Fetching from the wire…
Public story · 2026-07-21 · high
The demo doubles as a sandbox blueprint, an isolated browser engine agents could drive without ever touching a host machine.
Why now: Willison posted the demo on July 17, the same week Claude Code's sandbox drew fresh scrutiny.
A project compiles Firefox into WebAssembly and runs it inside Chrome, per Simon Willison's July 17 post. The novelty is fun. The real story is sandboxing. A full browser engine sealed inside a Wasm boundary could let an agent browse the web without ever touching the host machine. That's a complete rendering and JavaScript engine walled off from whatever system it runs inside.
Willison put it simply: "Here's my blog, running in Firefox, running in WebAssembly, running in Chrome."
Agent-driven browsing carries real risk when the agent runs with host-level access instead of a sealed boundary. Claude Code's sandbox and credential disclosures are the concrete reason that risk is getting attention.
Willison's post doesn't say the project was built with agent isolation in mind. It also doesn't address performance, or whether the trick holds outside a demo.
Whether any agent framework actually ships a Wasm-sandboxed browser, rather than just talking about isolation, is the thing worth watching.
Each link below shares sources, entities, or timing with this story.
v0.10.0 (~84.8k stars, Apache-2.0) ships no agent of its own and drives whichever CLI you already have, Claude Code, Codex, Cursor, Copilot, OpenClaw, Gemini, Kimi, Qwen, Cline, plus BYOK OpenAI-compatible endpoints, via od mcp install <agent>. It produces single-page HTML pro...
Released August 6, it binds an exact Chromium tab to its native process and window via Chrome DevTools Protocol, giving page-aware browser actions plus full desktop control in one session, reachable through CLI, MCP, Python, and TypeScript (Cua). Contrast with Claude Code conn...
OpenCLI is at 27,376 stars, installing as the opencli-browser skill in Claude Code, Cursor, and others, driving your already-authenticated Chrome through a Browser Bridge extension over the DevTools Protocol. Credentials never leave the browser and traffic looks like normal us...
1. Set package cooldown to 72 hours across all your package managers. pnpm: resolution-time=72h, uv: --exclude-newer, npm via .npmrc. This single config change would have protected you from the LiteLLM attack. Willison's survey covers all seven managers. 2. Install Lasso Secur...
Simon Willison covered Puter shipping a 233MB gecko.wasm plus 18MB of chrome assets so a full Gecko browser runs in a tab, tunneling network traffic through their servers over the Wisp protocol. The build reportedly ate ~$25K of Claude Opus/Fable tokens, dramatically cheaper u...
Prompted by Julia Evans admitting on July 17 that she still can't read query plans, Willison had Fable build a tool that runs arbitrary SQL against a SQLite database and renders both EXPLAIN QUERY PLAN and the lower-level EXPLAIN bytecode with per-line plain-English annotation...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.