Perplexity Open-Sources SPACE, a Firecracker MicroVM Sandbox for AI Agents
https://www.marktechpost.com/2026/10/16/perplexity-open-sources-space-firecracker-microvm-sandbox-ai-agents/📌 Perplexity 開源 SPACE：用 microVM 把 AI Agent 關進籠子
TL;DR：Perplexity 把撐起 Computer 所有任務的 microVM 沙箱開源，Apache 2.0 授權，團隊可直接自架。
一套每天跑滿 Perplexity Computer 全部工作階段的沙箱系統，而且團隊自己找了 9 個前沿模型來「越獄」它——這樣的產品被開源出來，值得工程師仔細看一眼。
🤔 Agent 要能執行程式碼，但不能摸到主機
Agent 工作的本質是長時間執行、有狀態、會分支，還得在重啟後存活。要讓 Agent 以 root 權限安裝套件、執行指令、呼叫外部服務，又不讓這些動作波及主機本身，Perplexity 的解法是：每個任務都配一臺獨立的 Firecracker microVM，憑證與對外流量全部由 VM 外部控管。這就是 SPACE（Sandboxed Platform for Agentic Code Execution）的設計起點，應用程式透過 HTTP API 建立 Linux 環境、下指令、串流輸出，template 提供起始檔案系統，sandbox 則是該 template 的一個實例，擁有自己的 VM 與可寫入磁碟，一個 sandbox 內可以跑多個指令。
🧩 四層架構：API、controller、worker、data plane
系統拆成 PostgreSQL 驅動的 API、controllers、worker services 與 data plane 四個部分。worker services 負責管理 VM、網路、volume、template 與憑證；每個 sandbox 的根檔案系統由 btrfs 的 copy-on-write 機制建立；sandbox 的生命週期在 running、paused、suspended、deleted 四種狀態間轉換。為了加速建立速度，Kubernetes 部署會維持一批已開機的 warm pool，單節點部署則改用 base snapshot。安全性上，每個 sandbox 擁有獨立的 guest kernel，host 上的 per-sandbox 網路閘道器會對每一個對外連線執行 egress 政策，密鑰（secrets）從不進入 guest，而是依 Perplexity 七月發布的工程文章所述，在網路層注入憑證，憑證儲存庫還加上了分層授權範圍、速率限制與審計日誌。
📊 延遲從 447ms 降到 89ms，紅隊測試揪出真實繞過手法
生產環境數據顯示，sandbox 建立延遲的 90th percentile 從 447 毫秒降到 89 毫秒，目前 100% 的 Perplexity Computer 工作階段都跑在 SPACE 上。更值得注意的是團隊自己發起的紅隊測試「Escaping SPACE: Part I」：讓 9 個模型以 root 權限在 guest 內嘗試突破，共跑了 2 個任務、4 種設定、216 次測試，結果 Claude Opus 5.0、GPT-5.6 Sol、GPT-5.6 Cyber 與 Kimi K3 都找到了繞過方法，手法是 DNS 偽造與共用 CDN IP 位址。Perplexity 隨後透過 nftables 加入來源位址驗證，讓閘道器終止 TLS 連線並同時檢查 SNI 與 HTTP host 是否符合允許清單，重測後沒有任何模型再產生可驗證的繞過。同一團隊也測試了 10 個第三方沙箱平臺，其中 8 個出現至少一次網路政策繞過，並已將結果通報給所有受影響的廠商。
🎯 自架門檻與既有 E2B 使用者的遷移路徑
安裝指南把 SPACE 部署進本地 Kind cluster，host 需要具備 /dev/kvm、/dev/net/tun、loop device 與 btrfs；若要在 VM 內跑，則需要巢狀虛擬化（nested virtualization）支援。已經在用 E2B 的團隊可以透過 E2B Compatibility Wrapper 嘗試遷移，其測試基準版本是 Python 套件 e2b==2.21.1，repo 中也附上了一份 AWS EKS 的參考部署範例。對於自建 coding 或 browsing agent 的團隊來說，這是一套經過生產規模與紅隊實測檢驗的隔離層，值得評估是否能直接拿來用。
🔗 來源
- 標題：Perplexity Open-Sources SPACE, a Firecracker MicroVM Sandbox for AI Agents
- 作者／機構：Asif Razzaq, MarkTechPost
- 連結：https://www.marktechpost.com/2026/10/16/perplexity-open-sources-space-firecracker-microvm-sandbox-ai-agents/
#AIAgents #Sandbox #Firecracker #MicroVM #Perplexity #OpenSource #CloudSecurity #AgentSecurity #Kubernetes #DevOps
原始資料 MarkTechPost · 收集於 2026-10-17
摘要原文
Perplexity has open-sourced SPACE , the sandbox platform behind every task in Perplexity Computer. The Perplexity SPACE sandbox gives each agent task its own Firecracker microVM. Credentials and outbound traffic are controlled from outside that VM. The code ships under Apache 2.0 on GitHub . For teams building coding or browsing agents, this is a production-tested isolation layer they can self-host. SPACE (Sandboxed Platform for Agentic Code Execution) is Perplexity’s platform for running agent code in