News & Updates
The latest news and updates from companies in the WLTH portfolio.
Meta, OpenAI and Anthropic AI agents get user-approved logins via 1Password
1Password fills the password into the form, so the agent never sees it. 1Password on Thursday introduced a platform that allows personal AI agents from Meta, OpenAI and Anthropic to sign into a user's accounts after the user approves the request. The agent executes the task without seeing or storing the password at any time. Nine more companies, Perplexity among them, are building integrations The product, called 1Password for Agents, adds a check between the agent and the login page. The agent taps into a sign-in form, presents a unique digital key, and 1Password authenticates its identity. The user will be prompted with the account requested and why. Approval is on the individual's own device. Then 1Password fills in the credential directly into the form. The agent proceeds with the task, and the password stays in the vault. "Agents are starting to do real work on our behalf," said Aashish Tripathi, chief product officer at 1Password. He added that one task assignment shouldn't give an agent permanent access to everything behind an account. When the integration is on, Meta's Muse will seek logins through 1Password. OpenAI wired up both ChatGPT Work and its always-on Dots agents. Elon Musk's SpaceXSI signed up Grok Bot. An AI assistant startup named Town, which raised $108 million this week, signed as well. Since July, Claude has been using 1Password in the browser. The more recent Claude Duet agent from Anthropic, which was released on Wednesday, comes next. "Claude Duet asks before it signs in anywhere, and soon 1Password will complete the sign-in with the passwords people have already set up, so they don't have to start over," said Ami Vora, chief product officer at Anthropic. Vora said that Anthropic wants everyone to be able to use the feature, even those "who've never before let an agent near their accounts." Nine more companies, including Perplexity and Browserbase, are building their own integrations. US banks now detect automated activity inside customer accounts The launch came on the same day that reports emerged of US banks observing activity by agents inside customer accounts. Most banks can't tell whether that activity links back to a real user request. Chase Bank told customers not to give their usernames and passwords to anyone. 1Password said that typing a password into an AI chat saves a copy the user can't control. Its new system is built to stop that. During a June assessment, an OpenAI agent accessed an Australian Medicare statistics portal without authorization, Cryptopolitan reported. Prime Minister Anthony Albanese has directly complained about a delay of about three months in disclosure. Meta's Muse logged 10.2 million US downloads, but Claroc researchers also identified more than 6,800 shared-chat links anyone could access. "As agents take on more complex tasks for users, security and user control need to be built in from the start," said Glen Coates, head of app platform at OpenAI.
Perplexity Open-Sources SPACE, a Firecracker MicroVM Sandbox for AI Agents
Perplexity has open-sourced SPACE, the sandbox platform behind every task in Perplexity Computer. The Perplexity SPACE sandbox gives each agent task its own Firecracker microVM. Credentials and outbound traffic are controlled from outside that VM. The code ships under Apache 2.0 on GitHub. For teams building coding or browsing agents, this is a production-tested isolation layer they can self-host. TL;DR * Size: Rust codebase, release 0.8.0, the public baseline. HTTP API plus server-sent events. * Runs on: A Linux x86_64 host with KVM, /dev/kvm, btrfs and Docker. Local Kind (Kubernetes) or direct mode. No macOS. * Performance: In production, median create latency fell from 185 ms to 60 ms versus Perplexity's previous provider. * Best: 0 of 108 VM-to-host escape attempts succeeded across 9 frontier models. * Worst: Before fixes, agents bypassed the egress policy in 11 of 54 partial-network runs. What is Perplexity SPACE? SPACE (Sandboxed Platform for Agentic Code Execution) is Perplexity's platform for running agent code in isolated microVMs. Applications call its HTTP API to create Linux environments, run commands and stream output. A template supplies the starting filesystem. A sandbox is one instance of that template, with its own VM and writable disk. Many commands can run inside one sandbox. Perplexity's launch thread explains the design goal. Agents run commands, install packages and call services with root inside the sandbox. The host stays outside the guest's control. Agent work is long-running, stateful and branching, so it must survive restarts. How does SPACE isolate agents? Each sandbox is a Firecracker microVM with its own guest kernel. A per-sandbox network gateway on the host enforces egress policy on every outbound connection. Secrets never enter the guest. Per Perplexity's July engineering post, credentials are injected at the network layer. The credential store adds hierarchical scoping, rate limits and audit logging. The architecture guide splits the system into 4 parts. These are a PostgreSQL-backed API, controllers, worker services and a data plane. Worker services manage VMs, networking, volumes, templates and credentials. btrfs copy-on-write