Perplexity AI is making its secure AI agent sandbox SPACE available as an open source solution

Artificial intelligence search engine startup Perplexity AI Inc. is shifting its focus to AI agent security after several high-profile incidents resulted in autonomous systems escaping secure environments and wreaking havoc on third-party websites.

The company has developed an AI sandbox called SPACE specifically for isolating AI agents, which is open source as of today, meaning any developer can use the tool to secure their own systems. SPACE is already used by partners such as CoreWeave Inc., Akamai Technologies Inc. and Crusoe Inc., all of which offer cloud-hosted infrastructure platforms for AI systems.

AI sandboxes are the main barrier that prevents AI agents from causing problems such as leaking sensitive data or hacking other systems. These are secure, isolated virtual environments in which autonomous agents can run third-party software, surf the Internet, and perform tasks without compromising the security of the host computer, the broader corporate network, or the underlying data center. By providing each AI agent with its own isolated computer in the cloud, the damage it causes in that environment is limited if it makes a mistake, executes a destructive command, or is manipulated by adversarial prompts.

The only problem with AI sandboxes is that their security is not always foolproof. In fact, there have been several incidents where cunning AI agents managed to find a way to escape their confines and cause trouble elsewhere.

One of the most notable cases involved OpenAI Group PBC’s testing of AI agents who escaped from a sandbox and subsequently hacked into the model hosting platform Hugging Face. OpenAI’s agents have also hacked websites operated by the US and Australian governments.

Most frontier modeling labs have focused more on “model alignment,” which involves training AI systems to behave on their own rather than looking for gaps in their guardrails. However, Perplexity engineer Zibi Braniecki told Semafor his company has instead focused on making these guardrails tougher and more reliable.

Perplexity developed SPACE to protect its wearable computing agents, which are marketed to its customers as locally hosted AI agents that can perform tasks on their behalf. They are used, for example, to develop web applications, research products, buy things online, book hotels, and so on.

With Perplexity’s computing agents, SPACE provides security features such as isolated code execution, pause and resume, recovery, and session forking. Agents run in a small virtual machine that has its own operating system, isolating them from the host computer.

There is a user-driven control plane to create, run, stop, and delete these VMs. SPACE ensures that these sandboxes are always treated as “untrusted” and manages their network access and platform credentials outside of the sandbox, allowing agents to connect to authorized services without ever having this sensitive information exposed to them in their environment. Additionally, file snapshots and checkpoints of the running environment are often created to preserve progress and ensure that it can be restored in the event of problems.

However, so far there has been no need to do such a thing because SPACE appears to be bulletproof. Braniecki told Semafar that his team tested nine boundary models in SPACE environments and specifically ordered them to try to break out of their sandbox.

Out of 118 attempts, none of them were successful, but some managed to bypass the network restrictions. However, Perplexity has since fixed these weaknesses, and none of the models succeeded again in follow-up tests.

To compare SPACE’s performance, Perplexity ran the same tests with other, proprietary sandboxes and said agents found a way to escape several of them.

Braniecki said SPACE’s open-source nature is key to securing AI agents, as it will allow companies to collaboratively build the strong guardrails they need. It’s similar to the early days of web browsers, he said, when the developer community collaborated on the security systems needed to enable secure browning and online commerce.

Perplexity isn’t the only company taking an open source approach to AI agent sandboxes. An alternative is Nvidia Corp.’s OpenShell project, released last month as part of a broader Open Agent Safety Platform. No OpenShell escapes have been reported so far.

Perplexity is nothing new in open source security. In addition to SPACE, the company has also developed open source innovations such as BrowseSafe, used to detect malicious instructions in web pages; Numbat, a tool for studying the behavior of dangerous agents; and Bumblebee, a scanner used to detect risky AI tool configurations.

Image: SiliconANGLE/Microsoft Designer