Sandboxing untrusted code using WebAssembly

In plain words

This is a WebAssembly-based runtime that isolates untrusted code to protect host systems from potential damage. Built in Rust with WASI 0.2 and the component model, it offers language-specific SDKs for Python and TypeScript that make integration straightforward. Developers can execute arbitrary code safely with resource controls, file permissions, and timeout settings using simple decorators or API calls, without exposing their systems to security risks.

written from the facts on this page · September 2026

From the sources

Secure runtime to sandbox AI agent tasks. Run untrusted code in isolated WebAssembly environments. - capsulerun/capsule

In the maker’s words, at launch

Hi everyone, I built a runtime to isolate untrusted code using wasm sandboxes. Basically, it protects your host system from problems that untrusted code can cause. We’ve had a great discussion about sandboxing in Python lately that elaborates a bit more on the problem [1]. In TypeScript, wasm integration is even more…

• 
  A MCP server to evaluate Python code in WASM VM using RustPython2025 · github.com · ▲41

  This is a pet project of mine where I build a MCP with WASM plugin system (published to OCI). I added a new plugin today that use Rust, compiled to WebAssembly to run Python code securely.

• 
  WebAssembly runtime embedded in Godot game engine2023 · github.com · ▲32

  A WebAssembly runtime embedded in Godot game engine projects. Interact with Wasm modules from GDScript. Accessing Wasm modules via GDScript provides the following benefits. - Sandboxed environment allows safely loading zero-trust mods/extensions to a project. - Single target means that Wasm modules can be built from any language e.g. Rust, Go, AssemblyScript and the single binary can be run on all platforms. - Fast execution compared to GDScript allows for offloading compute-heavy operations or running bots/mods/etc. at high FPS. This might be useful for loading mods, bot AI,…

• 
  Execute JavaScript in a WebAssembly QuickJS sandbox2024 · github.com · ▲206

  This TypeScript package allows you to safely execute JavaScript code within a WebAssembly sandbox using the QuickJS engine. Perfect for isolating and running untrusted code securely, it leverages the lightweight and fast QuickJS engine compiled to WebAssembly, providing a robust environment for code execution. Features - *Security*: Run untrusted JavaScript code in a safe, isolated environment. - *File System*: Can mount a virtual file system - *Custom Node Modules*: Custom node modules are mountable - *Fetch Client*: Can provide a fetch client to make http(s) calls - *Test-Runner*: Includes…

• 
  I built a Rust crate for running unsafe code safely2025 · github.com · ▲113

  A Rust crate for containing memory leaks and fragmentation - brannondorsey/mem-isolate

• 
  Create Native Desktop Apps from WebAssembly2022 · wasmer.io · ▲47

  In the [first article in this series](<https://wasmer.io/posts/wasm-as-universal-binary-format-part-1-native-executables>) we demonstrated how you can c...

• 
  Run WASM in Containerd2022 · github.com · ▲77

  I've been working with a partner team to integrate wasm workloads with existing container toolchains with the goal of enabling wasm workloads anywhere, be it on the edge, in kubernetes, or wherever. To that end, this project implements a containerd shim which runs those wasm workloads. It is designed as a library to bring your own host implementation, but also includes an implementation for WASI. Right now the library assumes you are using wasmtime, which is embedded in. It works either standalone (run with containerd directly) or in kubernetes. Kubernetes networking and storage are wired…

• 
  /dev/null▲456

  a social network for devs

  Dev tools · 2d ago · dev-null.sh

• 
  Whiteboard (YC W26) – an open-source IDE for thoughtful software design▲423

  open-source IDE for thoughtful software design. Contribute to devdotfast/whiteboard development by creating an account on GitHub.

  Dev tools · 27d ago · github.com

• 
  Reladraw – A diagram language where you decide where to place things▲411

  Contribute to reladraw/reladraw development by creating an account on GitHub.

  Dev tools · 25d ago · github.com

• 
  OpenBot▲362

  Grok Bot alternative: free, local, open-source, multiplayer

  Dev tools · 22d ago · openbot.run

• 
  Talanoa▲338

  Hi HN, I’m a fullstack developer, and honestly, I’ve lost count of how many side projects I’ve worked on over the years. But one idea kept coming back to me: a different kind of email client. It first came to me in 2014: “What if we could handle emails more like conversations?” Every year, I’d revisit this concept in my “Build Notes.” Ten years later, no one had built exactly what I had in mind — so I finally decided to do it myself. That’s how Talanoa was born. I wanted something focused on people, not timelines. I was tired of marking messages as unread just to remember to reply later, or…

  Dev tools · 19d ago · talanoa.email

• 
  CoreSpeed▲332

  One MCP for everything your agents need: apps, memory, tools

  Dev tools · 27d ago · corespeed.io

• 
  Rork Max▲1,428

  Best AI for iOS apps. Website that replaces Xcode

  Life & fun · Feb 2026 · rork.com

• 
  happycapy▲1,365

  The agent-native computer, for the rest of us

  AI · Feb 2026 · happycapy.ai

• 
  SuperX▲897

  All-in-one growth OS for serious 𝕏 creators

  AI · Feb 2026 · superx.so

• 
  KiloClaw▲868

  Hosted OpenClaw. No Mac mini required.

  Dev tools · Feb 2026 · kilo.ai

• 
  Lovon AI Therapy▲801

  Feel closer and have more fun with your partner every day!

  AI · Feb 2026 · lovon.app

• 
  I spent 3 years reverse-engineering a 40 yo stock market sim from 1986▲721

  Hello my name is Ben Ward for the past 3 years I have been remastering the financial game Wall Street Raider created by Michael Jenkins originally on DOS in 1986. It has been a rough journey but I finally see the light at the end of the tunnel. I just recently redid the website and thought maybe the full story of how this project came to be would interest you all. Thank you for reading.

  Work · Feb 2026 · wallstreetraider.com