Securing AI with Perplexity
Perplexity’s CISO Kyle Polley and Customer Success Manager Scott Lerner walk through how Perplexity secures its AI stack, from agent harnesses and sandboxing to inference orchestration and enterprise integrations. The session covers the principles behind Perplexity’s security-first approach and introduces key technologies built to protect both users and agents.
Webinar FAQs
Security resources referenced in this session
FAQs
Building security across the AI stack
How does Perplexity approach security when it builds across so many layers of the AI stack?
Everything Perplexity builds starts with security-first thinking, and we treat safety and security as related but distinct jobs. Safety is about protecting humans from agents. Security is about protecting agents from humans. Building across the stack means we can put the right controls at the right layer for the right tasks, rather than bolting protection onto a black box we do not own.
SPACE, Perplexity's agent sandbox
What is a sandbox, and how does it protect users and agents?
A sandbox gives code a contained place to run without reaching your systems or data. Agents raise the stakes, so in Computer every task gets its own sandbox.
Why did Perplexity build its own sandbox (SPACE) instead of using an existing one?
Off-the-shelf tools couldn’t provide the security Perplexity wants to ensure our customers. Agents break the assumption that sandboxes are for short-lived code execution. That introduces two needs pulling against each other: the environment should be disposable, but the work should be persistent. Existing platforms made you pick two of three between functionality, efficiency, and security. SPACE was built to deliver all three.
How does SPACE actually work, and what security controls does it have?
SPACE makes the session the durable object instead of the sandbox. A session is a chain of rolling snapshots, and those snapshots enable SPACE's full set of controls. Pausing is just stopping the sandbox. Resuming is restoring the latest snapshot on any machine. Forking is restoring the same snapshot twice and letting the copies diverge. Users get continuity, along with a time-machine button if something goes wrong.
Where do my credentials live when an agent acts on my behalf?
Sandboxes are where untrusted work happens, so it is the last place keys should live. If an agent were hijacked, the attacker would inherit everything the agent holds, which is why our agents hold nothing. Credentials arrive from outside the box, at the exact moment they are needed, for that task only.
RBAC, connectors, and Perplexity's security features
What does Perplexity actually get access to when a connector like Snowflake or Outlook is connected, and what can an admin turn off?
Unlike agent tools that start with access to your whole computer, Computer starts with no access. Access comes through OAuth with exact permissions, so if you cannot see it, your agent cannot see it. Admins can turn off a whole connector, or just specific tools inside one.
How does Perplexity's RBAC integrate with our identity provider?
An organization's identity provider already answers who can touch what. Perplexity plugs into it and those boundaries carry straight into the product. Your source of truth stays the source of truth, and your audit trail stays accurate. Teams get the context they need, and companies keep control over who sees what.
How does Perplexity protect agents from prompt injection on the open web?
Prompt injection is social engineering, aimed at agents instead of employees, and the open web is where strangers get to talk to it. BrowseSafe treats every page the agent reads as untrusted and scans it in parallel, before the content can shape what the agent does. Security research kept to yourself only protects you. Everyone's agents read the same web, so we made the benchmark public.
What tools does Perplexity use to protect the machines that agents and employees run on?
Bumblebee answers the first question after every supply-chain incident: is the bad package anywhere on our systems? Numbat watches the agent layer itself and reads behavior in sequence. Because it sits where the agent acts, it can stop an action before it executes.
Using Computer to secure Computer
Can Computer be trusted with real security work?
Perplexity's own security team built its security infrastructure in-house on top of Computer rather than waiting for external tools to catch up. Model-agnostic execution, persistent memory, and the rest of the roadmap were already there, so the team could focus on the security agent itself. Building the best security agent means needing the best harness underneath it.
Where does Computer take the most repetitive work off a security team's plate?
Computer can help with triaging missed alerts and follow-up incident reports. Every triage in Computer comes back documented by default, so analysts start from a written investigation instead of a raw alert.
