Simon Willison Ran a Sandbox Evaluation Entirely Through an Agent: smolvm 1.8.3 Cold-Starts in 0.6-1.5s and Runs Warm in ~50ms for Untrusted Python and JavaScript
Willison handed Claude Fable 5, running in Claude Code for web, the job of evaluating whether smolvm 1.8.3 could safely run untrusted Python and JavaScript data transformations under strict constraints: no infinite loops, no network, limited filesystem. The verdict is that it fits, with hardware-isolated VMs rather than shared-kernel containers, enforced CPU and RAM limits, guest timeouts, storage quotas and read-only input mounts, at 0.6 to 1.5 second cold starts and roughly 50 millisecond warm executions. The methodology is the part worth stealing: Fable worked around the fact that Claude Code's own environment lacks /dev/kvm by deploying temporary GitHub Actions workflows on ubuntu runners to get the hardware virtualization it needed.
↳ Follow the thread