---
title: "WASM Sandbox"
description: "The WASM sandbox is the primary isolation boundary for agent execution. Each agent runs in its own WebAssembly instance with: Memory isolation — Each instance has its own linear memory, no shared state Syscall filtering "
resource: https://www.aiagents.nexus/docs/manual/security/wasm-sandbox
generated: { by: "process:nexus-agent-assets", at: 2026-09-07T09:13:03Z }
status: stable
---

# WASM Sandbox Security

The WASM sandbox is the primary isolation boundary for agent execution.

## How It Works

Each agent runs in its own WebAssembly instance with:

- **Memory isolation** — Each instance has its own linear memory, no shared state
- **Syscall filtering** — Only whitelisted system calls are available
- **Resource limits** — CPU time, memory, and I/O are bounded
- **No ambient authority** — Agents must explicitly request capabilities

## Sandbox Configuration

```yaml
agents:
  planner:
    sandbox:
      memory_limit: 256MB
      cpu_timeout: 30s
      network: restricted    # none | restricted | open
      filesystem: none       # none | readonly | readwrite
      allowed_hosts:
        - api.openai.com
        - api.anthropic.com
```

## Capability Model

Agents request capabilities through a manifest:

```toml
[capabilities]
network = ["api.openai.com"]
filesystem = "readonly"
max_memory = "256MB"
```

The runtime enforces these limits. Any violation terminates the agent immediately.

## Escape Prevention

The WASM sandbox prevents common escape vectors:

- **No raw syscalls** — All I/O goes through the capability API
- **No shared memory** — Agents cannot read other agents' memory
- **No dynamic code loading** — JIT compilation is disabled
- **Stack overflow protection** — Guard pages prevent stack smashing