Willison tests smolmachines sandbox for untrusted code execution
Simon Willison investigated smolmachines/smolvm as a potential sandbox for executing untrusted Python and JavaScript with strict resource constraints, no network access, and controlled filesystem permissions. This research explores a critical infrastructure gap: how to safely run user-submitted or third-party code within AI systems without exposing the host to denial-of-service attacks or data exfiltration. The findings matter for anyone building AI agents, code-execution platforms, or multi-tenant services where code isolation is non-negotiable.
Modelwire context
ExplainerWillison's investigation reveals that smolvm can enforce hard resource limits (CPU, memory, execution time) and filesystem isolation simultaneously, but the real finding is the tradeoff: strict sandboxing comes at the cost of significant performance overhead and limited standard library access. This matters because most discussions of code execution focus on security OR performance, not both.
This is largely disconnected from recent activity in the space, which has focused on LLM capability releases and safety benchmarks. Instead, it belongs to the infrastructure layer of AI systems: how to actually deploy agents and code-execution features safely in production. The gap Willison identifies (safe execution for untrusted code in multi-tenant environments) has been implicit in AI agent discussions but rarely examined in depth. This work fills that void by testing a specific tool against real constraints rather than theoretical ones.
If Anthropic or OpenAI publicly adopt smolvm (or equivalent sandboxing) in their code-execution APIs within the next 12 months, that signals the industry has moved from 'this is a nice-to-have' to 'this is table stakes.' If neither does, watch whether Willison or others publish benchmarks comparing smolvm to alternative sandboxing approaches (gVisor, WebAssembly-based isolation) to establish which tradeoff wins in practice.
This analysis is generated by Modelwire’s editorial layer from our archive and the summary above. It is not a substitute for the original reporting. How we write it.
MentionsSimon Willison · Claude Fable 5 · Claude Code · smolmachines · smolvm
Modelwire Editorial
This synthesis and analysis was prepared by the Modelwire editorial team. We use advanced language models to read, ground, and connect the day’s most significant AI developments, providing original strategic context that helps practitioners and leaders stay ahead of the frontier.
Modelwire summarizes, we don’t republish. Simon Willison originally reported this story as “smolmachines / smolvm as a sandbox for untrusted Python & JavaScript”. The full content lives on simonwillison.net. If you’re a publisher and want a different summarization policy for your work, see our takedown page.