What Is Perplexity SPACE? The Sandbox Behind Perplexity Computer

How VM isolation, rolling snapshots, and external credential controls keep long-running AI agents fast, persistent, and contained.

TL;DR Perplexity SPACE is the sandbox runtime behind Perplexity Computer. It’s not Perplexity Spaces, the collaboration feature now called Projects. SPACE stands for Sandboxed Platform for Agentic Code Execution, and Perplexity says 100% of Computer sessions run on it. Its architecture uses VM-based isolation, rolling snapshots, external credential controls, and a three-layer system designed for long-running AI agents.

---

We build AI agents because they can do actual work. Run code. Edit and organize files, a chore we’ve wasted enough human life on since the 1980s. Search databases. Sometimes build the whole thing.

But they can get things wrong.

What Is an AI agent sandbox?

Think of a child doing a messy science experiment. You could hand them the ingredients in your kitchen and ask them to “be careful” (a phrase my kids generally interpret as background noise). Or you could put them in a playroom with a covered floor and keep the bleach locked away.

The second option is a sandbox.

A sandbox gives the agent a choreographed space to work in. You’re the one who sets the controls. Files and sensitive credentials stay protected. If something explodes, metaphorically or otherwise, the blast radius ends at the workshop door.

What Is Perplexity SPACE?

Perplexity SPACE is the sandbox platform that runs agentic workloads for Perplexity Computer. Its acronym explains precisely what it does: Sandboxed Platform for Agentic Code Execution. As of July 15, 2026, all Perplexity Computer sessions run on SPACE.

^{(Don’t confuse SPACE with Perplexity Spaces, the former name of the collaboration feature now called Projects. Projects organize information for people. SPACE isolates execution for agents. Google still mixes them up.)}

Hey, I’m Karo Zieminski 🤗.

AI PM and builder. I write Product with Attitude, an AI newsletter for tens of thousands of readers across 146 countries, helping them develop critical AI literacy the only way it sticks: through practice.

If you’re new here, welcome! Here’s what you might have missed:

• How to Save Credits in Perplexity Computer (Part 1)

• Save More Credits: Advanced Patterns for Perplexity Computer (Part 2)

• How to build your first AI Agent. One that works.

What Makes SPACE Different?

Traditional sandboxes were designed for brief, disposable tasks. An AI agent is a more persistent creature. It can work for hours. That’s the point. Wiping its workspace would mean losing your work.

Designing a sandbox involves a rather delicate balance between safety, agent freedom, and efficiency. Improving one can quite easily weaken another.

• More access = more risk

• Sharing resources between sandboxes makes them faster to assemble, but creates additional entry points for attackers.

• Taking frequent snapshots makes it easier to recover or restore an earlier version, but requires additional time and storage.

Agentic sandboxes, such as the one used by Perplexity Computer, need all of the above.

The Three-Layer Architecture

Perplexity built SPACE around three layers:

• A stateless control plane: The dispatcher. When your task requires a sandbox, it decides where that sandbox should run.

• Node-local services: The ground crew. They run on each machine and handle the practical work, from starting and stopping sandboxes to supplying temporary credentials.

• A VM-based sandbox: The locked workspace. Inside it, an agent called the space daemon acts as the sandbox’s on-site manager. It handles file access, starts and stops programs, checks whether the sandbox is ready for work, and reports what is happening.

  ^{Perplexity’s LinkedIn announcement says SPACE uses Firecracker microVMs. Firecracker uses KVM, a minimal device model, seccomp filters, process jailing, namespaces, and cgroups.}

What Does SPACE Mean For Us as Users?

We get a Perplexity Computer that performs better with greater security.

SPACE captures live memory along with files that can be updated as frequently as every minute. It can retain those snapshots for up to a week. This means I can abandon a task halfway through, as I rather often do, return a week later, and let the agent continue precisely where it stopped.

Agent security gets complicated the moment the agent needs to log in somewhere. We want it to open private repos or operate an authenticated browser. But we don’t want arbitrary code inside the sandbox reading the raw token and sending it to definitely-not-evil.example.

Passwords and other sensitive credentials are not stored within the sandbox and remain entirely in our control. We can also bring our own encryption keys for the information stored in the sandbox.

It makes Computer faster. On Nvidia Vera, early tests ran workflows 1.5× faster and launched concurrent sandboxes 1.9× faster. Perplexity says SPACE cut the typical sandbox creation time from 185 milliseconds to 60 milliseconds, making it roughly three times faster. Even slower launches improved sharply: 90% of sandboxes now start within 89 milliseconds, down from 447 milliseconds.

Where Sandbox API Fits

Perplexity announced Sandbox API one day before publishing the SPACE architecture article. It’s coming soon in private beta. Product announcements tempt us to combine nearby nouns into one architecture, but I haven’t found evidence that every Sandbox API pod will be SPACE microVM.

A Critical AI Literacy Note

Continuity and stronger security don’t remove the need for human judgment. Nothing does. Know what the agent remembers, and consider if it should have been given that information at all.

Frequently Asked Questions

Is Perplexity SPACE the same as Perplexity Spaces or Projects?

No. Perplexity SPACE is runtime infrastructure. Projects is the collaboration feature previously called Perplexity Spaces.

Does Perplexity SPACE use Firecracker microVMs?

I went looking for the primary technical layer. Perplexity says SPACE uses disposable Firecracker microVMs for workload isolation. SPACE adds scheduling, storage, networking, credentials, and snapshots around that boundary.

How does SPACE keep credentials away from AI agents?

I get nervous when “secure” arrives without a diagram showing where the secrets live. SPACE stores credentials outside the sandbox and provides controlled access through network gateways or browser injection. Policies limit scope, audit logs record access, and BYOK gives enterprises control of the encryption key.

WHY SUBSCRIBE ・YOUR BENEFITS・CRITICAL AI LITERACY・TOOLS I BUILT・CLAUDE HUB・PERPLEXITY HUB ・VIBE CODING HUB

Attitude Vault ・LinkSwap ・StackShelf

Support my mission to spread critical AI literacy and help keep high-quality, human-authored content like this open and free by subscribing to Product with Attitude.