Perplexity explains how SPACE routes agent requests to sandbox executions

Perplexity has detailed how its SPACE platform routes an authenticated AI-agent request to a selected sandbox execution. A short-lived signed capability carries the authorized sandbox and execution identity through the system. Perplexity presents the design as a way to prevent a request for one sandbox incarnation from reaching another, but its published evidence does not independently validate the implementation or production deployment.

For a file-read request, Perplexity says the SPACE control plane resolves the logical sandbox to a particular execution and worker. The request then passes through node-api and sbx-manager, crosses a Unix socket to spaced-host, and reaches spaced-guest inside a Firecracker microVM over VSOCK. This path separates the stable sandbox identity covered by caller authorization from a route identity that describes the current execution and placement. On Kubernetes, the route identity also contains the pod UID.

Once the caller is authorized, the control plane issues a capability naming the sandbox, execution, placement and permitted access. Perplexity says the capability uses an Ed25519 signature, expires after 120 seconds and allows up to 15 seconds of clock skew. Signing keys remain in the control plane; workers and gateways receive public verification keys. A public ServicePort capability also specifies the allowed port and protocol.

According to Perplexity, the receiving sandbox manager verifies the signature and compares the complete selected identity with its locally stored runtime record. A validly signed request is rejected if its execution identity does not match the execution the worker is serving. Perplexity acknowledges a residual window: an older capability can still match an older execution until the worker learns that the execution has retired or the capability expires.

Node-side checks also compare peer credentials with the expected host-bridge and Firecracker process identities, Perplexity says, while binding the VSOCK listener to the expected Firecracker process. New connections are checked again, and transparent reconnection is refused. The claim stops short of guest-application attestation: ServicePort traffic is checked for execution, port and protocol at the per-sandbox network gateway, but that does not establish the identity of an arbitrary application inside the guest.

For long-running backend streams, Perplexity says SPACE ties each stream to an identity epoch and cancels its lease when the route or execution changes. If a request carries an outdated route for the same sandbox, eligible operations can resolve the current execution and make one rebuilt attempt. A mismatch pointing to a different sandbox is denied, and the replacement backend must pass admission checks again.

Perplexity has separately described how it split AI search storage across Pillar, Lorry and CobbleDB.

The company’s architecture guide describes separate authorization material for management requests and session-scoped attachment tokens for command connections, saying the two are not interchangeable. The guide also says host-side services retain the privileges needed to manage virtual machines, storage and networking. A separate internal RPC TLS guide says signed route capabilities and runtime fences constrain what honest workers accept. They do not prove that an intercepted connection reached the intended worker or prevent another holder of a shared service identity from collecting credentials. Perplexity recommends per-node certificate identities where that risk must be excluded.

Perplexity’s threat model trusts the control-plane signer, worker kernel and node-local management services, while excluding worker-root and privileged cluster-administrator compromise. The bridge check is not hardware-backed remote attestation. Perplexity also says SPACE has processed millions of executions a day for months, with an error rate below 0.0002% and no dropped connections, but it did not publish independently auditable measurements for those figures.