10-19"
record_date: "2026-10-19"
date_kind: "published_at"
topics: ["sandbox"]
source_urls: ["https://www.perplexity.ai/hub/blog/open-sourcing-space"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:perplexity-open-sourced-the-sandbox-that-keeps-its-10afd0"
status: "published"
visuals: []
editorial_provenance: {"schema_version":"newruntime-editorial-copy-v1","content_status":"source_grounded_final","final_copy_sha256":"sha256:e9447232110e06cf9b895962f49c0ba71f99f6354ea1507b9281c2de8a36e25a","reviewed_at":"2026-10-19T11:02:18.161Z","source_evidence_count":1,"verified_claim_count":3,"site_analysis_schema_version":"newruntime-site-analysis-v1","site_object_kind":"field_note","observed_fact_count":3,"implication_count":1,"watch_condition_count":1,"related_record_count":0}
analysis: {"schema_version":"newruntime-site-analysis-v1","object_kind":"field_note","thesis":"Agent security depends on enforceable runtime boundaries, not solely on model instructions.","observed_facts":[{"text":"Perplexity says SPACE is the sandbox platform behind Computer and has open-sourced its repository.","source_urls":["https://www.perplexity.ai/hub/blog/open-sourcing-space"]},{"text":"The source describes each sandbox as a small virtual machine with its own operating system and lists isolation, state recovery, and credential and network controls.","source_urls":["https://www.perplexity.ai/hub/blog/open-sourcing-space"]},{"text":"Perplexity reports no guest-to-host escapes in 108 attempts, while some agents bypassed network rules before a fix.","source_urls":["https://www.perplexity.ai/hub/blog/open-sourcing-space"]}],"mechanism":"A separate virtual machine and controls around files, credentials, and network access constrain what agent-generated code can touch, while pause, resume, and recovery preserve work across interruptions.","why_now":"As agents handle longer tasks and interact with files and tools, teams need controls that still apply when a model behaves unexpectedly.","implications":["Builders can inspect and adapt an implementation instead of recreating sandbox infrastructure, but must validate whether it fits their own threat model."],"evidence_boundary":"The release and test results are described by Perplexity; the supplied source does not establish independent validation, nor that open-sourcing alone makes deployments secure.","watch_conditions":["Independent testing should examine escape resistance and network controls under realistic workloads."],"related_records":[],"new_branch_reason":"No prior New Runtime record was supplied; this creates a distinct analysis of the open-source runtime-security release."}
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/perplexity-open-sourced-the-sandbox-that-keeps-its-10afd0/","markdown":"https://newruntime.com/posts/perplexity-open-sourced-the-sandbox-that-keeps-its-10afd0.md","json":"https://newruntime.com/posts/perplexity-open-sourced-the-sandbox-that-keeps-its-10afd0.json"}
related_patterns: ["agent-security-moves-to-runtime-boundaries"]
---

# Perplexity open-sourced the sandbox that keeps its AI agents boxed in : in Perplexity's own testing, agents failed to escape it in 108 tries, though some slipped past its network rules before a fix.

## Retrieval answer

Perplexity’s SPACE release makes the runtime boundary inspectable: the company has open-sourced the sandbox platform it says supports agent work in Computer.

Perplexity’s SPACE release makes the runtime boundary inspectable: the company has open-sourced the sandbox platform it says supports agent work in Computer. It describes each sandbox as a small virtual machine with its own operating system, alongside isolation, state recovery, and credential and network controls.

Agent security depends on enforceable runtime boundaries, not solely on model instructions. A separate virtual machine and controls around files, credentials, and network access constrain what agent-generated code can touch, while pause, resume, and recovery preserve work across interruptions. As agents handle longer tasks and interact with files and tools, teams need controls that still apply when a model behaves unexpectedly. Perplexity reports that agents did not escape the guest machine in 108 attempts, but some bypassed network rules before a fix.

Builders can inspect and adapt an implementation instead of recreating sandbox infrastructure, but must validate whether it fits their own threat model. Independent testing should examine escape resistance and network controls under realistic workloads. The release and test results are described by Perplexity; the supplied source does not establish independent validation, nor that open-sourcing alone makes deployments secure.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Sandbox](https://newruntime.com/topics/sandbox.md): Explore the sandbox topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)