AOT JS/TS can't support eval — and one developer says rip eval out for AI-age safety
cramforce · x · 2026-10-19
Responding to Bun creator Jarred Sumner's take that fully ecosystem-compatible AOT JS/TS would be the most exciting thing since Node, engineer Malte Ubl explains the technical limits: pure AOT can get scriptc near 100% compatibility except for eval and computed-path requires (which is eval in disguise). He argues eval should be ripped out of JS/TS entirely because in the age of AI it's a dangerous RCE vector — a single uncontrolled .constructor read can compromise an app, and bun --aot would need 100MB of dependencies to support it; legitimate use cases should opt in by shipping QuickJS instead. The right goal, he says, is full ecosystem compatibility with AI rewriting the minimal set of libraries that can't be AOT-compiled.
More from coding & agent
- A Template-Mediator Schema to Take Prompt Injection Off the Table — no_awkward_Intention · 2026-10-19
- Open-Source Notion Alternative Noema Built in 4 Days with OpenCode — Register_Defiant · 2026-10-19
- Are We Overengineering AI Agents? A Case for Failure-First Design — Responsible-Dare5139 · 2026-10-19
- Scrawl: a new tool for effectively critiquing AI agent outputs in design workflows — gregbarbosa · 2026-10-19
- 15 tools every vibe coder should know in 2026, from Claude to Figma — Tegadesigns · 2026-10-19
- Directing agents to work 'within a researcher's interests' becomes a novel prompting trick — MoonL88537 · 2026-10-19