Version 3

Simon Willison has released a suite of alpha packages for AI agent tooling in Datasette: micropython-wasm (a WASM-sandboxed MicroPython runtime), datasette-agent-micropython (routing agent code execution through the sandbox), and datasette-agent-edit (implementing Claude's text editor pattern as a reusable plugin layer). [1][3][5] His June 6 technical post explains the design rationale in detail. [4] External commentary is limited but consistent: observers frame sandboxed execution as the correct instinct for AI agents, and at least one voice argues the sandbox itself will become the core product once agents routinely execute code. [6][8]

As AI agents that execute code become more common, reliable sandboxing is a prerequisite for safe deployment. Willison's approach stacks two containment layers — MicroPython's restricted Python subset and WebAssembly's memory isolation — and ships both as pip-installable libraries. His stated aim is to show the approach is viable enough that companies with professional security teams will commit to it and open source their own hardened implementations. [4]

Simon Willison released three alpha packages on June 2, 2026, aimed at sandboxed Python execution for AI agents in the Datasette ecosystem. The core package, micropython-wasm, bundles a customized WebAssembly build of MicroPython and runs it through Python's wasmtime bindings. A same-day bug-fix release (0.1a1) followed. The companion plugin, datasette-agent-micropython, integrates the sandbox into Datasette Agent — Willison's LLM-powered assistant for the Datasette data exploration tool — routing code-execution requests through the MicroPython/WASM sandbox instead of running them natively. [1][2][3]

Willison's June 6 technical post explains the design decisions. [4] He chose MicroPython over Pyodide because Pyodide cannot run server-side as of late 2024, making MicroPython the most practical Python-in-WASM option for embedded server applications. For persistent interpreter state across multiple agent turns, he routes execution through a MicroPython instance running in a background thread that blocks on a host-side queue. He favored WASM over V8-in-Python alternatives based on WebAssembly's browser security track record and the availability of active wasmtime Python bindings. AI coding agents — specifically Codex Desktop and GPT-5.5 — wrote the core implementation, including 78 lines of C bridging host functions into WASM. Willison is candid about the project's experimental state and acknowledges the irony of adding another immature sandboxing library to an ecosystem he has criticized for that same quality.

On June 7, Willison released a further plugin, datasette-agent-edit, expanding the agent tooling layer in a different direction. [5] Rather than sandboxed execution, this plugin implements Claude's text editor design — with view, str_replace, and insert tools — as a reusable base so that other Datasette plugins requiring agentic text editing do not need to recreate the pattern independently. Willison frames agentic editing as non-trivial to implement correctly and cites Claude's text editor as his preferred published pattern for the task.

External commentary is limited but consistent in direction. Qiang Han endorsed the sandboxed execution design as 'the right instinct — don't trust the agent's edit, gate it,' referencing a related project called Glyph 0.3.0. [6][7] Mykyta Pavlenko offered a more structural framing: 'The sandbox is the product once agents can run code,' paired with a separate note that he does not want agents with more autonomy yet. [8][9] Landon Huber noted that GPT-5.5 has not yet escaped the sandbox, calling it promising if cautionary. [10] No independent security analysis or third-party adversarial testing has entered the public record.