Claim◆Article
smolmachines/smolvm can be used as a fast, secure sandbox for running untrusted Python and JavaScript code, with resource limits (RAM, CPU time) and restricted filesystem and network access.
The research task was to evaluate smolmachines.com as a secure sandbox for executing user-provided, untrusted code with strict resource and access limits. ✦ AI generated
Author · Simon Willison's Weblog · 2026-08-19 · original ↗
Put https://smolmachines.com through its paces as a fast secure sandbox. Explore what it would take to use this to run untrusted Python and JavaScript code in a way that is limited in what RAM and CPU time it can take up (protection against "while true") with no network access and filesystem access only to designated files. Goal is to be able to use this to execute user-provided tasks for things like data transformations.
Read full article ↗excerpt · fair-use quotation
- ·Run untrusted Python and JavaScript safely
- ·RAM and CPU time limits enforced
- ·No network access by default
- ·Filesystem restricted to designated files
- ·Protects against infinite loops ('while true')
- ·Enables safe data transformation tasks
- ·Balances speed with strict resource limits
Around this claim
This moment responds to
provides context → The Claude Code for web environment cannot run smolvm because it lacks the necessary hardware virtualization support (KVM, VMX/SVM flags) and is itself a Firecracker guest.Author · Simon Willison's Webloggives example → LLMs and modern sandbox primitives create a new opportunity for extensible software on the web, enabling developers to build solid core applications that users can safely extend via LLM-generated extensions.Jeremy Morrell · Simon Willison's Webloggives example → Sandbox-level security must rely on hard, deterministic guardrails rather than trusting an LLM to mediate what an agent is allowed to do, because LLM-mediated permissions risk letting an agent exfiltrate data.Akshat Bubna · Latent Spaceprovides context → A creative workaround was to use GitHub Actions runners, which do expose /dev/kvm, to execute the real test battery against the branch.Author · Simon Willison's Webloggives example → Running evaluations of cyberattack potential in AI models is a spectacularly risky business that every AI lab needs to pay attention to, requiring close monitoring of sandboxed environments.Anthropic (via Hacker News article) · Simon Willison's Weblog