Version 4

Simon Willison has released a suite of alpha packages for AI agent tooling in Datasette built around two complementary safety strategies: MicroPython-in-WASM sandboxing for code execution, and human-in-the-loop interruption for consequential agent actions. [1][3] As of June 10, datasette-agent 0.2a0 adds tools that can pause mid-execution to ask users questions (yes/no, multiple-choice, or free-text), with suspended conversations persisting across server restarts; a new save_query tool requires explicit human approval before writing anything. [6] External commentary endorses sandboxed execution as sound infrastructure design, though no independent security analysis has appeared.

Willison's framework shows that agent safety in practice is layered: sandboxing limits what code can do, while human-in-the-loop interruption limits what the agent can decide on its own. Both mechanisms are now shipping as pip-installable plugins, giving other developers a concrete reference implementation rather than a design document.

Simon Willison released three alpha packages on June 2, 2026, aimed at sandboxed Python execution for AI agents in the Datasette ecosystem. The core package, micropython-wasm, bundles a customized WebAssembly build of MicroPython and runs it through Python's wasmtime bindings; a same-day bug-fix release (0.1a1) followed. The companion plugin, datasette-agent-micropython, integrates the sandbox into Datasette Agent — Willison's LLM-powered assistant for the Datasette data exploration tool — routing code-execution requests through the MicroPython/WASM sandbox instead of running them natively. [1][2][3]

Willison's June 6 technical post explains the design decisions in detail. [4] He chose MicroPython over Pyodide because Pyodide cannot run server-side as of late 2024. For persistent interpreter state across multiple agent turns, he routes execution through a MicroPython instance running in a background thread that blocks on a host-side queue. He favored WASM over V8-in-Python alternatives based on WebAssembly's browser security track record. AI coding agents — specifically Codex Desktop and GPT-5.5 — wrote the core implementation, including 78 lines of C bridging host functions into WASM. Willison is candid about the project's experimental state and acknowledges the irony of adding another immature sandboxing library to an ecosystem he has criticized for that same quality.

On June 7, Willison released datasette-agent-edit 0.1a0, implementing Claude's text editor design — with view, str_replace, and insert tools — as a reusable base so that other Datasette plugins requiring agentic text editing do not need to recreate the pattern independently. [5] On June 10, datasette-agent 0.2a0 extended the safety model in a different direction: human-in-the-loop interruption. Tools that declare a context parameter now receive a ToolContext object and can call await context.ask_user(...) to pause mid-execution and ask the user a yes/no, multiple-choice, or free-text question. Suspended conversations persist to the internal database and survive server restarts, with stored answers replayed on re-execution. A new save_query tool demonstrates the pattern in practice: the agent shows the full SQL plus proposed metadata, and nothing is written until the user approves. [6]

External commentary is limited but consistent in direction. Qiang Han endorsed sandboxed execution as 'the right instinct — don't trust the agent's edit, gate it.' [7] Mykyta Pavlenko offered a structural framing — 'the sandbox is the product once agents can run code' — while separately noting he does not want agents with more autonomy yet. [8][9] Landon Huber noted that GPT-5.5 has not yet escaped the sandbox, calling it promising if cautionary. [10] No independent security analysis or third-party adversarial testing has entered the public record.