On this page
- Which Sandbox API Should Your Agent Call: Perplexity's or CreateOS's?
- What is Perplexity SPACE?
- What Can a Developer Actually Call Today?
- How Does CreateOS Sandbox Compare, Feature by Feature?
- Is SPACE Faster Than CreateOS Sandbox?
- What Does Each Cost for a Typical Agent Job?
- Common Questions
- About CreateOS
- Next Step
Which sandbox API should your agent call: Perplexity's or CreateOS's?
If your agent runs inside Perplexity's Agent API and needs to run a bit of Python, Perplexity's sandbox tool is already there and costs $0.03 per session. If you need a sandbox your own agent calls directly, with any image, an egress allowlist, pause and fork, computer use, or self-hosting, that is CreateOS Sandbox. The two are not yet the same kind of product, and most of the coverage of Perplexity's SPACE launch blurs that.
SPACE is the runtime Perplexity built for its own products. What a developer can call today is a code-execution tool inside the Agent API, running Python and bash in a container, with a standalone Sandbox API listed as upcoming on Perplexity's roadmap. This page compares what exists, with every Perplexity claim traced to their documentation or their announcement, and every CreateOS number to a measurement you can repeat.
What is Perplexity SPACE?
SPACE, "Sandboxed Platform for Agentic Code Execution", is the Firecracker microVM runtime behind Perplexity Computer, announced on 15 July 2026. Perplexity describes disposable sandboxes wrapped in durable sessions, so a task's sandbox is destroyed when it finishes while the session can be paused, resumed or branched.
The announcement's figures, as reported by Perplexity and repeated by SiliconANGLE, AlphaSignal and bex.co:
- Median sandbox creation fell from 185 ms to 60 ms; the 90th percentile from 447 ms to 89 ms.
- Millions of sandbox creations and tens of millions of reconnects in launch week; 100% of Computer sessions run on it.
- Rolling disk snapshots plus full snapshots of the paused VM, memory included, for pause, resume and branching.
- Secrets never enter the sandbox; credentials are injected at the network layer.
Those are strong numbers and a sound design. They are also internal: measured inside Perplexity's infrastructure, on a runtime that is not exposed to developers as a raw create call.
What can a developer actually call today?
A sandbox tool inside the Agent API, plus a standalone Sandbox API that Perplexity lists as upcoming. From Perplexity's sandbox tool documentation, pricing and roadmap, as of 11 September 2026:
| What Perplexity documents | Detail |
|---|---|
| How you invoke it | Add {"type": "sandbox"} to the tools array of an Agent API request; "the model decides when to call it" |
| Runtimes | "The model runs Python for computation and bash for shell commands" |
| Isolation | "An isolated Linux container"; executions in one response share it |
| Network | "The container has network access"; no allowlist documented |
| Limits | "Each execution has a runtime cap"; the value is not stated; long jobs use background mode and polling |
| Price | $0.03 per session, 20-minute billing window, plus model tokens; $0.0025 per search run from inside the sandbox |
| Standalone Sandbox API | Roadmap, "Upcoming and In Progress": Python and bash, "dedicated per-sandbox containers", files and processes, pause/resume |
Two things follow. First, the developer-facing sandbox is a container, not the Firecracker microVM the SPACE post describes; the roadmap uses the word "containers" for the coming Sandbox API too. Second, your agent does not create, pause or fork a sandbox; Perplexity's model decides to run code, inside Perplexity's loop.
How does CreateOS Sandbox compare, feature by feature?
CreateOS Sandbox is a Firecracker microVM your code creates and controls directly. Every row below for CreateOS is on the limits and defaults page or the egress allowlist page; every Perplexity row is from the documentation linked above.
| CreateOS Sandbox | Perplexity sandbox (today) | |
|---|---|---|
| Isolation | Firecracker micro-VM with its own guest kernel | Isolated Linux container (SPACE microVMs internally) |
| How your agent calls it | REST, TypeScript, Go and Python SDKs, CLI, MCP server | Tool inside an Agent API request; model-initiated |
| Runtimes | Any image: Alpine, Debian, Ubuntu, a dev box, a desktop with Chrome, or your Dockerfile | Python and bash |
| Egress | Open with no rules; deny-by-default with any rule, enforced in the host kernel outside the VM | Network access; no allowlist documented |
| Lifecycle | Create, exec, pause, resume, fork, destroy as API calls | Session inside the request; pause/resume on the roadmap |
| Networking between sandboxes | Private overlay networks | Not documented |
| Storage | S3-compatible disks you control | Files shared within a response; share_file to retrieve |
| Computer use | desktop:1 image with a screenshot, mouse, keyboard and window API |
Perplexity Computer is a product, not an API for your agent |
| Self-host | Control plane and storage in your VPC or on-prem | Runs inside Perplexity |
| Concurrency | 1 (Free), 5, 20, 30 concurrent by plan | Subject to Agent API rate limits; not stated per sandbox |
Where Perplexity is genuinely ahead: production scale nobody outside a handful of vendors can claim, credential injection at the network layer as a default, and a price that is one number.
Is SPACE faster than CreateOS Sandbox?