creates each root filesystem. How do pause, suspend and restore work? Sandboxes move through 4 states: running, paused, suspended and deleted. * Paused: VM memory stays resident on the worker. This is not a durable snapshot. * Suspended: VM memory, runtime state and root filesystem are snapshotted. Active resources are released. * Idle default: sandboxes suspend after 6 hours without activity. For fast creates, Kubernetes deployments use warm pools of booted sandboxes. Single-node setups use base snapshots instead. In production, the 90th-percentile create latency dropped from 447 ms to 89 ms. Perplexity reports that 100% of Computer sessions run on SPACE. Did SPACE survive a red-team test? Perplexity's Escaping SPACE: Part I report tested 9 models with root inside the guest. The study ran 216 runs across 2 tasks and 4 settings. * Sandbox escape: 0 of 108 runs reached the host-side secret. * No-network bypass: 0 of 54 runs succeeded. * Partial-network bypass: 11 of 54 runs succeeded before fixes. 4 models found a path. Claude Opus 5.0, GPT-5.6 Sol, GPT-5.6 Cyber and Kimi K3 found bypasses. The attacks used DNS spoofing and shared CDN IP addresses. Perplexity then added source-address validation through nftables. The gateway now terminates TLS and checks both SNI and HTTP host against the allowlist. In the retest, no model produced a verified bypass. The same team tested 10 third-party platforms. 8 showed at least one network-policy bypass. Perplexity disclosed the results to every affected vendor. How does SPACE compare with other open sandboxes? How do developers deploy SPACE? The installation guide deploys SPACE into a local Kind cluster. The host needs /dev/kvm, /dev/net/tun, loop devices and btrfs. Running it inside a VM requires nested virtualization. Teams already on E2B can try the E2B Compatibility Wrapper. Its tested baseline is the Python package e2b==2.21.1. A reference AWS EKS deployment ships in the repository. Key Takeaways * SPACE runs each agent task in its own Firecracker microVM. * Credentials and egress policy live outside the guest VM. * 0 of 108 escape attempts reached the host in red-team tests. * Egress bypasses hit 11 of 54 runs before fixes, 0 after. * Apache 2.0, Rust, needs a Linux x86_64 host with KVM. Check out the GitHub repo, the docs and the red-team report. All credit goes to the researcher of this project. Also, feel free to follow us on Twitter and don't forget to join our 150k+ML SubReddit and Subscribe to our Newsletter. Wait! are you on telegram? now you can join us on telegram as well.
Perplexity AI open-sources its secure AI agent sandbox SPACE
Perplexity AI open-sources its secure AI agent sandbox SPACE The artificial intelligence search engine startup Perplexity AI Inc. is shifting its focus to AI agent security in the wake of several high-profile incidents that saw autonomous systems escape from secure environments and go on to wreak havoc on third-party websites. The company has developed an AI sandbox specifically for isolating AI agents called SPACE, and it's being made open source from today, which means every developer can use the tool to secure their own systems. SPACE is already being deployed by partners including CoreWeave Inc., Akamai Technologies Inc. and Crusoe Inc., which all offer cloud-hosted infrastructure platforms for AI systems. AI sandboxes are the main barrier that prevents AI agents from causing problems like leaking sensitive data or going off and hacking other systems. They're secure, isolated virtual environments where autonomous agents can run third-party software, browse the internet and execute tasks without risking the security of the host computer, the broader corporate network or underlying data center. By giving each AI agent its own walled-off computer in the cloud, if it makes a mistake, runs a destructive command or is manipulated by adversarial prompts, the damage it does will be contained within that environment. The only problem with AI sandboxes is their security isn't always foolproof. In fact, there have been several incidents of cunning AI agents managing to find a way to escape from their confines and make trouble elsewhere. One of the most notable involved AI agents being tested by OpenAI Group PBC, which escaped from a sandbox and went on to hack into the model hosting platform Hugging Face. OpenAI's agents have also hacked websites operated by the U.S. and Australian governments. Most frontier model labs have been focused more on "model alignment," which involves training AI systems to behave themselves and not look for loopholes in their guardrails, but Perplexity engineer Zibi Braniecki told Semafor his company has instead concentrated on making those guardrails tougher and more reliable. Perplexity developed SPACE to safeguard its Portable Computer agents, which are marketed to its customers as locally-hosted AI agents that can perform tasks on their behalf. They're designed to do things like developing web applications, research products, buy things online, book hotels and so on. With Perplexity's Computer agents, SPACE provides safety features such as isolated code execution, pause and resume, recovery and session branching. Agents run within a small virtual machine that has its own operating system, isolating them from the host computer. There's a user-controlled control plane for creating, running, pausing