Details
- Perplexity published its approach to governing AI agents through infrastructure, testing, product safeguards, and endpoint monitoring.
- SPACE runs each Computer task inside an isolated microVM, while credentials and network controls remain outside the sandbox.
- Snapshots enable rollback, and enterprise customers can revoke encryption keys so protected data becomes unreadable to the agent.
- Perplexity tested nine models with root access across 108 attempts; none escaped the SPACE virtual machine. Separate network testing identified bypasses that were fixed and retested.
- Comet and Computer use BrowseSafe to screen retrieved content for prompt injection, while tool guardrails and confirmation requirements protect sensitive actions.
- Portable Computer keeps the model and harness on the user’s device, enforcing policy through deterministic code and an operating-system sandbox.
- Numbat monitors coding agents including Claude Code, Codex, OpenCode, and Pi, and can block dangerous actions or detect multi-step activity such as secret access followed by data exfiltration.
- Bumblebee scans developer machines for risky packages and extensions. Computer can propose improved detection rules, but humans must approve changes before deployment.
- Perplexity said its Secure Intelligence Institute collaborates with researchers at Stanford, CMU, Duke, Columbia, Ohio State, and UVA, alongside NVIDIA and the Open Secure AI Alliance.
Impact
Perplexity is treating agent security as a layered operational control problem rather than a model-only issue. The approach reflects a broader industry shift toward sandboxing, runtime monitoring, auditability, and human approval as agents gain access to sensitive systems. Its published escape testing and disclosure of weaknesses to other platform vendors could increase pressure for comparable evidence from rivals, while open tools such as Numbat and collaboration with NVIDIA’s safety ecosystem may broaden adoption of common agent-security practices.
