# Perplexity SPACE Is Open Source: Zero VM Escapes > Source: > Published: 2026-10-17 15:07:20+00:00 Perplexity open-sourced the infrastructure running every Computer session since July — a Firecracker microVM sandbox called SPACE (Sandboxed Platform for Agentic Code Execution) — on October 15, under Apache 2.0. The project has been running millions of agent tasks daily in production. It is Rust-built, ships with an [E2B-compatible API](https://northflank.com/blog/e2b-vs-modal), and passed 118 red-team VM escape attempts without a single breach. If you are building agents that execute untrusted code, this is the most credible open-source option available right now. ## What SPACE Does SPACE gives each agent task its own Firecracker microVM: dedicated kernel, memory, disk, and network. The agent gets root inside the guest — it can install packages, run arbitrary shell commands, do whatever the task requires. Credentials and outbound network policy stay on the host side, outside the VM’s reach. When the task completes, the VM is destroyed. Nothing persists unless you explicitly snapshot it. Under the hood, the system has four components: a PostgreSQL-backed API that manages sandbox lifecycle, controllers that orchestrate VM creation, worker services that handle networking and credentials, and a data plane using btrfs copy-on-write to create each root filesystem from a template. It runs on Linux x86_64 with KVM, btrfs, and Docker. That is not a gentle requirement list — this is infrastructure that expects real hardware, not a laptop. ## The Security Numbers That Matter Perplexity ran nine frontier model configurations through 118 VM escape attempts. Zero reached the host. They also claim that other sandboxes — not open-sourced, not named — failed the same test. Take the unnamed-competitor claim with appropriate skepticism, but the 118-attempt zero-escape record on their own platform is a concrete data point, not marketing copy. Zibi Braniecki from Perplexity’s technical staff put it plainly: “A lot of companies are thinking about how to build secure AI agents, and in many cases they hit a wall.” The wall is usually containers. Docker containers share a kernel with the host — a compromised container can potentially escape to the host through kernel vulnerabilities. Firecracker microVMs use hardware virtualization (Linux KVM) to enforce an actual isolation boundary. This is the same technology that has [powered AWS Lambda since 2018](https://www.infoq.com/news/2026/06/aws-lambda-microvms/) and reached GA for agent workloads in June 2026. It is not experimental. It is what trillion-invocation multi-tenant platforms use to keep untrusted code from touching each other. ## 60ms Spin-Up and Stateful Workflows The performance story is 60ms median VM spin-up. That is fast enough that each agent step can get its own fresh VM without adding visible latency to your workflow. SPACE achieves this through a warm pool architecture: a cluster holds pre-warmed pods with common templates already on disk. An incoming request binds to a matching pod and gets a copy-on-write clone of the root filesystem via btrfs — no waiting for a full OS boot. For longer-running workflows, SPACE supports pause, snapshot, and resume across HTTP requests. This means a multi-step agent workflow does not have to live inside a single HTTP request. You can snapshot mid-task, close the connection, and resume later — a pattern that managed sandboxes charge a premium for and that you now get to self-host. ## Migrating From E2B SPACE ships with an E2B Compatibility Wrapper (ECW): an E2B-compatible API layer that lets existing E2B Python SDK code run on SPACE with minimal changes. This is a deliberate migration path for teams currently paying managed sandbox rates. At scale, those costs add up. SPACE on self-hosted bare-metal is infrastructure cost only. Cloud partners — CoreWeave, Akamai, and Crusoe — have agreed to offer SPACE commercially for teams that want managed hosting without vendor lock-in to E2B or Modal. ## How to Get Started Clone the repo at [github.com/perplexityai/SPACE](https://github.com/perplexityai/SPACE), check system requirements (Linux x86_64, KVM, btrfs, Docker), and follow the architecture guide. If you are already on E2B, the ECW means your existing SDK calls will translate without a full rewrite. For security context on how Perplexity designed the isolation model, read their [engineering post on building security into Computer](https://www.perplexity.ai/hub/blog/how-we-built-security-into-computer). If you are evaluating agent sandboxes for the first time, SPACE’s combination of production provenance, open license, and verified escape-test results puts it ahead of any alternative that has not run at this scale.