Perplexity is getting ready to hand developers one of the most powerful pieces of its internal stack: the Sandbox API, a managed, isolated code execution environment that’s been quietly powering Computer, Deep Research, and the Finance Agent behind the scenes. Instead of being just another “code interpreter,” Sandbox is designed as infrastructure for agents that need to think in natural language but compute in a deterministic, auditable way.

Under the hood, every Sandbox session spins up inside its own isolated Kubernetes pod, so each workflow runs in a dedicated environment with its own resources and filesystem. Developers never touch the underlying infra – provisioning, networking, cleanup, and resource management are handled by Perplexity’s platform, the same stack it already relies on to run thousands of Computer sessions per minute. Out of the gate, Sandbox supports Python, JavaScript, and SQL, with the ability to install additional packages at runtime inside a session, which means agents can pull in the specific libraries they need without bloating a global image.

The sessions themselves are stateful, which is a big deal if you’ve ever fought with stateless “one-and-done” code blocks in typical LLM tools. Perplexity mounts a persistent filesystem via FUSE, intercepting file operations so the agent can read, write, list, and track changes across steps: files created in one call are naturally available in the next. Long-running workflows can pause and resume hours later and still pick up where they left off, and each session can juggle up to five background processes – think workers crunching data while the agent continues to plan the next steps.

Security is very much front and center: the architecture assumes every piece of code is untrusted by default. The sandbox itself has no direct network access; whenever outbound connectivity is needed, traffic is funneled through an egress proxy outside the sandbox that matches destinations by domain and injects credentials there, never exposing raw API keys or secrets to the running code. On top of that, timeouts and resource limits enforce hard boundaries so a buggy script or runaway loop doesn’t spiral into an infrastructure problem, which is crucial as more teams move from toy agents to workflows that actually touch real data and production systems.

If you’ve followed Perplexity’s recent push around Computer and the Agent API, Sandbox slots into that picture as the execution layer. The Agent API already acts as a managed runtime for orchestrating multi-step workflows with integrated search, tools, and multi-model routing; Sandbox becomes one of those tools that the agent can call when it needs deterministic computation mid-flow. In practice, that looks like: the agent reasons about what needs to happen, delegates the actual computation to Sandbox, inspects the results, and then continues its reasoning loop, all under the same API key and credit system.

Perplexity has already been battle‑testing this pattern internally. Computer relies on sandboxed environments for things like heavy data analysis, long-horizon workflows, and browser automation while keeping user data isolated through per-task containers and separate filesystems. Deep Research leans on the same setup for generating files, transforming formats, and processing large datasets in the middle of multi-hour research runs. The Finance Agent, meanwhile, uses Sandbox to run live market calculations and assemble models on top of a wide set of real-time data sources, where correctness and traceability matter a lot more than in casual chat.

Zooming out, Sandbox is one of four core APIs that Perplexity is rolling out as part of its platform: Search, Agent, Embeddings, and Sandbox. Search gives you grounded retrieval over the live web, Agent provides the orchestration layer that can call tools and juggle multiple provider models, Embeddings power retrieval and ranking, and Sandbox brings a secure place to execute code and manage files. For developers trying to ship products where “LLM plus a bit of glue code” is no longer enough, that combination is essentially a full-stack agent platform: find the data, reason over it, run code on it, and keep everything auditable.

The security story also lands in a broader moment: the industry is still reacting to high‑profile failures where autonomous agents went off-script, from mass email deletions to over‑permissive automations that touched production systems. Perplexity’s answer is “sandbox everything” – not just for show, but as a default posture where every task, browser session, and code run is isolated. The Sandbox API essentially makes that same “safety by design” architecture something any developer can plug into, instead of having to roll their own container orchestration, filesystem isolation, and secret‑handling proxies.

The timing also lines up with the growing demand for agentic workflows that go beyond chat. As more teams try to wire LLMs into data pipelines, spreadsheets, CRMs, and internal tools, the pain points are pretty consistent: agents hallucinate numbers, code execution is flaky, and wiring everything securely is exhausting. Sandbox doesn’t magically solve hallucinations at the reasoning layer, but it does provide a deterministic substrate: once the agent decides what to compute, the execution behaves like a regular program with clear inputs, outputs, and logs, which is exactly what teams need for debugging and compliance.

For now, Sandbox API is “coming soon” rather than generally available. Perplexity says it will open a private beta shortly, with documentation already live under its developer docs for those who want to start planning integrations and experimenting as access rolls out. Given that the roadmap also mentions isolated containers with pause/resume workflows and dedicated resources per sandbox, what’s shipping to external developers looks very close to the infrastructure Perplexity itself uses to run advanced data analysis for Pro and enterprise customers.

All of this adds up to a pretty clear signal: Perplexity doesn’t just want to be the place you ask questions; it wants to be the platform where your agents live, think, and compute. With Sandbox API entering private beta soon, developers who have been hacking together their own mini-sandboxes now have the option to offload a big chunk of that complexity to the same runtime that already powers Perplexity’s flagship products. If you’re building serious AI workflows – especially ones that touch sensitive data, financial models, or long-running analysis – this is one API worth keeping on your radar over the coming months.