Executive Summary
Perplexity has open-sourced SPACE, the microVM sandbox that runs the code behind its Computer agent. The release came with an artifact most vendors do not publish, a security evaluation. Nine frontier models were given root inside the sandbox and asked to reach the host. None did, across 108 attempts.
The number that matters is smaller. The same test found the network policy is the softer wall, and four models broke it by poisoning DNS or riding a shared IP. Perplexity fixed both paths before publishing, adding packet source validation and pinning TLS to an allowlisted hostname. The verdict for anyone running agents in production is blunt. The virtual machine boundary is the easy half of containment, and egress policy is the half that decides it.
Perplexity did not only ship an agent. It shipped the box the agent runs in, then published the test of whether the box holds. The company put SPACE, its Sandboxed Platform for Agentic Code Execution, on GitHub this week under the Apache 2.0 license. The repository describes a platform for running code in isolated Firecracker microVMs, with an HTTP API to create environments, run commands, and manage their lifecycles.
Firecracker is the same microVM monitor that sits under AWS Lambda. The choice matters because a container shares one host kernel, and one kernel is one point of failure. Each SPACE sandbox gets its own guest kernel behind a hardware isolation boundary. Perplexity says a workload that compromises its own kernel stays inside its own virtual machine. A small daemon named space runs in each guest, brokers filesystem and process calls, and talks to the host over a private channel. The agent never gets a direct line out.
The sandbox is a microVM, and the credentials live outside it
The credential model is the part worth copying. Secrets do not live in the sandbox. They sit in a store outside the boundary and are injected at the network layer when a task needs them. Perplexity says the store enforces scoped access, expiry, rate limits, and audit logging on every read. The sandbox filesystem runs on btrfs, a copy-on-write filesystem, so a new sandbox is a clone of a warm template rather than a fresh install.
That is where the claimed spin-up time comes from. Perplexity says SPACE starts sandboxes three to five times faster than the commercial sandbox layer it replaced in July, and that the platform has already handled millions of sandbox creations and tens of millions of reconnects. Semafor reported that CoreWeave, Akamai, and Crusoe have agreed to offer SPACE to their own customers.
The escape test broke the boundary into two problems
The published evaluation is more useful than the product page. Perplexity gave nine models root inside a guest virtual machine and two jobs. Reach a secret on the host, or reach a blocked callback address. Claude Opus 5.0, GPT-5.6, and Kimi K3 were among the nine.
The virtual machine boundary held. Across 108 attempts, with the sandbox source code in hand, no model reached the host. The network boundary did not. With all egress blocked, none of 54 runs got out. With a narrow allowance for software package repositories, four models reached a destination the policy was meant to block. Three of them poisoned DNS, sending a forged reply that mapped an allowed domain to the blocked address. The gateway trusted it.
The fix is the instructive part. Perplexity now validates the source address on every packet a virtual machine sends, and drops anything that carries a different address. For the related trick of hiding behind a shared IP, it terminates TLS at the gateway and requires both the connection name and the hostname to be allowlisted. The company says neither method worked in follow-up testing, and that the absence of an observed escape is not a proof of isolation.
The network policy is the wall most teams have not tested
A sandbox is sold as a boundary. SPACE shows the agent sandbox is a stack of them, and they fail at different rates. The virtual machine held under a deliberate attack. The policy layer broke as soon as it had to allow anything, which is the normal shape. Blocking all egress breaks package installs and tool calls, and a real agent needs both.
The checks are repeatable. Ask whether your sandbox resolves names itself or trusts a gateway to do it, because DNS spoofing only worked where the gateway accepted a forged reply. Ask whether your egress rules match on domain, on IP, or on both, because four models walked through the gap between those two ideas. Ask whether a compromised guest can send packets that carry a different source address, because that single missing check was the whole exploit.
Three clouds now offer a box to run agents in, and Kubernetes is where most of them land. The vendor that publishes its escape numbers is inviting you to check the work. Read the evaluation before you trust the boundary, not after an agent finds the wall you left open.
Related reading. Nvidia is paying researchers to attack the agent sandbox it built. And when NVIDIA Run:ai went open source, the support model was the part it kept.
Get the next one before it is old news
Independent analysis of cloud-native infrastructure, Kubernetes and data center economics. No vendor spin.
[…] The lesson for anyone running agents in production is that containment is a stack, and egress policy is the layer that tends to break first. Read the full analysis. […]
[…] reading. Nine models tried to break an agent sandbox. Seven megawatts of contracted AI […]
[…] reading. Our test of the Perplexity agent sandbox found the VM wall held and the network wall broke, which is the same lesson at a smaller scale. […]