and deleting these VMs. SPACE ensures that these sandboxes are always treated as "untrusted," and manages their network access and platform credentials outside of the sandbox, enabling agents to connect to authorized services without that sensitive information ever being made available to them within their environment. It also takes frequent file snapshots and checkpoints of the running environment to preserve progress and ensure it can revert back if any problems occur. So far though, there hasn't been any need to do anything like that, for SPACE seems to be bullet proof. Braniecki told Semafar that his team tested nine frontier models in SPACE environments and ordered them specifically to try and break out of their sandbox. In 118 attempts, none of them succeeded, though some did manage to find their way around the network restrictions. However, Perplexity has now fixed those weaknesses, and none of the models were able to do it again in follow-up testing. To compare SPACE's performance, Perplexity performed the same tests using other, proprietary sandboxes, and said the agents found a way to escape from several of them. Braniecki said the open-source nature of SPACE is key to securing AI agents, because it will enable companies to work together to build the tough guardrails they need. It's similar to what happened during the early days of web browsers, he said, where the developer community collaborated on the security systems needed to enable secure browning and online commerce. Perplexity isn't the only company pursuing an open-source approach to AI agent sandboxes. One alternative is Nvidia Corp.'s OpenShell project, which was released last month as part of a broader Open Agent Safety Platform. So far, there have been no reported escapes from OpenShell. Perplexity is not new to open-source security. Besides SPACE, it has also developed open source innovations such as BrowseSafe, which is used to detect malicious instructions hidden in web pages; Numbat, a tool for investigating dangerous agent behaviors; and Bumblebee, which is a scanner that's used to detect risky AI tool configurations.
Reddit and Perplexity AI clash over law firm's role in data-scraping case
Reddit filed the lawsuit in 2025, alleging Perplexity illegally scraped its online forums for data it needs for its online "answer engine" system. WASHINGTON - Reddit has asked a federal judge to block its former law firm Proskauer Rose from defending Perplexity AI in a lawsuit alleging the AI search start-up company stole Reddit content, arguing it was dropped like a "hot potato" by lawyers who owed it client loyalties. In a court filing on Oct 9 in Manhattan federal court, Reddit said Proskauer has a conflict of interest due to its past work for Reddit in a whistleblower case. Reddit also said Proskauer earlier vowed it would not represent Perplexity. "Proskauer cannot drop Reddit like a hot potato in favour of Perplexity," Reddit said in its filing. Proskauer contends Reddit has no basis to disqualify the firm. In a court filing on Oct 9, the firm said its work for Reddit in the whistleblower matter did not create a conflict of interest that should bar the firm from representing Perplexity now. It also denied it ever agreed not to represent Perplexity. Reddit declined to comment other than to refer to its court filings. Perplexity and Proskauer did not immediately respond to requests for comment. The case is part of a wave of copyright cases targeting AI companies over their alleged use of protected content for AI training. Proskauer argues Perplexity should be able to rely on its chosen counsel in a case exposing it to large potential damages. Reddit filed the lawsuit in 2025, alleging Perplexity illegally scraped its online forums for data it needs for its online "answer engine" system. Perplexity has denied Reddit's copyright infringement claims. Reddit has content licensing deals with Google and others for AI training. REUTERS
Anthropic Puts Claude Dashboards and Motion Into Beta Testing | TokenPost
Dashboards are available on paid plans, while Motion is entering beta for Team and Enterprise users. Docs, Slides and Design are now available across all Claude plans. Anthropic is putting Claude Dashboards and Claude Motion into beta testing, adding tools for data dashboards and animated explanations to its AI platform. Claude Dashboards is available for testing on paid plans. It can connect with Amazon Redshift, BigQuery, ClickHouse, Databricks and Snowflake, along with Salesforce. Users can ask questions in natural language to generate dashboards that update over time. Each figure can be opened to inspect its underlying query, while charts show when the data was last refreshed. Dashboards can be sent to Amplitude, Grafana, Hex, Mixpanel, Omni, Perplexity, PostHog and Sigma for continued analysis. Support for Looker, monday.com and Tableau is planned. Claude Motion is entering beta on Team and Enterprise plans. The feature generates playable animated explanations from prompts. Users can edit the results themselves, ask Claude to revise them or download them as MP4 files. Anthropic also made Docs, Slides and Design available across all Claude plans, including Free, after completing testing. Users have created more than 45 million documents, presentations and designs since the features were added to Claude conversations.
