Perplexity has introduced SPACE, short for Sandboxed Platform for Agentic Code Execution, a new runtime designed to support long-running AI agents that execute code, edit files, and complete multi-step tasks over hours, days, or even months.
The company began deploying SPACE as the sandbox layer for Perplexity Computer in June. It now powers 100% of Computer sessions and has already handled millions of sandbox creations and tens of millions of reconnections. Perplexity plans to expand the system across more products and environments, including Linux microVMs, Windows guests, and users’ local machines.
Each SPACE sandbox runs inside a virtual machine with its own guest kernel, separating untrusted workloads from the host and other tenants. A dedicated in-guest daemon controls filesystem and process operations through a private channel, while a network gateway governs outbound traffic. Credentials remain outside the sandbox and can be injected at the network layer or entered by a browser agent. Enterprise customers can also use their own encryption keys for externally stored data.
SPACE supports persistent sessions, pausing, resuming, suspension, restoration, rollback, forking, and crash recovery. Regular disk snapshots preserve filesystem changes, while full snapshots capture the d virtual machine. Suspended sessions are uploaded to object storage, allowing another node to restore the agent with its prior filesystem and running state.
Perplexity built the storage layer on btrfs, using copy-on-write cloning and atomic snapshots to reduce startup time and storage consumption. Warm pools keep commonly used templates ready for incoming sessions. In production testing, median sandbox creation time dropped from 185 milliseconds to 60 milliseconds, while 90th-percentile latency fell from 447 milliseconds to 89 milliseconds. This makes SPACE between 3.1 and 5 times faster than Perplexity’s previous sandbox system.
Perplexity is positioning SPACE as shared infrastructure for its agent products and future developer-facing runtimes. The platform addresses a central challenge for autonomous agents: preserving state and access to working files while isolating potentially compromised code, credentials, and network activity.