Perplexity's 60 ms is an internal creation time; the closest public number for CreateOS is 0.18 s median time-to-interactive on a third-party burst benchmark. They are different measurements, and SPACE is not on any benchmark a third party runs. Here is everything we can put next to each other, with the source and the method for each.
| Measurement | Value | Who measured, how |
|---|---|---|
| Perplexity SPACE sandbox creation, p50 | 60 ms (from 185 ms) | Perplexity, inside its infrastructure, July 2026 announcement |
| Perplexity SPACE sandbox creation, p90 | 89 ms (from 447 ms) | Same |
| CreateOS time-to-interactive, median | 0.18 s, 100% success | ComputeSDK burst benchmark, 11 September 2026, all 29 providers launched concurrently from Northern Virginia; CreateOS ranked 2 of 29 |
| Same benchmark, for scale | E2B 1.28 s, Modal 0.89 s, Daytona 0.35 s, Vercel 0.50 s, Blaxel 0.63 s, Runloop 1.14 s, Cloudflare 5.70 s | Same run; Perplexity not listed |
CreateOS spawn_ms (server-side VM start, returned by the create call), 60 sequential creates, 20 per image |
Alpine p50 27 ms / p90 58 ms; dev box 28 / 36 ms; desktop with Chrome 29 / 44 ms. 58 of 60 under 70 ms; two cold starts at 2.1 s and 2.4 s | Us, over the public API from a GitHub Actions runner to the EU region, 13 September 2026, zero errors; harness published |
CreateOS create call round trip (includes spawn_ms) |
p50 228 to 239 ms, p90 262 to 415 ms | Same |
| CreateOS first exec after create | p50 158 to 164 ms on Alpine and dev box, 639 ms on the desktop image | Same |
| CreateOS destroy | accepted in 134 ms; destroyed after 760 ms |
Same |
Time-to-interactive includes the API round trip and the first command; a creation time does not. The number most comparable to Perplexity's 60 ms is our spawn_ms, and on 60 sequential creates across three images it was 27 to 29 ms at the median and 36 to 58 ms at the 90th percentile, with two cold starts of about 2 s in the whole series. On that measurement, a warm CreateOS microVM starts in less than half the time Perplexity reports for SPACE, and a full desktop with Chrome starts as fast as a bare Alpine image. What we cannot say is how SPACE behaves on a cold start, because Perplexity publishes no such number; if your agent creates one sandbox an hour rather than in bursts, budget for the 2 s case on either platform.
What does each cost for a typical agent job?
For a short job the two prices are close; for anything long, large or idle, CreateOS bills only the seconds and resources used. Sandbox pricing is $0.0504 per vCPU-hour and $0.0162 per GiB-hour, per second, no egress fees, and a paused sandbox pays for storage only.
| Job | CreateOS Sandbox | Perplexity sandbox |
|---|---|---|
| 20 minutes, 1 vCPU / 1 GB | $0.022 | $0.03 per session, plus model tokens |
| 20 minutes, 2 vCPU / 4 GiB | $0.055 | Not selectable; container resources are not published |
| 2 hours, 1 vCPU / 1 GB, then paused | $0.13, then storage only | Runtime cap per execution is not stated; background mode for long jobs |
| Idle overnight, state kept | Storage only | Not applicable today; pause/resume is on the roadmap |
The token line matters: a Perplexity sandbox session is billed inside an Agent API request, so the model's tokens are part of every run. A CreateOS sandbox has no model attached; you bring whichever model you already pay for.
Common questions
Is Perplexity's Sandbox API an alternative to CreateOS Sandbox?
Not as a direct call, as of September 2026. Perplexity's sandbox is a tool the model invokes inside an Agent API request, running Python and bash in a container for $0.03 per 20-minute session; the standalone Sandbox API is on their roadmap. CreateOS Sandbox is a microVM your own code creates, executes in, pauses, forks and destroys over REST, SDKs, CLI or MCP, with any image.
Is SPACE faster than CreateOS Sandbox?
Perplexity reports 60 ms median and 89 ms p90 creation, measured inside its own infrastructure. CreateOS measured 0.18 s median time-to-interactive at 100% success on ComputeSDK's public burst benchmark on 11 September 2026, and 27 to 29 ms median spawn_ms (p90 36 to 58 ms) over the public API on 60 sequential creates across three images. Those are different measurements, and SPACE is not on any third-party benchmark, so a like-for-like answer does not exist yet.
Does Perplexity's sandbox have an egress allowlist?
Its documentation says the container has network access so code can install packages and reach external endpoints, and documents no allowlist. CreateOS Sandbox is open with no rules and deny-by-default the moment any rule exists, enforced in the host kernel where code inside the VM cannot change it.
Which one is cheaper?
For a 20-minute Python job they are within a cent of each other: $0.03 per session on Perplexity plus tokens, about $0.022 for a 1 vCPU / 1 GB CreateOS sandbox with no token charge. For longer, larger or idle workloads CreateOS bills per second and pauses to storage-only.
Can I give a Perplexity sandbox a desktop?
No. Perplexity Computer is a product Perplexity operates on SPACE, not an API your agent can drive. CreateOS ships a desktop:1 image with a Computer API for screenshots, mouse, keyboard and windows; see give your agent a computer.
Where do I start with CreateOS Sandbox?
Create an API key, then one call with shape and rootfs returns a running sandbox. The limits and defaults page lists every shape, image, per-plan cap and default, and the CreateOS vs Perplexity comparison page keeps the table above current.
About CreateOS
CreateOS is the unified AI execution layer for the enterprise: route, govern, validate, observe. It runs agent workloads in Firecracker/KVM micro-VM sandboxes with fork, pause-resume, VPC and S3-backed disks, with kernel-level egress control via eBPF, and can run entirely inside a customer's own boundary. Built by the team at NodeOps.
Next step
If you are choosing a sandbox for agents in production, talk to our team about egress policy and self-hosting. For the wider field, 26 sandbox platforms, measured covers everyone on the public benchmark, and Firecracker sandboxes for AI agents explains what happens after isolation.
