Perplexity open-sourced SPACE: the VM held, the network rules did not

Six slides on SPACE, the open-source (Apache 2.0) sandbox platform behind Perplexity Computer, released October 15, 2026: what it is, Perplexity's own performance claims, its red-team results (0 of 108 VM escapes, 11 of 54 network bypasses with partial network access, both fixed), what coverage skipped (8 of 10 other sandbox platforms had bypasses; KVM host requirements; partial E2B compatibility), and facts vs our read. Sources: https://www.perplexity.ai/hub/blog/open-sourcing-space , https://www.perplexity.ai/hub/blog/escaping-space-part-i , https://github.com/perplexityai/SPACE

Transcript

1. Perplexity open-sourced SPACE The VM held. The network rules did not. Released October 15, 2026, Apache 2.0, Rust Sources: Perplexity blog posts + GitHub repo, read Oct 17 Clydara 1/6
2. What SPACE is The sandbox behind Perplexity Computer since July Each sandbox: a Firecracker microVM with its own OS Control plane creates, pauses, resumes, removes Credentials and network access managed outside the sandbox Diff-based snapshots + full checkpoints (pause, restore, branch) Clydara 2/6
3. Perplexity's claims Not independently verified Millions of sandbox creations per day Creation 3-5x faster than its previous provider, same traffic Akamai launched it; Crusoe adding it; CoreWeave CKS guide Clydara 3/6
4. The red-team test (Sep 23) 9 models with root inside a guest VM VM-to-host escape: 0 of 108 runs No network: 0 of 54 bypasses Partial network: 11 of 54 bypasses (DNS forgery, shared CDN IPs) Both fixed; neither worked in the retest Clydara 4/6
5. What coverage skips 8 of 10 other sandbox platforms had a network-policy bypass Needs Linux x86_64 + KVM, TUN, btrfs, privileged Docker No direct macOS path; cloud VMs need nested virtualization E2B wrapper is partial: no mcp, volumeMounts, iam Clydara 5/6
6. Fact vs our read Fact: VM isolation and egress are separate boundaries Fact: only egress broke under agent pressure Our read: buyers will ask vendors for egress red-team results Check: does your gateway verify SNI + Host, or only the IP? Clydara 6/6