Give your coding agent a sandbox

Hey there 👋

I opened two announcements this morning that turned out to be the same announcement. Perplexity open-sourced the sandbox it runs agent code in. Nvidia open-sourced one too, in the same window. Neither is a model and neither is a benchmark, and that is the tell. The part of agent-building nobody had a clean answer for was never the model. It was where the thing runs once it starts writing and executing its own code, and this week two companies gave that away for free within days of each other.

That is the thread today: an agent that remembers you, a bank that hired a thousand people to clean up after its AI, and a piece of malware that wants your agent's keys. The model is the settled part now. The open question is the blast radius.

- Ron

The Big Thing

Perplexity open-sourced the box you run your agent's code in

Perplexity released SPACE on GitHub under the Apache 2.0 license, and the name says what it is: Sandboxed Platform for Agentic Code Execution. It is the thing that runs the code your agent writes, in isolation, so a bad command or a prompt-injected instruction cannot reach the rest of your machine. It is built on AWS Firecracker microVMs, which means the boundary sits below the shared operating system rather than at a software fence inside it. A sandbox spins up in about 60 milliseconds, down from 185, so you can give every task its own clean box. It can pause and resume, it keeps rolling snapshots for up to a week, and it supports bring-your-own-key secrets that get injected only when the code needs them and never get stored inside the box.

This is not a lab demo. SPACE has run in production since June powering Perplexity Computer, across millions of sandbox creations, so the open-source drop is battle-tested code rather than a research release.

Now the part to read with your skeptic hat on. Perplexity says it told frontier models to break out and none did: Semafor reports nine models across 118 attempts, a Perplexity writeup puts it at 108, and either way the number is Perplexity's own September red-team with no outside reproduction yet. The company was honest about one thing that matters: during the exercise a few network-policy holes surfaced, and Perplexity patched them. So believe the mechanism, microVM isolation plus secrets that never touch the sandbox, and treat the zero-escape headline as a vendor claim until someone outside runs the test. The bigger signal is not Perplexity at all. Nvidia open-sourced its own agent sandbox, OpenShell, in the same week, and cloud providers including CoreWeave, Akamai, and Crusoe agreed to offer SPACE. Agent isolation just went from a thing you build to a thing you install.

Ship it? TRY now. Stand SPACE up for any agent that executes code it wrote, point your own red-team at it before you trust the escape numbers, and keep your keys on bring-your-own-key injection. If you need local and no cloud bill, OpenShell is the other door. Either way, running agent-written code on bare metal is now a choice you are making, not a limitation you are stuck with.

Sources: Semafor: Perplexity to give away its AI security software; Crypto Briefing: Perplexity open sources SPACE.

Tour de Headlines

🧠 Copilot Studio agents can remember you now. Microsoft put agent memory into production-ready preview in Copilot Studio. The agent captures a user's preferences and context, stores them as files in Microsoft-managed storage, and applies them in later conversations, so it stops asking the same three questions every session. Read the fine print, because the aggregators got it wrong: the memory is per user and never shared across users, it clears after 28 days of no contact, each person can view or wipe their own through a memory portal, it runs on the GitHub Copilot harness, and it spends Copilot Credits as it goes. Persistence is the quiet upgrade that turns a chatbot into something closer to a coworker, and it is also a new place your users' data lives. Verdict: PILOT it on one workflow, set the credit budget, and tell whoever owns data governance where the memory store sits.

🏦 Bank of America hired a thousand people to clean up after its AI. This is the part the security demos skip. Anthropic's Claude Mythos surfaced flaws in vendor and in-house software at industrial scale, one scan flagged more than 23,000 issues, and the bank added about 1,000 contractors in the second quarter, on top of 3,000 staff, to patch them. Remediation and compliance work added a few hundred million dollars to third-quarter costs, even as the CEO still projects 300 million in AI savings this year. The lesson is about sequencing. The finder is the cheap half and the fixing is the expensive half, and someone on the bank's own feed asked the fair question of why Mythos did not repair what it flagged. Verdict: WATCH, and budget the cleanup crew before you point a finder at your whole codebase.

🎮 Four agents beat Minecraft from scratch by leaving each other notes. A Google DeepMind team had four Gemini 4 Argon agents defeat the Ender Dragon from a random spawn in 27 hours and 14 minutes, writing 2,783 JavaScript programs against the standard Mineflayer library, with 229 messages and 605 deaths on the way. The hook is how they did it. No pre-assigned roles, no human-written game tools, just in-game chat and a shared memory the agents used to split the work and write their own tools as they went. It is a research result on Hugging Face, not something you deploy. But emergent division of labor through a shared scratchpad is the same persistence idea running under the rest of today's issue. Verdict: WATCH the coordination pattern, skip the hype about agents beating games.

Tool of the Day

🛠️ Sakana Agentic Scientist v3

Turn a task.md brief into experiments, ablations, and a written paper, with every phase boxed in its own Docker container.

If you run eval or research loops, AI-Scientist-v3 from Sakana is worth an afternoon. It is Apache 2.0 on GitHub, and it wraps a coding agent you already use, Claude Code, Codex, OpenCode, or Pi, in a six-phase pipeline: task drafting, investigation, ablations, final evaluation, post-hoc analysis, and paper production. The design detail that fits today's theme is that each phase executes in its own Docker container reading a run-local snapshot, so the agent never touches your real environment. Sakana says a version co-produced an Error Diffusion paper accepted as an oral presentation at ALIFE 2026, with humans choosing the question and verifying every result. One warning to respect: it runs full-permission inside the container, so hand it minimal credentials, and it only covers computational machine-learning tasks for now. Same discipline SPACE sells, built straight into a research agent.

AI-Scientist-v3 on GitHub

Worth a Click

• The AI-found-bug market is consolidating. Cohere signed a letter of intent, not a closed deal, to buy AISLE, an AI vulnerability scanner that claims 500-plus new CVEs across 100-plus codebases, including 18 of the 24 fixed in cURL's October release. The Prague team becomes a new Cohere Cyber unit. Read the counts as AISLE's own.
• Rotate your agent's keys tonight. Symantec says the Aoki infostealer now hunts AI coding-assistant secrets: Claude's .claude.json and desktop cookies, Codex config.toml and .env files, and tokens for Copilot, Cursor, Gemini, JetBrains AI, and Kiro, plus AWS credentials. A stolen token acts as you, with your quota and your repos. Vault the session files and rotate anything exposed.
• The other open sandbox. Nvidia open-sourced OpenShell, a containerized runtime that isolates autonomous agents locally with no cloud bill. Two open agent sandboxes in one week is the real headline. Pick one and stop running agent code on bare metal.

Here is my bet, with a stake on it. The teams that win the next quarter will treat an agent like a new contractor on day one: a scoped account, an isolated workspace, rotated keys, decided before the first task, not after the first incident. Everything in today's issue points the same way. SPACE and OpenShell are the isolated workspace. Copilot Studio memory is the question of what the agent is allowed to remember and where that data sits. Aoki is why the keys have to be locked. And Bank of America is the bill that lands when you skip the sequencing, because the finder is cheap and the thousand-person cleanup is not.

The model stopped being the interesting variable. It is good enough, it is cheap enough, and it is mostly interchangeable. What is left to get right is the blast radius: where the agent runs, what it can touch, and what it keeps. Give it the sandbox and the badge first. The work comes after.

- Ron