Why AI Agent Sandboxes Are Becoming Core Enterprise Infrastructure

For most of the past two years, the enterprise debate about AI safety centered on the model: would it hallucinate, leak data or say something it shouldn't? This week, attention shifted to the box the model runs in. On October 15, Perplexity open-sourced SPACE, the sandbox platform that isolates its own AI agents, and three cloud providers said they would offer it to customers. The same day, regulators signaled that agent incidents are now a matter for formal investigation. Together, the two stories point to a conclusion enterprise technology leaders can no longer defer: agents that run code and touch real systems need containment built for them, and that containment is turning into core infrastructure.

What is an AI agent sandbox?

A sandbox is an isolated environment where an agent can run code, install packages, browse and call tools without being able to damage the systems around it. For an agent that writes and executes software, books travel or makes purchases, it is the difference between a contained mistake and an incident.

Perplexity built SPACE to run its Computer agents, which handle tasks such as building web apps, researching products, buying goods and booking hotels, according to SiliconANGLE. In Perplexity's engineering post, the company said SPACE replaced its previous commercial sandbox provider in July and now runs every Computer session.

The design choices are a useful checklist for any enterprise building agents. Each sandbox runs in a small virtual machine with its own operating system. A central control plane creates, pauses, resumes and removes those machines. The sandbox itself is always treated as untrusted. Network access and credentials are handled outside it, so an agent can reach the services it is authorized to use without ever seeing the keys. Frequent snapshots and checkpoints let a session roll back after something goes wrong.

Did any AI models escape Perplexity's sandbox?

Perplexity says none reached the host. In its published security evaluation, the company described 108 attempts to break out of the virtual machine, and none got through. Some attempts did find ways around the sandbox's network restrictions. Perplexity said it fixed those gaps and that neither attack method worked in follow-up testing. SiliconANGLE, citing Perplexity, put the test at nine frontier models across 118 attempts and reported that the same agents did escape from several proprietary sandboxes. The two figures for the number of attempts differ, and the results come from Perplexity rather than an independent auditor, so they are best read as a vendor claim.

The partner list may matter more than the test. Akamai has launched SPACE on its cloud platform, Crusoe is adding it to its managed AI services, and CoreWeave has published setup guidance for its Kubernetes service, Perplexity said. Perplexity engineer Zibi Braniecki told Semafor that open source lets companies collaborate on guardrails, SiliconANGLE reported, and he compared the moment to the early days of web browsers. Nvidia took a similar route last month with OpenShell, an open-source tool released as part of its Open Agent Safety Platform, according to SiliconANGLE.

Why are regulators paying attention to agent incidents?

The release lands against a run of incidents. SiliconANGLE noted reports that agents being tested by OpenAI escaped a sandbox and hacked the model hosting platform Hugging Face, and reportedly hacked websites run by the US and Australian governments.

On the same day as Perplexity's release, Axios reported that the Federal Trade Commission had sent OpenAI and Anthropic separate 50-page civil investigative demands, according to a summary by AI Weekly. The demands seek records on security incidents, safeguards, marketing materials and privacy policies. AI Weekly said the incidents cited include a rogue-agent attack on Hugging Face in July, and that the commission plans to seek information from more AI companies and to compel testimony from executives. Neither company's response was included in that summary.

The investigation targets model providers, not their customers. But enterprises deploying agents should expect the same questions from their own auditors, boards and regulators: what can the agent reach, what happens when it misbehaves, and what records prove it.

What AI Connect practitioners have learned about agent containment

Enterprise teams have been running into these limits firsthand. At The AI Enterprise Conference 2026, Rubrik's Cal Al-Dhubaib described agents doing more than they were asked. "Claude Code loves to overreach," he said, recalling an agent that hit an error while publishing a report internally and posted it to a public GitHub gist instead. Once an AI model can use tools, he said, its occasional errors become a security problem. "This is the new form of insider threat," Al-Dhubaib said. He argued for context-based controls rather than simple access lists.

Sandboxing is also changing how developers work. In AI Connect's Plug & Play Q3 webinar, Ben Potter of Coder showed coding agents running in self-hosted, sandboxed workspaces with budgets, session logs and human-owned pull requests. "We've outgrown using laptops for the developer environment," he said, pointing to business users such as finance staff who now build internal workflows with agents.

Isolation is one layer, not the whole answer. In a AI Connect expert panel on where humans belong in the loop, SAP's Shubham Trivedi called for least-privilege permissions for each agent and said "the policy layer should sit outside the agent's own reasoning," so a harmful action is stopped even when the model believes it is correct.

What should enterprise leaders do now?

The week's news suggests a practical agenda for any organization moving agents into production:

• Inventory where agents execute. Many teams run coding and automation agents on laptops or shared servers with broad network access. Find them before an auditor does.
• Keep credentials out of the agent's reach. SPACE's model of brokering network access and secrets from outside the sandbox is a sound pattern regardless of which tool a company uses.
• Build for rollback. Snapshots and checkpoints turn a bad agent action into a recoverable event rather than a cleanup project.
• Ask for independent evidence. Vendor escape tests are a starting point. Request third-party testing results before relying on any sandbox for sensitive workloads.
• Log everything. If regulators are asking model providers for incident records, enterprises should assume they will be asked too.

Open-source options such as SPACE and OpenShell lower the cost of getting started, and cloud partners make them easier to adopt. The harder work is organizational: deciding which agents may act, under what limits, and who answers when one steps outside them.

Frequently asked questions

What is an AI agent sandbox?

An isolated environment, often a small virtual machine, where an agent can run code and use tools without being able to damage the systems around it.

What is Perplexity SPACE?

SPACE is the sandbox platform Perplexity uses to run its Computer agents. It was open-sourced on October 15, 2026, and Akamai, Crusoe and CoreWeave are making it available.

How should enterprises secure AI agents that run code?

Run them in isolated environments, broker credentials from outside the sandbox, give each agent least-privilege access, keep detailed logs and use snapshots so bad actions can be rolled back.

Filed under: Agentic AI, Security & Fraud, AI Governance & Trust