isolated microVMs. Applications call its HTTP API to create Linux environments, run commands and stream output. A template supplies the starting filesystem. A sandbox is one instance of that template, with its own VM and writable disk. Many commands can run inside one sandbox. Perplexity’s launch thread explains the design goal. Agents run commands, install packages and call services with root inside the sandbox. The host stays outside the guest’s control. Agent work is long-running, stateful and branching, so it must survive restarts. Each sandbox is a Firecracker microVM with its own guest kernel. A per-sandbox network gateway on the host enforces egress policy on every outbound connection. Secrets never enter the guest. Per Perplexity’s July engineering post , credentials are injected at the network layer. The credential store adds hierarchical scoping, rate limits and audit logging. The architecture guide splits the system into 4 parts. These are a PostgreSQL-backed API, controllers, worker services and a data plane. Worker services manage VMs, networking, volumes, templates and credentials. btrfs copy-on-write creates each root filesystem. Sandboxes move through 4 states: running, paused, suspended and deleted. For fast creates, Kubernetes deployments use warm pools of booted sandboxes. Single-node setups use base snapshots instead. In production, the 90th-percentile create latency dropped from 447 ms to 89 ms . Perplexity reports that 100% of Computer sessions run on SPACE. Perplexity’s Escaping SPACE: Part I report tested 9 models with root inside the guest. The study ran 216 runs across 2 tasks and 4 settings. Claude Opus 5.0, GPT-5.6 Sol, GPT-5.6 Cyber and Kimi K3 found bypasses. The attacks used DNS spoofing and shared CDN IP addresses. Perplexity then added source-address validation through nftables. The gateway now terminates TLS and checks both SNI and HTTP host against the allowlist. In the retest, no model produced a verified bypass. The same team tested 10 third-party platforms. 8 showed at least one network-policy bypass. Perplexity disclosed the results to every affected vendor. The installation guide deploys SPACE into a local Kind cluster. The host needs /dev/kvm , /dev/net/tun , loop devices and btrfs. Running it inside a VM requires nested virtualization. Teams already on E2B can try the E2B Compatibility Wrapper . Its tested baseline is the Python package e2b==2.21.1 . A reference AWS EKS deployment ships in the repository. Check out the GitHub repo , the docs and the red-team report . All credit goes to the researcher of this project. Also, feel free to follow us on Twitter and don’t forget to join our 150k+ML SubReddit and Subscribe to our Newsletter . Wait! are you on telegram? now you can join us on telegram as well. The post Perplexity Open-Sources SPACE, a Firecracker MicroVM Sandbox for AI Agents appeared first on MarkTechPost .
由 claude-code/sonnet 自動生成