The Sandbox That Stops Existing: Perplexity's SPACE and Ephemerality as a Control Primitive

Perplexity shipped SPACE this month, a sandbox platform for AI agents that handle sensitive data. The design decision worth studying sits in the lifecycle, before any feature list. Every sandbox is created for a task and destroyed when the task ends. Per the announcement, the environment an agent works in simply stops existing once the work is done.

That single choice carries more governance weight than the rest of the platform combined. An environment that no longer exists cannot leak later. It cannot be compromised next week, because there is no next week. Whatever an injected prompt convinced the agent to stash for future use evaporated with the filesystem it was stashed on.

We have argued before that sandboxing moves trust from per-action to per-environment. SPACE is a live implementation to test that framing against, and it exposes something the taxonomy did not name: the time axis.

What Perplexity Actually Shipped

As described in the announcement, SPACE is built on three security layers. A Control Plane governs orchestration and policy from outside the execution environment. Node-level Services enforce boundaries on the machines where sandboxes run. In-sandbox protections harden the environment the agent actually touches. Around that core, the platform adds session forking, credential isolation that keeps secrets out of the sandbox the model controls, and support for on-prem and fully offline deployment.

Perplexity also claims SPACE eliminates the trade-off between functionality, efficiency, and security that constrains existing sandbox solutions. That is a vendor statement about a hard engineering problem, and the page itself resists independent scrutiny for now, so treat it as a claim to verify in your own evaluation rather than a settled fact. The architecture, though, is legible without the benchmark: layered enforcement, secrets outside the blast radius, and environments that die on schedule.

The offline and on-prem support deserves a note. A sandbox platform that runs disconnected is aimed at legal, financial, and healthcare workloads where data cannot transit a vendor’s cloud. That is a deliberate market signal about who Perplexity thinks will pay for containment.

The Taxonomy Meets an Implementation

Our earlier survey of the containment pattern catalogued the sandboxing approaches shipping across the industry: OS-level primitives, user-space kernels, microVMs, and policy layers above them. Every approach in that catalog answers a spatial question. What can this process touch? Which syscalls, which files, which network routes?

SPACE combines several of those patterns at once. The three-layer design is defense in depth across the spatial axis: policy at the control plane, enforcement at the node, hardening inside the environment. Nothing there extends the taxonomy; it stacks known moves.

Ephemerality is the extension. The taxonomy asked what an agent can touch. SPACE also fixes how long the touched surface exists. Those are different control dimensions, and the second one has been quietly missing from most sandbox conversations.

A persistent sandbox accumulates state. Cached tokens. Temp files from task forty-one still readable during task fifty-two. Package caches that a poisoned dependency wrote to on Monday and a different agent read on Thursday. Every one of those is a bridge between tasks, and bridges between tasks are exactly what an attacker who partially compromises one session needs to reach the next. Destroying the environment after each task burns every bridge on a schedule the defender controls.

Ephemerality Is a Control Primitive

Security teams already trust this principle at the identity layer. Short-lived credentials beat static secrets because the window of usefulness for a stolen credential shrinks toward zero. Workload identity federation, which we walked through on the identity floor of the containment stack, rests entirely on that logic: the credential is a transient artifact, derived at the moment of use, worthless an hour later.

An ephemeral sandbox applies the same logic to compute. The environment is a transient artifact, derived for the task, worthless after it. Persistence is the property attackers depend on, whether the persistent thing is a credential, a foothold, or a scratch directory, and ephemerality removes the property itself instead of guarding it.

Session forking, per the announcement, extends the idea sideways. Branching a session into a fresh copy instead of mutating a shared one means exploration happens on disposable branches. A bad path gets abandoned along with its environment. The lineage of what led to any final state stays reconstructable, which is what an auditor asks for and what mutable long-lived environments quietly destroy.

Credential isolation completes the picture, and it answers the threat that keeps agent platform teams up at night: prompt injection. An injected instruction can make an agent misuse whatever sits inside its environment. It cannot make the agent read a secret that was never in the environment. Keeping credentials outside the sandbox the model controls, brokered by infrastructure the model cannot instruct, converts “the agent got tricked” from a breach into an incident.

Watch Who Is Shipping This

Perplexity is a consumer answer-engine company. Its revenue comes from people asking questions, and it just shipped layered enterprise containment infrastructure with offline deployment modes.

Containment used to be sold as compliance tooling, something buyers demanded and vendors grudgingly documented. It is now being built as product, a capability vendors lead with. Anthropic runs gVisor and Bubblewrap under its agent products. Vercel boots Firecracker microVMs for sandboxed execution. Those examples anchored the compute floor when we mapped the wider surface in April. SPACE adds a new data point from an unexpected direction, and the direction is the story. When companies outside the infrastructure business start competing on isolation architecture, containment has crossed from cost center to selling point.

For buyers, this shifts the evaluation question. The market is starting to offer containment properties as differentiators, which means you can now demand them in procurement instead of building them yourself. Sandbox lifecycle, credential brokering, and audit lineage belong in the same RFP section as uptime.

Do This Now

Run a one-hour review of your agent runtime, whatever it is, against two questions.

First: how long does an execution environment live after its task ends? If sandboxes persist across tasks, inventory what accumulates inside them: caches, temp files, tokens, package state. Each item on that list is cross-task attack surface. Decide deliberately which items justify the persistence, and destroy the rest by default. If your platform cannot destroy environments per task, write that down as a known limitation with an owner.

Second: what secrets exist inside the environment while the agent runs? Anything the model can read, an injected prompt can attempt to exfiltrate. Move credentials behind a broker outside the sandbox, issue them short-lived and scoped per operation, and confirm the agent’s environment holds nothing worth stealing at rest.

Teams that already run the four-floor review from the containment stack should add lifecycle as an explicit line on the compute floor. The question set grows by one entry: for every environment an agent occupies, when does it stop existing? If the honest answer is “never,” you now know exactly where to start.

This analysis synthesizes Secure Sandboxes for Agents (Perplexity AI, July 2026).

Victorino Group helps engineering organizations design agent containment architectures where isolation, credential brokering, and environment lifecycle are governed by default. Let’s talk.