Key Takeaways
- SPACE is Perplexity's code-execution sandbox for AI agents, released as open source under Apache 2.0 and used for millions of daily sessions on its Computer product.
- It is built on Rust and Firecracker microVMs, treats every sandbox as already compromised, and keeps credentials on the host instead of inside the VM.
- Perplexity says it dropped its commercial sandbox provider in July and saw 3-5x faster sandbox creation; SPACE includes a drop-in E2B-compatible API wrapper for migration.
- No public build, download or official page exists yet, so you cannot install it today; watch the official Perplexity channels for the repository and hosting partners Akamai, CoreWeave and Crusoe.
Quick Facts
| Type | Open-source agent code-execution sandbox |
|---|---|
| Devices | Server-side; runs on cloud VMs and bare metal |
| Price | Free to self-host; cloud pricing not yet published |
| Languages | Rust core; API accessible from any language |
| Highlight | Firecracker microVMs with E2B-compatible API wrapper |
| Learning curve | Moderate; needs Linux, virtualization and ops skills |
| Category | Dev & Web Tools |
| Creator | Ethan Walkrman |
| Heat | 🔥 25.8K Heat |
| Last updated |
What Perplexity SPACE Actually Is and Why It Matters
SPACE is the code-execution sandbox that Perplexity built for its agent product, Computer. A sandbox is the isolated environment where an AI agent runs shell commands, installs packages and executes generated code without touching the host machine. Perplexity has now released SPACE as open source under the Apache 2.0 license and says the same system handles millions of sessions per day in production, which makes it one of the few agent sandboxes with that scale of real-world use behind it.
The release matters because running untrusted, model-generated code is one of the hardest practical problems in agent engineering. Every coding agent, data-analysis agent or browser-automation agent eventually needs to execute something it wrote, and a single escape can compromise the host. Perplexity's answer is architectural: SPACE is built around the premise that the sandbox should be treated as already compromised, so the design assumes an attacker is inside and focuses on containing them.
Perplexity also frames the release as a direct challenge to E2B, the commercial sandbox provider it says it stopped using in July. Both systems run on Rust and Firecracker microVMs, and SPACE ships with a drop-in E2B-compatible API wrapper, so teams already on E2B have the most direct migration path. The company says it saw 3-5x faster sandbox creation after the switch, though it has not published a detailed benchmark methodology.
- Apache 2.0, not a source-available tease
The license is a standard permissive open-source license, so commercial use, modification and redistribution are allowed. That is a meaningfully different posture from sandboxes that are only open-core.
- Production-proven at Perplexity
Perplexity says SPACE powers millions of daily sessions on Computer. Most open agent sandboxes are demos or research projects, so operational history at this scale is the main differentiator.
- Aimed squarely at E2B
The E2B-compatible API wrapper is the clearest signal of intent. It lowers switching costs for teams that already wrote their agent against E2B's interface.
- Cloud partners lined up
Akamai, CoreWeave and Crusoe are set to offer SPACE on their clouds, which matters for teams that want the stack without building their own hosting.
Inside the Firecracker MicroVM Design and Security Model
SPACE uses Firecracker microVMs, the same lightweight virtualization technology that underpins AWS Lambda. Each sandbox is a separate microVM with its own kernel, which gives you hardware-level isolation rather than the weaker namespace-based isolation of plain containers. Firecracker's design goal is fast startup with low memory overhead, which is exactly what an agent platform needs when it spins up thousands of short-lived environments per minute.
The security posture is the most interesting part. Instead of assuming the sandbox is trusted and trying to prevent escape, SPACE assumes the code inside is hostile from the start. That changes the threat model: the question is not whether an agent can break out, but what it can reach if it does. Perplexity says nine frontier models were put through roughly 118 escape attempts in total, and none broke out to the host machine. Treat that as a vendor claim until independent testing is published.
Credentials are handled outside the VM. Rather than injecting API keys as environment variables, where any process in the sandbox could read them, SPACE manages secrets on the host side. This is a small architectural detail with large practical consequences: prompt-injected or malicious code running inside the sandbox has no direct path to your keys, which removes one of the most common real-world attack routes in agent systems.
- MicroVM isolation beats container isolation
A separate kernel per sandbox is a stronger boundary than shared-kernel containers. It costs a little more memory per instance but removes whole classes of container escape.
- Host-side secret management
Keys never enter the VM as environment variables. If your agent needs to call an external API, the host mediates that call rather than handing the sandbox a credential.
- Rust core
The Rust implementation is consistent with the performance and memory-safety goals of a system that starts and tears down VMs constantly under load.
- Verify the escape claims yourself
Perplexity's 118-attempt result is self-reported. If your threat model is strict, plan your own red-team evaluation once the code is available.
How to Self-Host SPACE: Requirements and Workflow
There is an important caveat before any setup instructions: as of the announcement on October 16, 2026, no public build, download or official page has been published. The creator has only shown SPACE in a short preview video and announcement. Everything below describes the workflow the architecture implies and what you should prepare, not a procedure you can run today. Check the official site and Perplexity's developer channels for the repository.
When the code lands, expect a server-side deployment. SPACE is not a desktop app or a browser tool; it runs on Linux hosts with hardware virtualization available, which means bare metal or VM instances that expose KVM. You will need a machine with enough CPU and memory to run many microVMs concurrently, plus the operational tooling to manage their lifecycle, networking and storage. A laptop will work for experimentation but not for anything resembling production load.
The migration story is the practical selling point. If your agent already targets E2B, the compatible API wrapper is designed so you can point your existing calls at SPACE with minimal changes. If you are starting fresh, you will write against the SPACE API directly. Either way, budget time for the unglamorous parts: image building, network policy, log collection and cleanup of orphaned sandboxes. Those are where self-hosted sandboxes usually fail in production, not in the happy path.
