Perplexity’s technical report on SPACE — its internal sandbox platform for long-running agents — is a rare look at the infrastructure layer that determines whether agentic AI products actually work at scale.
SPACE — By The Numbers
60ms
Median sandbox creation (vs. 185ms prior)
89ms
P90 latency (vs. 447ms prior — ~5x faster)
100%
Of Perplexity Computer sessions on SPACE
Millions
Sandbox creations + tens of millions of reconnects
All figures self-reported by Perplexity; benchmarks are vs. Perplexity’s own prior infrastructure, not competitors. Platform described in a company technical report, not independently verified.
In a technical report published this week, Perplexity described SPACE — the sandbox platform it built to run its Computer (agent) product — and the core problem that motivated it. Chatbots handle single-turn exchanges; agents are different. Perplexity describes agent sessions as long-lived and stateful: an agent accumulates hours of context, a working filesystem, and running processes over the course of a task. That persistence sits in direct tension with security (isolating agent-generated activity that may be untrusted) and efficiency (controlling resource consumption), a combination Perplexity found that traditional container approaches handle poorly.
SPACE is Perplexity’s answer, and it is now the substrate for every Computer session the company runs. The reported scale — millions of sandbox creations, tens of millions of reconnects — is what makes the architectural choices matter economically, not just technically.
The architecture is three layers. A stateless Control Plane reconciles desired versus observed state through idempotent, self-recovering operations. Node-Local Services manage each sandbox’s lifecycle, storage, and networking, and enforce safety gates including credential management and network-egress policy. At the base, each agent runs inside its own virtual machine with its own kernel, alongside a space-daemon — a process that regulates every action the platform performs inside the guest through a single controlled channel. The design borrows from defense-in-depth logic: both the VM and the host must be breached for a kernel exploit to cross workloads.
SPACE — Architecture Decisions
Isolation Layer
Per-sandbox VMs with dedicated kernels. A compromise in one sandbox cannot propagate across workloads; both VM and host must be breached.
Storage Layer
Btrfs filesystem for fast copy-on-write cloning and atomic snapshots. Layered snapshots (frequent disk + fuller VM checkpoints) allow rollback and crash recovery without lost work.
Credential Layer
Secrets are kept outside the sandbox entirely and injected at the network layer — the agent never holds credentials directly.
Start-Time Layer
Warm pools of pre-built templates reduce cold-start latency. Perplexity reports median creation time falling from 185ms to 60ms — roughly 3.1x faster — and P90 from 447ms to 89ms.
The key insight: The agent runtime is not a commodity infrastructure problem — it is a product problem. Security, stateful recovery, and sub-100ms startup must coexist in the same system. The difficulty of solving all three simultaneously is exactly why this layer matters strategically, and why Perplexity built it rather than bought it.
The Structural Read
The report is interesting as engineering. It is more interesting as a window into a layer of the AI stack that receives almost no attention and is quietly becoming decisive.
The shift from single-turn AI to long-running agents is not incremental. A chatbot needs a model and an API. An agent that executes code, edits files, browses the web, and sustains multi-step tasks over hours needs a secure, stateful, recoverable execution environment underneath the model. That environment — the agent runtime — did not matter when AI was single-turn. It is foundational now. It is the picks-and-shovels layer of the agentic era: the model gets the attention, the sandbox does the work.
This maps directly onto what the Agentic AI Stack framework describes: the infrastructure beneath the model — storage, execution, orchestration, isolation — is load-bearing for any product that depends on agents actually completing tasks reliably. Perplexity’s technical choices are not just engineering decisions; they are where the product’s trust and coststructure get determined.
The Four Intelligence Moats — Applied
Boring Infrastructure Is the Hardest Moat to Copy
Btrfs, VM isolation, and layered snapshots are not novel concepts. But running them correctly at millions of sandboxes — with the right credential handling, egress policy, and warm-pool economics baked in — is years of operational learning. It does not show up in a product demo. It compounds silently. That is precisely what makes it durable. See: The Four Intelligence Moats.
