Signal / 035 — Perplexity’s SPACE puts agent execution behind an inspectable boundary

The interesting question about an agent is not only what it can do. It is where that work is allowed to happen. Following October 15, 2026 reporting about Perplexity opening its sandbox software, the company’s public SPACE repository provides the concrete artifact to inspect: an Apache-2.0-licensed platform for isolated code execution.

A workspace, not a permission slip

SPACE stands for Sandboxed Platform for Agentic Code Execution. Its README describes Linux environments running in Firecracker microVMs. Applications create sandboxes through an HTTP API, start commands, collect output, and manage the environments’ lifecycles. A template supplies the starting environment; each sandbox gets its own VM and writable filesystem.

The project is implemented in Rust, but applications interact over HTTP and server-sent events rather than embedding a Rust library. Its setup documentation includes a local Kind-cluster route, while the architecture guide also discusses running without Kubernetes. Those are implementation options, not evidence that every NAS or laptop can run it unchanged.

sysVoid take

Open code makes the boundary inspectable. It does not make the boundary infallible. Before connecting any agent runtime to valuable files or credentials, understand its host requirements, network policy, and recovery behavior. We have not installed SPACE or tested its containment.

The useful shift is architectural: give code-running agents a deliberate workspace, then decide which results cross back out. Escape the default of handing every experiment the keys to your everyday machine.

AI-assisted summary, checked against the linked sources; no hands-on testing. Featured photo by Ilya Pavlov on Unsplash is illustrative, not a screenshot of the reported software.