Perplexity launches SPACE sandbox for secure, long-running AI agents

Perplexity AI introduced SPACE today, a sandbox platform designed to enable its Computer AI agent to work safely and effectively over extended periods. Computer itself is a "digital worker" built atop Perplexity's search engine that accepts natural language goals from users, breaks them down into multi-step tasks, and orchestrates over 19 frontier models—including Claude, Gemini, and Grok—to interact with web search, email, Notion, Slack, and data curation tools. The agent can recall past work, adapt to a user's specific style, run unattended, and be scheduled to activate when data changes across hours, days, or months.

Such long-duration work often requires the ability to pause, resume, or branch workflows. SPACE solves this by isolating agent sessions in sandboxes—secure, isolated environments where all working data lives separately from other agents and systems. When Perplexity evaluated off-the-shelf sandbox options, the company found a consistent problem: systems that isolate well often expose user passwords, API keys, and other sensitive information, while systems optimized for short-lived jobs become unstable or confusing when sessions must run for hours or days. To address both challenges, Perplexity built SPACE using Firecracker microVMs, an open-source virtual machine developed by Amazon Web Services and designed to balance speed and isolation. Firecracker boots tiny virtual machines in as little as 5 milliseconds with minimal memory overhead—splitting the difference between traditional VMs (which are slow and memory-heavy) and containers (which are fast but lack hardware-level isolation). SPACE wraps this virtualization with controls for pausing, resuming, session forking, per-session credential isolation, forwarding, and orchestration into a single platform.

The resulting architecture captures live memory and files, updating them as frequently as every minute, and archives data for up to a week. This means a user can walk away mid-task, return a week later, and the agent picks up where it left off. Critically, passwords, keys, and other sensitive information never live inside the sandbox; instead, they remain entirely in the user's own password and key management systems and are accessed only when needed. Users also bring their own encryption keys for sandbox data. If a user revokes an encryption key, new sandboxes cannot read the data, making it completely secure. SPACE is live in Computer today and designed to run anywhere. In early testing using Nvidia's Vera architecture, Computer-style workflows ran around 1.5 times faster than current production references, and launching concurrent sandboxes was 1.9 times faster. Perplexity has been using SPACE internally for the past two months, and over the past week it supported more than 1.25 million sandbox creations and 11.9 million sandbox reconnects. The company frames SPACE as the first iteration and plans to evolve its infrastructure as AI and agentic workflows continue to evolve.

Perplexity's Computer is a 'digital worker' that mirrors recent releases from competitors like Anthropic's Claude Cowork and OpenAI's ChatGPT Work—agentic systems that take natural language goals, decompose them into steps, and orchestrate multiple frontier models to interact with external tools. The critical difference SPACE addresses is durability and security for workflows that run unattended over extended periods. Traditional off-the-shelf sandboxes face a dilemma: they either isolate well but expose credentials, or they handle short-lived jobs efficiently but break down when sessions must persist across hours or days. By wrapping sessions in Firecracker microVMs (Amazon's lightweight virtualization layer originally designed for Lambda and Fargate), Perplexity achieved hardware-level isolation with millisecond boot times and minimal memory overhead—the middle ground between slow, heavy traditional VMs and fast but isolated-only containers. The architecture's strength lies in separating credential management from the sandbox itself; instead of storing keys inside the isolated environment, SPACE keeps them in the user's own password and key management systems, accessed on-demand. This design choice directly mitigates the attack surface for long-running agents that may interact with dozens of external APIs. Early testing on Nvidia's Vera architecture suggests tangible performance gains (1.5× faster workflows, 1.9× faster concurrent sandbox launch), though the body does not specify the production baseline hardware or methodology. Perplexity's internal usage—1.25 million sandbox creations and 11.9 million reconnects in a single week—indicates the system is already operationalizing the multi-day/multi-week task model at meaningful scale.

No comments yet. Be the first to share your thoughts!