A sandbox, given away
Perplexity released SPACE as open source on 15 October, under the Apache 2.0 licence. It is the containment layer the company built for its own Portable Computer agents, which run tasks such as building web apps, researching products and booking hotels, and it is now on GitHub for anyone to run.
The design is a microVM rather than a container. Each sandbox is a Firecracker virtual machine with its own operating system, and applications drive it over an HTTP API that creates Linux environments, runs commands, collects output and tears the machine down. SiliconANGLE reported the rest of the shape: a control plane the operator owns, frequent file snapshots and checkpoints so a session can be rolled back, and pause, resume and branching of sessions.
Two decisions matter more than the virtualisation. The sandbox is treated as untrusted at all times, and network access and platform credentials are held outside it — an agent can reach a service it is authorised to use without ever seeing the secret that authorises it.
The numbers, and the gap between them
Perplexity red-teamed the sandbox by instructing nine frontier models to escape it. Semafor and SiliconANGLE both report 118 attempts with no successful escape. Perplexity’s own report, as summarised by MarkTechPost, counts 0 of 108 runs reaching the host-side secret.
The two figures have not been reconciled publicly. They may describe different slices of the same evaluation — the whole red-team exercise against the specific host-secret test — but the announcement does not say so, and nobody outside the company can check. Everything here is vendor-reported: Perplexity designed the sandbox, wrote the attack prompts, scored the results and published them. No independent evaluator has repeated the exercise.
The more useful number is the one that records a failure. On network restrictions, 11 of 54 runs produced a bypass before Perplexity fixed the weaknesses, and four of the nine models found a path. The company says that after the fixes no model produced a verified bypass in retesting. A containment claim is worth more when the published record includes the part that broke.
The comparison that cannot be checked
Perplexity also says the same models escaped commercial sandboxes it has not open-sourced. It has not named those products or published the runs, so the claim sits outside anyone’s ability to verify, and it is a claim about competitors made by a company shipping an alternative. It should be read as marketing until the detail arrives.
CoreWeave, Akamai and Crusoe plan to offer SPACE to their customers, which matters more than the benchmark: three infrastructure providers adopting one containment layer is how a default gets set.
Guardrails instead of alignment
Zibi Braniecki, a member of Perplexity’s technical staff, told Semafor the company has focused on making guardrails tougher and more reliable rather than on model alignment, which is where most frontier labs put the effort. He compared the task to the early web, when competitors built shared guardrails for secure browsing and commerce, and said the industry is currently thinking too small.
The argument has a logic to it. Alignment work tries to make a model not want to escape; a sandbox assumes it will try. The second assumption survives a model you did not train, which is the situation every company running someone else’s agent is in.
SPACE is not alone. Nvidia released OpenShell last month as part of its Open Agent Safety Platform, and SiliconANGLE reports no escapes from it either. Perplexity has also open-sourced BrowseSafe, Numbat and Bumblebee.
What to watch
The test is whether anyone outside Perplexity runs the escape suite and publishes what they find, and whether the 118 and 108 figures get an explanation. Until then the honest summary is that a widely deployed sandbox is now inspectable, which is itself the point of releasing it.
