Secure Sandboxes for Agents

AI agents perform real work on our behalf: editing files, running code, and carrying out multi-step tasks over hours or days. This often requires access to private information, which makes where an agent runs matter more than how smart the model is.

Sandboxes keep agents secure, letting them access the tools and files they need to complete these tasks, while keeping sensitive information protected. 

When building our agent platform Computer, we explored off-the-shelf sandbox options. Every option required us to consider tradeoffs between functionality, efficiency, and security. Perplexity Computer needed all three, so we built an entirely new type of sandbox.

Today, we’re introducing SPACE, a sandbox platform designed to unlock Computer’s full power while providing the highest level of security for advanced agentic systems.

Reinventing sandbox architecture 

SPACE spins up ephemeral sandboxes which only live as long as they’re needed for running code, interacting with files, or other tasks. When the task finishes, the sandbox, and everything inside it, is destroyed. 

For long-horizon work that needs to survive restarts, SPACE wraps each sandbox in a session that can be paused, resumed, or branched into multiple sandboxes. SPACE’s rolling snapshot technology allows context to travel with the work, even though no individual sandbox does.

Eliminating previous tradeoffs 

Most sandbox platforms only solve for two of three variables: functionality, efficiency, or security. Optimizing for one tends to come at the expense of another. Some solutions have strong isolation primitives but leave credentials exposed inside the environment. Others execute short-lived jobs well, but lose state and fail when a session needs to run for hours. 

SPACE solves for all three by separating concerns across dedicated services. The Network Gateway, Space Daemon, and File Service each secure a different part of the stack. They also deliver credentials from outside the sandbox only at the moment they’re needed. 

With this design, a compromised agent has no path to platform-managed credentials by default. And it doesn’t have access beyond the task it was given, regardless of the session’s duration or backend.

Creating three layers of security

SPACE is made up of three key layers, each with strong security measures built in: 

1. Control Plane: The first layer of SPACE’s architecture, the Control Plane is responsible for orchestrating the sandbox’s lifecycle. It receives every request through a single API, tracks the sandbox state, and decides in real time which backend to route to. It determines when a task needs a new sandbox. It also decides when a task is complete and its corresponding sandbox can be destroyed. Because the Control Plane is stateless and centrally hosted, the same API call works on any existing infrastructure, including a local machine. 

2. Node-level Services: In SPACE, Node-level Services is where Perplexity’s security posture stands out. With SPACE, credentials never pass into the sandbox. Instead, they’re passed in from outside the sandbox only at the precise moment they’re needed. When an agent needs temporary access to connect to a Google Account, SPACE can handle the sign-in flow without exposing credentials inside the sandbox. Outbound network traffic is also controlled at the node level. A compromised agent can’t reach anything outside its permitted scope.

3. In-sandbox: The in-sandbox layer is SPACE’s last line of defense. With SPACE, each task runs inside a Firecracker microVM, a fully isolated environment with its own operating system. That means nothing inside can affect the host or any other sandbox running in parallel. The Space Daemon is the only process that talks to Perplexity's control plane. It carries operational signals like start, pause, and snapshot commands. This is what makes the communication channel auditable and controllable.

Offering a full set of controls

SPACE is unique among providers in offering a full set of controls. SPACE combines pause and resume, session forking, per-session credential isolation, protocol forwarding, and multi-backend orchestration in a single platform. 

SPACE takes rolling snapshots of the full session state, capturing live memory alongside files as frequently as every minute. It can go back in time a week. It's essentially a built-in time machine: Anyone can walk away mid-task, come back a week later, and the agent picks up exactly where it paused.

SPACE treats the sandbox as untrusted by default and surrounds it with network controls, credential controls, tenant separation, and encrypted storage. If one layer is compromised, the others will protect personal information. 

With SPACE, enterprise customers can also bring their own encryption keys. If a customer revokes their key, new sandboxes cannot boot and existing customer-encrypted data can no longer be decrypted.

For those who work with particularly sensitive data, SPACE is designed to work both on-prem and fully offline. This level of control ensures data never has to leave a secure environment.

Powering Perplexity

Perplexity engineers took SPACE from concept to product in 10 weeks. We’ve been using SPACE internally for the past two months. Over the last week, it has supported millions of sandbox creations and tens of millions of sandbox reconnects. It is live in Computer for all users today.

SPACE was built to run anywhere. In an early test on NVIDIA Vera CPU, actual Computer-style workflows ran roughly 1.5x faster than our current production reference, and started concurrent sandboxes up to 1.9x faster. This early signal demonstrates that Vera will deliver exceptional value for agentic sandboxes and validates the backend agnosticism behind SPACE.

Investing in secure environments

We believe there shouldn’t be a tradeoff between functionality, efficiency, and security. Agents should work across the same data we do, with the same trust we’d place in any teammate.

SPACE is just the first iteration of this secure environment. As AI continues to evolve, our security and infrastructure systems will as well.

View Making SPACE: Secure and Efficient Runtimes for Long-Running Agents for more details.