mitsuhiko: an AST interpreter alone is too fragile as an agent code-execution sandbox

mitsuhiko · x · 2026-10-10

In a thread on codemode implementations, developer mitsuhiko explains he wasn't comfortable relying on an AST interpreter as the only isolation mechanism for AI agent code execution: it's substantial work and tricky to sandbox, and he's even unsure about wasm/worker as the sole isolation layer. He previously noted Pi picked quickjs for codemode out of pragmatism. The thread weighs tradeoffs between quickjs/AST approaches and wasm+worker isolation, including serialization overhead — useful engineering context for anyone building coding agents.

Original post →

mitsuhiko: an AST interpreter alone is too fragile as an agent code-execution sandbox

More from coding & agent