Version 2

Simon Willison released three alpha packages in early June 2026 for sandboxed Python execution in AI agent contexts, then on June 6 published a full technical post explaining the design. [4] The core package, micropython-wasm, runs a customized WASM build of MicroPython through Python's wasmtime bindings; the companion plugin datasette-agent-micropython routes code execution in Datasette Agent through that sandbox. [1][3] Willison chose MicroPython over Pyodide because Pyodide cannot run server-side as of late 2024, and preferred WASM over V8-in-Python alternatives based on WebAssembly's decade of browser security testing. [4] External commentary is beginning to appear, with at least one observer endorsing the 'don't trust the agent's edit, gate it' framing. [5]

As AI agents that execute code become more common, reliable sandboxing is a prerequisite for safe deployment. Willison's approach stacks two containment layers — MicroPython's restricted Python subset and WebAssembly's memory and CPU isolation — and ships both as a pip-installable library. His stated aim is to demonstrate that Python-in-WASM is viable enough that companies with professional security teams will commit to the approach and open source their own hardened implementations. [4]

Simon Willison released three alpha packages in quick succession on June 2, 2026, aimed at sandboxed Python execution for AI agents. The core package, micropython-wasm, bundles a customized WebAssembly build of MicroPython and runs it through the Python wasmtime bindings. A 0.1a1 bug-fix release followed the same day. The companion plugin, datasette-agent-micropython, integrates the sandbox into Datasette Agent — Willison's LLM-powered assistant for the Datasette data exploration tool — routing code-execution requests through the MicroPython/WASM sandbox instead of running them natively. [1][2][3]

On June 6, Willison published a full technical post explaining the design decisions. [4] He chose MicroPython over Pyodide because Pyodide cannot run server-side as of late 2024, making MicroPython the most practical Python-in-WASM option for embedded server applications. For persistent interpreter state across multiple code-execution calls — necessary for an agent that runs many turns — he routes execution through a MicroPython instance running in a thread that blocks on a host-side queue. He favored WASM over V8-in-Python alternatives based on WebAssembly's decade-long browser security track record and the availability of active wasmtime Python bindings. AI coding agents — specifically Codex Desktop and GPT-5.5 — wrote the core implementation, including 78 lines of C bridging host functions into WASM.

Willison is candid about the project's experimental state and his own position in the ecosystem: he has criticized the proliferation of immature, loosely-maintained sandboxing libraries, and acknowledges he has now built one himself. His stated aim is not to replace professional security tooling but to demonstrate that Python-in-WASM is viable enough that companies with dedicated security teams would commit to the approach and open source their own hardened solutions. [4]

External commentary is limited but present. Qiang Han endorsed the design principle as 'the right instinct — don't trust the agent's edit, gate it,' referencing a related project called Glyph 0.3.0. [5][6] Broader social amplification of the initial releases appeared across several accounts, but no independent security analysis or third-party testing has entered the public record.