Running Untrusted Agent Code Without a Sandbox

Dynamic subagents in Deep Agents have been introduced to allow agents to write scripts that orchestrate tool calls, operating within a code interpreter environment. This powerful approach requires secure execution of untrusted code, which is achieved through three design requirements: execution isolation, capability isolation, and durable pauses. Execution isolation ensures that agent-written code cannot compromise the host system, utilizing WebAssembly (WASM) to create a sandboxed environment with a hard boundary. Capability isolation limits what the agent can access, adhering to Meta's rule of two, which restricts agents to no more than two capabilities among accessing sensitive data, exposure to untrusted content, or external communication. Durable pauses allow the program to pause and resume while maintaining its state, using QuickJS within WASM to serialize and restore memory. Two experimental packages, quickjs-rs and langchain-quickjs, support this functionality and are being refined through collaboration with partners as they move toward production readiness.

No tracked trend matches for this post yet.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.