Isolating each agent task in a Firecracker microVM with externally managed credentials is a concrete, reusable pattern for agent safety that goes beyond model-level guardrails. Developers building autonomous agents can adopt SPACE directly or borrow its architecture to limit blast radius from malicious prompts. The Apache 2.0 license allows both commercial and open-source integration without restrictions.
Perplexity 把自家智能体沙箱 SPACE 开源了，每个任务跑在独立 Firecracker microVM 里，做 Agent 隔离可以直接抄作业。
The interesting part is the state machine: Pause keeps memory resident for fast recovery, Suspend snapshots VM memory plus filesystem for true persistence, with idle sandboxes auto-suspending after 6 hours. Engineers building agent sandboxes or code-interpreter features can study how warm pools and btrfs snapshots attack cold-start latency, a problem most teams still solve ad hoc. Management and attachment tokens being non-interchangeable is a useful security boundary pattern to copy.
Isolating each agent task in a Firecracker microVM, with credentials and network egress managed outside the VM, is a concrete pattern teams building agent infrastructure can study or adopt directly. Developers running autonomous agents with tool access can compare SPACE with alternatives like E2B or self-managed gVisor setups. The Apache 2.0 licence permits commercial use without restrictions.
给 Agent 搭运行环境必看，国内外的开源 Sandbox 一篇梳理清楚，各家适合什么场景都写明白了。
做浏览器自动化、爬虫或 AI 代理的开发者，这次基础设施升级直接关系到你的任务速度和成本，值得关注即将到来的变化。
