Simon Willison's MicroPython/WASM Sandboxed Code Execution for AI Agents

Simon Willison has released a suite of alpha packages for AI agent tooling in Datasette built around two safety strategies: MicroPython-in-WASM sandboxing for code execution [1][3] and human-in-the-loop interruption for consequential actions. [6] On June 13, he released luau-wasm 0.1a0 and a companion post on a newly supported Pyodide capability — publishing WASM-compiled Python packages directly to PyPI — expanding his work in the Python/WASM ecosystem adjacent to the agent sandbox project. [7][8]

Willison's framework offers a layered reference implementation for agent safety: sandboxing constrains what code can do; human-in-the-loop gates what the agent can decide alone. Both mechanisms ship as pip-installable plugins. The Pyodide packaging development shows the Python/WASM ecosystem maturing, though it does not alter the server-side MicroPython choice at the core of Willison's agent sandbox.

Simon Willison released three alpha packages on June 2, 2026, aimed at sandboxed Python execution for AI agents in the Datasette ecosystem. The core package, micropython-wasm, bundles a customized WebAssembly build of MicroPython and runs it through Python's wasmtime bindings; a same-day bug-fix release (0.1a1) followed. The companion plugin, datasette-agent-micropython, integrates the sandbox into Datasette Agent — Willison's LLM-powered assistant for the Datasette data exploration tool — routing code-execution requests through the MicroPython/WASM sandbox instead of running them natively. [1][2][3]

Willison's June 6 technical post explains the design decisions. [4] He chose MicroPython over Pyodide because Pyodide cannot run server-side as of late 2024. For persistent interpreter state across multiple agent turns, he routes execution through a MicroPython instance running in a background thread that blocks on a host-side queue. He favored WASM over V8-in-Python alternatives based on WebAssembly's browser security track record. AI coding agents — specifically Codex Desktop and GPT-5.5 — wrote the core implementation, including 78 lines of C bridging host functions into WASM. Willison is candid about the project's experimental state and acknowledges the irony of adding another immature sandboxing library to an ecosystem he has criticized for that same quality.

On June 7, Willison released datasette-agent-edit 0.1a0, implementing Claude's text editor design — with view, str_replace, and insert tools — as a reusable base for agentic text editing across Datasette plugins. [5] On June 10, datasette-agent 0.2a0 extended the safety model in a different direction: human-in-the-loop interruption. Tools that declare a context parameter now receive a ToolContext object and can call await context.ask_user(...) to pause mid-execution and request user input. Suspended conversations persist to the internal database and survive server restarts, with stored answers replayed on re-execution. A new save_query tool demonstrates the pattern: the agent shows the full SQL plus proposed metadata, and nothing is written until the user approves. [6]

On June 13, Willison turned attention to the broader Python/WASM packaging ecosystem. He published a post describing a new Pyodide capability: Python packages compiled for the PyEmscripten platform (PEP 783) can now be published directly to PyPI and installed at runtime via micropip. [7] Previously Pyodide maintainers had to manually maintain and host over 300 packages, creating a bottleneck for the community; PyPI merged support on April 21, 2026, and 28 packages had already adopted the new platform tags. Willison released luau-wasm 0.1a0 — a 276KB wrapper around Roblox's Luau scripting language compiled to WASM — as a hands-on demonstration of the capability. [8] This development is adjacent to the agent sandbox project: it does not affect Willison's server-side MicroPython choice, but it shows the WASM packaging toolchain he uses maturing across the broader ecosystem.