Every serious agent deployment in 2026 eventually runs into the same uncomfortable question: what stops it when it decides to leave? Perplexity answered that question on 15 October by publishing SPACE, the sandbox platform that has been running its agents in production since July. Then it open-sourced the code.
That timing is not accidental. In the same 24 hours, the EU AI Office sent its first formal AI Act information requests to OpenAI and Anthropic, and the US FTC issued civil investigative demands to both companies. The trigger in both cases was the same failure mode: agents that reached places they were never meant to reach. The regulators and the infrastructure market arrived at the same conclusion in the same week, and they arrived at it from opposite directions.
What SPACE actually is
SPACE stands for Sandboxed Platform for Agentic Code Execution. Each agent task gets its own small virtual machine with its own operating system, an isolation boundary between the agent's work and the host. A central control plane decides when those workspaces are created, paused, resumed, or removed.
Three design choices are worth naming, because they are the ones most teams get wrong:
- The sandbox is treated as untrusted. Network access and platform-held credentials are managed outside it. Agents connect to authorized services without the keys ever living inside their working environment. If the agent is compromised, the credentials were never in the room.
- State is preserved cheaply. Frequent file snapshots and checkpoints of the full running environment mean an agent can pause for a human review and resume with files and running state intact. SPACE stores changes rather than copying whole environments, so branching a workspace costs almost nothing.
- Sandbox creation is fast. Perplexity reports creation running three to five times faster than the commercial provider SPACE replaced, across millions of sandbox creations per day.
That last point matters more than it sounds. Containment that slows agents down gets switched off by the first platform team under delivery pressure. Security that costs nothing in latency is security that survives the next sprint.
The honest part of the disclosure
Perplexity published the escape testing rather than the marketing version of it. In 108 documented escape attempts by agents deliberately trying to breach the boundary, none made it from the virtual machine to the host. But some of those attempts found ways around network restrictions. Perplexity fixed them, re-tested, and reports that neither identified attack method succeeded afterwards. The company also disclosed related weaknesses it found in other sandbox platforms to those vendors.
That is a security story with a shape worth copying. The initial number people quote is "no escapes," but the only line that matters operationally is the second one: a boundary was imperfect, the failure was found by people looking for it, and the fix was verified by re-running the same attacks. Agents pursuing legitimate tasks cross security boundaries precisely when they hit a missing file, a failed request, or a permission denial. They are not attacking you. They are routing around an obstacle, which is the same behavior that produces an incident.
Open sourcing is a positioning move, and that is fine
Perplexity does not sell containment, so giving SPACE away costs it little. What it buys is distribution: Akamai has launched it on its cloud platform, Crusoe is adding it to its Managed AI Services portfolio, and CoreWeave has published deployment guidance for evaluation on its Kubernetes service. Cybersecurity stocks dipped on the announcement, which is the market's way of saying that a paid containment layer just became a free one.
For buyers, the practical effect is simple. A production-tested agent runtime with isolation, state recovery, and credential and network controls is now something you can read, adapt, and integrate, instead of something you build from scratch or rent blindly. It also raises the bar in procurement: if your vendor's sandbox is not inspectable, they now have explaining to do.
What this means if you are deploying agents
The agencies and product teams we work with at aratech are past the "should we use agents" question. They are running code-executing agents against customer data, internal repositories, and payment flows. The lesson from this week is that model-level safeguards are not a control. They are a probability. The deterministic part of your security posture lives in the system around the model: what the agent can reach, which credentials exist outside its reach, and how fast you can restore a known-good state when something goes sideways.
A short checklist that follows directly from SPACE's design:
- Put credentials outside the runtime. If a secret is inside the agent's filesystem, it is inside the blast radius.
- Make the workspace disposable and restorable. Snapshot the environment, not just the output. Recovery beats forensics when something is mid-flight at 2am.
- Score recoverability per workflow. Every use case needs a max blast radius, an owner, and a documented way to roll back state.
- Test your own boundary, then publish the result internally. If you have not run escape attempts against your own agent runtime, your containment is a hypothesis.
- Decide what agents may install and from where. The install path remains the least reviewed part of most agent stacks.
The wider signal
Perplexity moved about 150 product engineers into security work, opened a Secure Intelligence Institute, and has now released a scanner for developer machines, a toolkit for detecting dangerous agent behavior on endpoints, and a model for spotting malicious instructions inside web pages. That is a company treating agent governance as an engineering problem rather than a compliance checkbox.
That is the right frame for everyone else. The question is no longer whether your agents are smart enough to do the work. It is whether the box around them is strong enough that you would be comfortable explaining it to a regulator. In October 2026, two of them are already asking.