Perplexity put the agent in a sandbox. The cloud bill still gets in.

"A sandbox is what makes all of this possible." 1

Perplexity introduced SPACE on July 15 as the sandbox platform underneath Perplexity Computer, its general-purpose agent for running multi-step work over time. The pitch is familiar: give the agent a real filesystem, browser, tools, and enough autonomy to keep working after you leave. The interesting part is that Perplexity has finally admitted the boring bit is the product. 1

Computer turns an outcome into tasks and subtasks, then delegates pieces of the job to sub-agents for research, document generation, data processing, or API calls to connected services. It runs those jobs in an isolated environment with a real filesystem, browser, and tool integrations, rather than leaving the model trapped in a chat box. 2

SPACE is the machinery that keeps that environment alive. Its control plane tracks where sandboxes run and whether they have been backed up. Node-local services handle storage, networking, and lifecycle operations. Each sandbox is a virtual machine with its own guest kernel, plus a small in-guest space-daemon that brokers filesystem and process access. 1

That lets Computer pause, resume, suspend, restore, fork, and roll back work instead of treating every interruption as a fresh prompt. SPACE uses disk snapshots and full VM checkpoints, with suspended snapshots uploaded to object storage so another node can restore them later. The product is less “an agent in a box” than “a cloud operating system for agents that refuse to clock out.” 1

The engineering is not imaginary. SPACE combines VM isolation with host-level process isolation, forces outbound traffic through a network gateway, and keeps credentials outside the sandbox. Its credential manager injects access at the network layer or fills it through a browser agent instead of handing secrets directly to the workload. Perplexity also supports bring-your-own-key encryption for data stored outside the sandbox. 1

That is a sensible response to agents that can run code, edit files, and make network requests. It narrows the blast radius when the workload is buggy or compromised. Perplexity reports that its comparison rollout cut median sandbox creation latency from 185 milliseconds to 60 milliseconds, and 90th-percentile latency from 447 milliseconds to 89 milliseconds. Those numbers are vendor-reported, but they describe a real systems problem rather than a chatbot demo. 1

Here is the catch hiding behind the word “sandbox”: this is not a local boundary that you own. It is a managed runtime with a control plane, node services, snapshot storage, network gateways, and a credential service. The safety promise is that an agent cannot casually escape its VM. The operational reality is that your long-running work still depends on Perplexity’s system to store state, restore state, mediate egress, and decide when credentials can be injected. 1

The price matches the architecture. Perplexity’s current plan page lists Computer access with Pro at $17 per month when billed annually, including 4,000 bonus Computer credits. Max is listed at $167 per month when billed annually, with 35,000 bonus credits and 10,000 monthly credits. The runtime is not an install you buy once; it is a subscription wrapped around a usage budget. 3

SPACE is the most serious part of Perplexity Computer because it tackles the unglamorous problem that makes long-running agents possible: preserving state without giving an untrusted workload the keys to the host. But it also exposes the marketing trick. “Safe sandbox” sounds like local containment; SPACE is a remote, metered workplace whose usefulness depends on durable snapshots, provider-controlled networking, and paid credits. It is worth considering for teams that want managed agent execution and accept that control boundary. It is a bad fit for anyone who hears “sandbox” and thinks “the work stays on my machine.” Perplexity did not build a box around the agent. It built a cloud, then put the box inside it.