Simon Willison runs untrusted Python in a 362KB sandbox — and the thread is a map of every rival approach
To safely run agent-written Python, Willison compiled MicroPython to a 362KB WebAssembly binary with memory limits and gated I/O — 'vibe-coded,' alpha, stress-tested against GPT-5.5 escape attempts. The thread surfaces a crowded field and the real tradeoff he's making.
The build
Simon Willison's post introduces micropython-wasm, an alpha PyPI library for running untrusted Python safely: he compiled MicroPython to a 362KB WebAssembly binary, and manages interpreter state across calls with threading and queues so variables persist. He chose MicroPython over Pyodide because, as he notes, Pyodide "can only run in a browser or Node.js," whereas MicroPython's lean design fits constrained hosts. It ships memory/CPU limits and gated file/network access, with C bindings that selectively expose host functions. He's candid that it's "vibe-coded" and alpha — not for high-stakes use — but says he stress-tested it against GPT-5.5 sandbox-escape attempts. The use case: safely running plugin and agent code inside his Datasette/LLM tooling.
The thread becomes a sandbox bake-off
The most substantive reply offered a different bet — full CPython, not MicroPython:
"I'm using Brett Cannon's cpython-wasi-build running inside a WASI rust container with a carefully-designed host SDK (e.g. sandboxed Chromium access, diff, sandboxed filesystem, pandas subset, PDF reading …) … the AI sees a goal, a plan, and essentially treats the 'task space' as a WASI-powered Python notebook." — a data engineer and CTO building in this space
That comment quietly names Willison's tradeoff: MicroPython is tiny but doesn't bring pandas and the rest of the scientific stack that real agent tasks reach for. Others pointed at more options:
"there's also monty by pydantic … it's Rust so can be compile to wasm" — a commenter surfacing Pydantic's Monty
"We are working to solve the 'sandboxing in Wasm' problem across multiple runtimes … Node.js is now fully supported, Python is in preview and Rust is coming soon." — the CTO of a WebAssembly compiler vendor
And a fair skeptic
"I am trying to think of a use case for this … I can't really think of any good WASI use cases." — a commenter questioning the niche
The takeaway
The headline frames MicroPython+WASM as the answer; the thread shows it's an answer in a crowded, fast-moving field — WASI CPython, Monty, commercial multi-runtime sandboxes. Willison's pick optimizes for a 362KB footprint and brutal simplicity. The cost is the library ecosystem, which is exactly what an agent doing data work will miss first. The right sandbox depends entirely on whether your untrusted code needs to be small or needs to be capable — and you usually can't have both.
Get breakdowns like this every day
The top Hacker News stories, unpacked — by email, Telegram, or RSS.
Pokémon Emerald in your browser at '100k FPS' — and it's not an emulator, it's the decompiled game
The headline says 100,000 FPS. The real novelty, a low-level hacker points out, is that this isn't a GBA emulator running a ROM — it's the community decompilation of the game itself compiled to WebAssembly. Saving works. Audio doesn't. The battle menu crashes.