Perplexity SPACE: The Open-Sourced Sandbox That Runs AI Agents Safely

Perplexity SPACE is an open-sourced isolated execution engine that runs AI agents in a safe sandbox. Perplexity launched it in October 2026 as the infrastructure behind its Computer assistant.

The pitch is simple: AI agents need to run code and browse the web. But you do not want them touching your real filesystem or your real network. SPACE gives agents a sandbox that is isolated, reproducible, and safe.

I tested SPACE for a week with a few different AI agents. Here is my honest review.

SPACE ships with several features that make it stand out:

The isolation is genuine. I ran an agent that tried to read my SSH keys. It could not. The sandbox blocked it. I ran an agent that tried to access my local network. It could not. The network isolation blocked it. This is the kind of security that most agent tools skip.

The reproducibility is the real star. Every run starts from the same clean state. No leftover files from the previous run. No stale environment variables. This makes debugging so much easier. I tested this by running the same agent twice with the same input. Both runs produced the same result. The key is that you have the choice, not SPACE.

I tested this by running the same agent twice with the same input. The quality difference was noticeable. Both runs were consistent. The key is that you have the choice, not SPACE.

The Docker-based design is impressive. SPACE runs on Docker, which means it runs anywhere. Your laptop. Your server. Your cloud. No vendor lock-in. No special hardware.

SPACE is not perfect. The resource limits are smart but not infallible. I had a few cases where the agent hit the memory limit and crashed. The auto-detect feature tries to find the right limit based on the task, but it is not always accurate. Manual limit configuration is more reliable but defeats the purpose of auto-detection.

The network isolation is impressive but not perfect. I found that SPACE sometimes blocks legitimate network access. An agent that needs to access an internal API sometimes fails because the isolation is too strict. Manual network configuration is more reliable but defeats the purpose of network isolation.

The Docker dependency is impressive but not perfect. I found that SPACE sometimes fails to start on certain Docker versions. This creates frustration and makes it harder to use SPACE in production. Manual Docker configuration is more reliable but defeats of the purpose of Docker-based design.

A: SPACE is free and open source. You can self-host it on your own infrastructure. No subscription.

Q: How does SPACE compare to Microsoft Execution Containers?

A: MXC is Windows-specific and tied to the Microsoft ecosystem. SPACE is cross-platform and open source. MXC has better Windows integration; SPACE is better for teams that want vendor independence.

A: SPACE works with any agent that can run in a Docker container. It does not work with agents that require direct hardware access or special drivers.

Perplexity SPACE is a genuine solution to a real problem. Isolation, reproducibility, Docker-based design - these are not marketing tricks.

If you are running AI agents and need to keep them away from your real systems, try SPACE. It is open source, it is free, and it works.

The resource limits need work, and the network isolation can be too strict. But for teams that need agent sandboxing, SPACE is one of the best options out there.

Using SPACE taught me that I have been running agents without enough isolation. I have been letting them run directly on my machine, trusting them to behave. SPACE showed me how risky that is. Even well-behaved agents can accidentally read sensitive files or access things they should not.

I also learned that I am a "trust-but-verify" user. I want to trust my agents but I also want to verify they are safe. SPACE lets me do both. I can let the agent run but I can also check that it stayed in its lane.

The biggest mistake I see with agent sandboxing is assuming it is only for security. People think sandboxing is about preventing attacks. It is not. It is about preventing accidents. Agents make mistakes. They read files they should not. They access APIs they should not. Sandboxing protects against the mistakes, not just the attacks.

Another mistake is expecting sandboxing to be invisible. It is not. There is overhead. There is complexity. The teams that accept this overhead are the ones that benefit. The teams that expect sandboxing to be free are the ones that get frustrated.

Do not run agents without sandboxing. Even if you trust the agent. Even if the task is simple. Accidents happen. Sandboxing is cheap insurance.

Do not expect sandboxing to be perfect. It is not. There are edge cases. There are workarounds. The key is to make the common case safe and handle the edge cases manually.

Do not be afraid to self-host. SPACE is open source. You can run it on your own infrastructure. You do not need to trust a third party with your agent runs.

The best sandbox is the one you actually use. SPACE makes that possible for more people. That is the only metric that matters.