- Prepare Linux hosts with KVM
Firecracker needs hardware virtualization. Confirm your provider exposes nested virtualization or give SPACE bare metal, which is what the cost comparison assumes.
- Plan for image and dependency management
Agents install packages constantly. Decide up front whether you build golden images or let each sandbox install from scratch, because it dominates startup time.
- Instrument lifecycle metrics
Track sandbox creation latency, active session duration and idle time. The cost argument for self-hosting depends entirely on how much of your sandbox time is actually active.
- Consider managed hosting first
Akamai, CoreWeave and Crusoe plan to offer SPACE. If you do not want to run the control plane yourself, that is the lower-effort path once it is available.
Cost Math, E2B Comparison and Who Should Care
The cost breakdown drove most of the discussion around the release. For a 2vCPU/2GB equivalent sandbox, Perplexity presents E2B as billing per wall-clock second, roughly $0.13 per hour, which means you pay while the sandbox sits idle waiting for LLM tokens. Perplexity's own Agent API is described as a flat $0.03 per 20-minute active session, roughly $0.09 per hour. Self-hosted SPACE on Akamai, CoreWeave or Crusoe is quoted at about $0.03 to $0.05 per hour, which Perplexity frames as 60% to 75% cheaper under full load.
The key phrase is under full load. Self-hosting only wins when your utilization is high, because you pay for the host whether or not sandboxes are running. If your agents are bursty and idle most of the day, a per-second or per-session managed service can easily be cheaper once you add the engineering time to operate the cluster. Run the numbers against your own traffic pattern before assuming the headline savings apply to you.
So who should care? Teams building coding agents, data-analysis agents or anything that spins up many short-lived environments and already has infrastructure staff. Teams on E2B get the most direct migration path through the compatible wrapper. Teams with low volume, no ops capacity or strict compliance requirements that demand a managed vendor should probably wait for the hosted offerings or stay where they are. SPACE is a serious piece of infrastructure, not a drop-in toy.
- Idle time is the real cost driver
Per-second billing charges you while an agent waits for model tokens. Active-session or self-hosted models remove that idle tax, which is where most of the claimed savings come from.
- Self-hosting adds hidden costs
Engineering time, on-call, security review and capacity planning are not in the $0.03-0.05 per hour figure. For small teams those can exceed the sandbox bill itself.
- E2B remains a reasonable choice
If you value a managed service with support and do not want to run microVM infrastructure, E2B is still a legitimate option. SPACE mainly changes the calculus at scale.
- Confirm pricing before committing
The figures above come from Perplexity's announcement. Cloud partner pricing and the final Agent API terms are not published yet, so verify on the official site.
Step-by-Step Guide
Confirm whether SPACE is actually available yet
As of the October 16, 2026 announcement, there is no public build, download or official page. Start by checking Perplexity's official developer channels and the official site for a repository link before planning any deployment.
Assess your workload and cost model
Measure how long your sandboxes stay active versus idle, and how many you create per hour. Self-hosting only pays off at high utilization, so this number decides whether SPACE is even the right answer for you.
Prepare Linux hosts with hardware virtualization
Firecracker microVMs need KVM. Provision bare metal or instances with nested virtualization, size them for your expected concurrent sandbox count, and set up networking and storage before you touch the sandbox layer.
Decide between self-hosting and a cloud partner
Akamai, CoreWeave and Crusoe plan to offer SPACE. If you lack ops capacity, wait for those managed options. If you have infrastructure staff, plan a self-hosted pilot on a small cluster first.
Migrate through the E2B-compatible wrapper
If your agent already targets E2B, the drop-in API wrapper is the fastest path. Point a staging environment at SPACE, run your existing test suite, and compare sandbox creation latency and cost against your current provider before switching production traffic.
Frequently Asked Questions
Is Perplexity SPACE free to use?
The source code is released under Apache 2.0, so you can self-host it without paying a license fee. Your real costs are the compute you rent or own, plus the engineering time to operate it. Perplexity quotes roughly $0.03 to $0.05 per hour for a 2vCPU/2GB equivalent on Akamai, CoreWeave or Crusoe, but those partner prices are not officially published yet, so verify on the official site.
Can I download or install SPACE right now?
No. As of the announcement on October 16, 2026, no public build, download or official page has been published, and the creator has only shown it in a short preview video and announcement. You cannot install it today. The practical step is to watch Perplexity's official developer channels and the official site for the repository and hosting partner details.
How is SPACE different from E2B?
Both run on Rust and Firecracker microVMs, so the underlying isolation technology is similar. The differences are licensing and control: SPACE is open source under Apache 2.0 and self-hostable, while E2B is a commercial managed service. SPACE also ships with an E2B-compatible API wrapper, which suggests Perplexity is targeting E2B users directly. Perplexity says it left a commercial sandbox provider in July and saw 3-5x faster sandbox creation afterward.
Is SPACE safe enough to run untrusted AI-generated code?
The design assumes the sandbox is already compromised, uses separate-kernel Firecracker microVMs for isolation, and keeps credentials on the host instead of inside the VM. Perplexity says nine frontier models went through roughly 118 escape attempts in total without breaking out to the host. That is a vendor claim, not an independent audit, so teams with strict threat models should plan their own red-team testing once the code is available.
What hardware and skills do I need to self-host SPACE?
You need Linux hosts with hardware virtualization exposed, meaning bare metal or instances with nested virtualization enabled, since Firecracker requires KVM. Beyond that, expect to handle image building, network policy, log collection and cleanup of orphaned sandboxes. The learning curve is moderate: it is infrastructure software, so comfort with Linux, virtualization and cluster operations matters more than familiarity with any particular programming language.