There is also a cost and control argument for building in-house. Shaving sandbox creation from 185ms to 60ms across millions of creations is real unit economics — at scale, latency is money. More importantly, credential handling, VM isolation, and fork/rollback are capabilities you want to own when agents are executing your users’ code. Renting that from a third party means trusting their security model, their pricing, and their roadmap.
This connects to Perplexity’s broader positioning. The company has been explicit about a model-agnostic orchestration strategy — it does not depend on any single model provider. That strategy only holds if the surrounding infrastructure is proprietary. As the model layer commoditizes — and open-weight models now carry a meaningful share of real usage — durable competitive position migrates to the layers around the model. The runtime is one of those layers. SPACE is Perplexity building the infrastructure its model-agnostic strategy actually requires.
Finally, there is the reliability angle. Agents have a well-documented trust problem: they fail partway through tasks in ways that are hard to recover from. An agent that can snapshot its state, roll back to a clean checkpoint, and resume is an easier agent to trust — and easier to debug. SPACE’s layered snapshot design is not just a performance feature; it is a step toward the kind of agent reliability that long-running tasks require before mainstream enterprise adoption becomes plausible.
Three Implications
IMPLICATION 1 — The Runtime Layer Will Be Competed Over
Every company building a serious agent product will face the same triad Perplexity solved in SPACE: security, statefulness, and efficiency. Most will start with off-the-shelf containers and hit the same walls. A dedicated third-party sandbox market already exists (Modal, E2B, Morph) precisely because this problem is common. Perplexity’s decision to build in-house validates the layer’s importance; the question for the market is whether general-purpose runtimes can match custom-built economics at scale.
Perplexity’s model-agnostic strategy is only as durable as the proprietary infrastructure underneath it. If the runtime is rented, a provider can reprice it; if it is commoditized, so is the differentiation. Building SPACE is Perplexity locking in control over the execution layer so that model-layer flexibility above it remains a genuine strategic option rather than a theoretical one. Labs that do not own their runtime are exposed to dependency risk at the layer that agents actually run on.
IMPLICATION 3 — Snapshot Architecture Is a Trust Primitive, Not Just a Performance Feature
The ability to roll back an agent to a known-good state, recover from a crash without losing work, and audit what happened at each checkpoint changes the risk calculus for deploying agents on consequential tasks. This matters more than latency numbers in enterprise conversations. Runtime-level rollback is a building block for the kind of verifiable, recoverable agent behavior that regulated industries and risk-averse buyers need before they will deploy agents on real workflows.
Business Engineer Framework
The Agentic AI Stack
The Agentic AI Stack framework maps the nine infrastructure layers that sit beneath and around an AI model — from execution environments and orchestration to memory and tooling. SPACE is a case study in one of the most underbuilt of those layers: the secure, stateful runtime. Understanding where this layer sits, who controls it, and what replacing it costs is essential context for reading any agent-product strategy.
Perplexity’s SPACE report is an unusually transparent look at a layer of the AI stack most companies keep internal and most observers ignore — and the engineering choices it documents, from per-sandbox VMs and Btrfs snapshots to credential injection at the network layer, are less a curiosity than a preview of what serious agent infrastructure looks like in production. The model layer is where the narratives live; the runtime layer is where agent products succeed or fail. Perplexity has built its own, it runs at millions of sandbox
91,000+ executives read Business Engineer for the AI strategy frameworks cited by ChatGPT, Claude, and Perplexity.
Gennaro is the creator of FourWeekMBA, which reached about four million business people, comprising C-level executives, investors, analysts, product managers, and aspiring digital entrepreneurs in 2022 alone | He is also Director of Sales for a high-tech scaleup in the AI Industry | In 2012, Gennaro earned an International MBA with emphasis on Corporate Finance and Business Strategy.
Scroll to Top
Discover more from FourWeekMBA
Subscribe now to keep reading and get access to the full archive.
