WASM Sandbox Security

The WASM sandbox is the primary isolation boundary for agent execution.

How It Works

Each agent runs in its own WebAssembly instance with:

• Memory isolation — Each instance has its own linear memory, no shared state
• Syscall filtering — Only whitelisted system calls are available
• Resource limits — CPU time, memory, and I/O are bounded
• No ambient authority — Agents must explicitly request capabilities

Sandbox Configuration

agents:
  planner:
    sandbox:
      memory_limit: 256MB
      cpu_timeout: 30s
      network: restricted    # none | restricted | open
      filesystem: none       # none | readonly | readwrite
      allowed_hosts:
        - api.openai.com
        - api.anthropic.com

Capability Model

Agents request capabilities through a manifest:

[capabilities]
network = ["api.openai.com"]
filesystem = "readonly"
max_memory = "256MB"

The runtime enforces these limits. Any violation terminates the agent immediately.

Escape Prevention

The WASM sandbox prevents common escape vectors:

• No raw syscalls — All I/O goes through the capability API
• No shared memory — Agents cannot read other agents' memory
• No dynamic code loading — JIT compilation is disabled
• Stack overflow protection — Guard pages prevent stack smashing