How Perplexity built security into its Computer agent

Letting an AI write code, run scripts, and browse the web on your behalf sounds amazing until enterprise security teams realize what could go wrong. One rogue instruction hidden inside an untrusted webpage, and your sensitive corporate data could easily walk out the door.

Perplexity published a deep dive into the security architecture powering Perplexity Computer, its autonomous agent built to code, search the web, and execute tasks across third-party services. The company laid out exactly how it plans to keep enterprise data safe while giving an autonomous system live execution powers.

Hardware-level sandboxing with Firecracker

Running arbitrary code generated by an agent demands strict isolation. Instead of relying on traditional OS process isolation, Perplexity runs every single Computer task inside its own Firecracker microVM.

Each sandbox gets its own dedicated Linux kernel, an isolated filesystem that automatically wipes once the session wraps up, and a private network namespace with custom firewall rules. When inactive, sandboxes auto-pause and eventually destroy themselves, ensuring every new run begins from a completely pristine state.

Credential handling gets a similar lockdown. Instead of handing out raw API keys, sub-agents route their requests through short-lived proxy tokens managed by an authenticated gateway. The credentials disappear along with the microVM, and storage is kept in a separate cloud VPC from execution to prevent data leaks.

Four-layer prompt injection defense

Whenever an autonomous agent reads external webpages, prompt injection becomes a real and constant threat. To stop attackers from hijacking the agent mid-task, Perplexity deployed a four-layer defense system featuring BrowseSafe, its open-source detection model designed specifically for browser agents. The entire architecture was audited by cybersecurity firm Trail of Bits.

Machine learning classifiers inspect all incoming external data in parallel with the agent's reasoning loop. If suspicious content pops up, the system executes an immediate safe stop. External content is strictly flagged as untrusted, and the agent is forced to constantly cross-reference the user's original prompt before triggering any external tools.

Enterprise controls tie the package together. Admins can stream audit logs directly into Splunk, Azure Sentinel, or Datadog, toggle connectors like Gmail, Slack, GitHub, and Salesforce on a granular level, set strict token spend limits, and rest easy knowing enterprise attachments are deleted after 7 days without being used for model training.

Why it matters

For companies waiting to deploy autonomous agents without terrifying their security compliance officers, this breakdown shows what the baseline standard now looks like. Perplexity Computer is directly addressing the biggest enterprise bottleneck: not model reasoning, but operational trust. By backing up its existing 2026 SOC 2 Type II attestation with Firecracker isolation and enterprise SIEM export, Perplexity is clearing the hurdles that usually stall enterprise pilot programs.

The broader industry takeaway is clear: the AI agent race is shifting fast from raw capability benchmarks to defensive systems engineering. Any agent that can touch databases and execute scripts will encounter adversarial content in the wild. Building a sandbox that assumes failure and minimizes blast radius is becoming table stakes.

We think Perplexity made the right call by separating its security boundaries. Instead of naively trusting the LLM to ignore malicious instructions, it deployed external classifiers and hardened virtual machines. The real trade-off will be latency and edge-case friction. Running parallel ML classifiers on every piece of retrieved web content adds compute overhead, and aggressive safe stops could easily break legitimate, complex workflows if the classifiers trip on false positives.