Perplexity built a time-traveling sandbox for AI agents

Letting an AI agent touch your local files, run custom scripts, and handle multi-step work across days sounds great until you realize you have to hand it your system keys. Where an agent runs has quietly become just as critical as the intelligence of the model steering it.

Perplexity just introduced SPACE, an in-house sandbox platform designed from scratch to run its agent product, Computer. The architecture ditches typical container tradeoffs by spinning up disposable Firecracker microVMs that vanish the instant a task wraps up.

Instead of trusting standard off-the-shelf sandbox runtimes, Perplexity built the entire stack in ten weeks to balance security, state retention, and execution efficiency across long-running tasks.

No credentials inside, plus a built-in time machine

Most modern agent runtimes stumble when jobs stretch from quick queries into multi-day projects. If a sandbox stays open for hours, credentials sitting in environment variables become sitting ducks for prompt injections or exploits.

SPACE splits the problem across three distinct layers: a stateless control plane, node-level gateways, and the in-sandbox microVM itself. Credentials are never written into the guest sandbox. When an agent needs temporary access to complete a Google sign-in flow, the credentials are provided externally only at the exact second they are required. If an agent gets compromised, there are zero platform credentials left inside for an attacker to grab.

For persistence, SPACE implements a rolling snapshot engine that captures live memory and modified files as often as once every minute. The system can pause, resume, or fork a session up to a week back. You can walk away in the middle of a complex project, come back days later, and the agent picks up with its exact memory state intact.

For sensitive setups, the platform supports on-premises deployment, fully air-gapped offline modes, and bring-your-own-encryption keys (BYOK). Revoking the key immediately kills boot capabilities and renders stored customer-encrypted data unreadable.

Why it matters

We think this launch marks a crucial shift in the AI race: the bottleneck is moving from model weights to execution environments. A brilliant model is useless for serious work if legal and security teams refuse to let it touch company data.

Perplexity is smart to bypass generic container services and build directly on Firecracker microVMs. The isolation model means developers and enterprise users can test complex, multi-step workflows without gambling their credentials. Having the ability to resume paused tasks from memory snapshots solves one of the most frustrating pain points of existing agent platforms, where dropped connections often wipe hours of work.

Scale is already here. Perplexity says SPACE handled millions of sandbox boots and tens of millions of reconnects over the past week alone, and early hardware tests on NVIDIA Vera CPUs clocked 1.5x workflow speedups and nearly 1.9x faster concurrent boot times. The challenge will be keeping that infrastructure rock-solid as Computer scales out, but Perplexity just set a very high bar for what a production-grade agent environment should look like.