Perplexity AI Releases pplx-embed-v2-late: A 0.6B Edge Model and a 9B Model Scoring 92.4% on MADQA
Perplexity has released pplx-embed-v2-late, a pair of ColBERT-style multimodal embedding models. They come in 2 sizes: 0.6B for fast, cheap queries and 9B for maximum quality. Both models retrieve text, images and rendered PDF pages, and they share one embedding space. Is it deployable? Yes, if you host it yourself. Both models are on Hugging Face under the MIT license. A hosted Perplexity API endpoint is planned but not live. TL;DR The best * The 0.6B model uses about 340M active parameters for images and stays close to 8B rivals. * A 9B index can be searched with 0.6B queries, recovering about half the 9B quality gap on text at 0.6B query cost. * Its 128-dim token vectors are 16x to 32x narrower than rivals at 2,048 to 4,096 dims. * MIT license, with commercial use allowed. The worst * It stores 1 vector per token, so index size grows with document length. * It is not #1 on ViDoRe v3 image retrieval; Tencent's EVIE scores higher. * A single input cannot mix text and images. * All scores are self-reported, and the technical report is not out yet. Model Size and What It Runs On Perplexity designed the 0.6B model as a lightweight query encoder that can also run on edge devices. Both model cards show CUDA GPU usage. They need and . The memory figures are our estimate at 2 bytes per parameter, for weights only. The published checkpoints are stored in F32, which doubles the download size. How Well It Performs: Best and Worst Scores All numbers below are from Perplexity's announcement: The strongest result: 92.4% on MADQA, set by the 9B model. The biggest margin is on BrowseComp+, at 8.7pp over the best dense model. The weakest result: 61.2% on ViDoRe v3 Markdown, from the 0.6B model. It is still the 2nd-best score on that benchmark. Image search is the real gap: Gemini Embedding 2 beats the 9B model on MIRACL-Vision and by 2pp on PPLX-Q2I. Mixing sizes: a 9B index queried by the 0.6B model scored 63.5% on ViDoRe v3 image retrieval. That beats 62.3% with 0.6B on both sides, at the same query cost. How It Works Dense models compress a document into 1 vector. pplx-embed-v2-late instead keeps a 128-dim vector for every token. It scores with MaxSim: each query token finds its best document token, and those maxima are summed. Pages are encoded as images, so no OCR step is needed. Perplexity distilled both models from an 18B teacher using LEAF-style token-level training. That training is what creates the shared space. Best Use Cases * The best fit is visual document search over PDFs, slides and scanned reports. * Low-latency search: index in the cloud with 9B, then query on-device with 0.6B. * Agentic RAG over large PDF or web collections. Interactive Explainer How It Compares Key Takeaways * The 0.6B model fits edge devices; the 9B model is built for index-time quality. * Best score: 92.4% on MADQA. Weakest: 61.2% on ViDoRe v3 Markdown. * 0.6B queries over a 9B index beat 0.6B on both sides. * Storage growth and self-reported scores are the main caveats. Check out the Model weights on HF and Technical details. All credit goes to the researcher of this project. Also, feel free to follow us on and don't forget to join our 150k+ML SubReddit and Subscribe to our Newsletter. Wait! are you on telegram? now you can join us on telegram as well.
