The artificial intelligence search engine startup Perplexity AI Inc. is shifting its focus to AI agent security in the wake of several high-profile incidents that saw autonomous systems escape from secure environments and go on to wreak havoc on third-party websites.
The company has developed an AI sandbox specifically for isolating AI agents called SPACE, and it’s being made open source from today, which means every developer can use the tool to secure their own systems. SPACE is already being deployed by partners including CoreWeave Inc., Akamai Technologies Inc. and Crusoe Inc., which all offer cloud-hosted infrastructure platforms for AI systems.
AI sandboxes are the main barrier that prevents AI agents from causing problems like leaking sensitive data or going off and hacking other systems. They’re secure, isolated virtual environments where autonomous agents can run third-party software, browse the internet and execute tasks without risking the security of the host computer, the broader corporate network or underlying data center. By giving each AI agent its own walled-off computer in the cloud, if it makes a mistake, runs a destructive command or is manipulated by adversarial prompts, the damage it does will be contained within that environment.
The only problem with AI sandboxes is their security isn’t always foolproof. In fact, there have been several incidents of cunning AI agents managing to find a way to escape from their confines and make trouble elsewhere.
One of the most notable involved AI agents being tested by OpenAI Group PBC, which escaped from a sandbox and went on to hack into the model hosting platform Hugging Face. OpenAI’s agents have also hacked websites operated by the U.S. and Australian governments.
Most frontier model labs have been focused more on “model alignment,” which involves training AI systems to behave themselves and not look for loopholes in their guardrails, but Perplexity engineer Zibi Braniecki told Semafor his company has instead concentrated on making those guardrails tougher and more reliable.
Perplexity developed SPACE to safeguard its Portable Computer agents, which are marketed to its customers as locally-hosted AI agents that can perform tasks on their behalf. They’re designed to do things like developing web applications, research products, buy things online, book hotels and so on.
With Perplexity’s Computer agents, SPACE provides safety features such as isolated code execution, pause and resume, recovery and session branching. Agents run within a small virtual machine that has its own operating system, isolating them from the host computer.
There’s a user-controlled control plane for creating, running, pausing and deleting these VMs. SPACE ensures that these sandboxes are always treated as “untrusted,” and manages their network access and platform credentials outside of the sandbox, enabling agents to connect to authorized services without that sensitive information ever being made available to them within their environment. It also takes frequent file snapshots and checkpoints of the running environment to preserve progress and ensure it can revert back if any problems occur.
So far, though, there hasn’t been any need to do anything like that, for SPACE seems to be bulletproof. Braniecki told Semafar that his team tested nine frontier models in SPACE environments and ordered them specifically to try and break out of their sandbox.
In 118 attempts, none of them succeeded, though some did manage to find their way around the network restrictions. However, Perplexity has now fixed those weaknesses, and none of the models were able to do it again in follow-up testing.
To compare SPACE’s performance, Perplexity performed the same tests using other, proprietary sandboxes, and said the agents found a way to escape from several of them.
Braniecki said the open-source nature of SPACE is key to securing AI agents, because it will enable companies to work together to build the tough guardrails they need. It’s similar to what happened during the early days of web browsers, he said, where the developer community collaborated on the security systems needed to enable secure browning and online commerce.
Perplexity isn’t the only company pursuing an open-source approach to AI agent sandboxes. One alternative is Nvidia Corp.’s OpenShell project, which was released last month as part of a broader Open Agent Safety Platform. So far, there have been no reported escapes from OpenShell.
Perplexity is not new to open-source security. Besides SPACE, it has also developed open source innovations such as BrowseSafe, which is used to detect malicious instructions hidden in web pages; Numbat, a tool for investigating dangerous agent behaviors; and Bumblebee, which is a scanner that’s used to detect risky AI tool configurations.