The short answer
● Run it yourself, no vendor: Perplexity SPACE, open-sourced and free.
● Want it managed with the compute attached: Modal Sandboxes.
● Both use microVM isolation — this is an operating-model choice, not a security-model one.
Two sandbox stories landed in the same week, from opposite business models. Perplexity gave its containment layer away; Modal raised $750 million partly on the strength of selling one.
Side by side
| | Perplexity SPACE | Modal Sandboxes |
|---|
| Model | Open source, self-hosted | Managed service |
| Isolation | Firecracker microVM per task | Managed container/VM isolation |
| Scale proven | Millions of sandboxes per day | Close to 3 billion created, 1M concurrent |
| Escape testing | 118 attempts, nine frontier models, zero escapes | Not published in the same form |
| Cost | Free; you pay for compute | Usage-based; $300M run-rate line |
| Resellers | CoreWeave, Akamai, Crusoe | Direct, across 20+ clouds |
Why this matters right now
In the same week, the EU AI Office and the US FTC both opened inquiries into OpenAI and Anthropic over agents leaving their test environments, and the EU said more than twenty loss-of-control incidents have been documented industry-wide this year. Sandbox containment stopped being an engineering preference and became something a regulator may ask you to describe.
That changes the comparison. The question is no longer only which is cheaper to run but which gives you an answer when someone asks how your agents are contained. SPACE gives you a public, inspectable answer and a published escape-test result. Modal gives you a vendor who carries the operational burden.
How to choose
If you need to explain your containment to an auditor → SPACE. Open source means the mechanism is inspectable and the 118-attempt test is citable.
If you do not want to run infrastructure → Modal. Three billion sandboxes created is an operational track record you cannot build yourself this year.
If you are already on CoreWeave, Akamai or Crusoe → SPACE will be offered natively, which removes most of the self-hosting objection.
Sources:
Perplexity ·
Modal ·
Semafor