Willison tests smolmachines sandbox for untrusted code execution

Willison's investigation reveals that smolvm can enforce hard resource limits (CPU, memory, execution time) and filesystem isolation simultaneously, but the real finding is the tradeoff: strict sandboxing comes at the cost of significant performance overhead and limited standard library access. This matters because most discussions of code execution focus on security OR performance, not both.

This is largely disconnected from recent activity in the space, which has focused on LLM capability releases and safety benchmarks. Instead, it belongs to the infrastructure layer of AI systems: how to actually deploy agents and code-execution features safely in production. The gap Willison identifies (safe execution for untrusted code in multi-tenant environments) has been implicit in AI agent discussions but rarely examined in depth. This work fills that void by testing a specific tool against real constraints rather than theoretical ones.

If Anthropic or OpenAI publicly adopt smolvm (or equivalent sandboxing) in their code-execution APIs within the next 12 months, that signals the industry has moved from 'this is a nice-to-have' to 'this is table stakes.' If neither does, watch whether Willison or others publish benchmarks comparing smolvm to alternative sandboxing approaches (gVisor, WebAssembly-based isolation) to establish which tradeoff wins in practice.