Simon Willison used Claude Code as a research agent to produce a comprehensive comparison of JavaScript sandboxing options for running untrusted code, covering Node.js worker_threads, node:vm, Permission Model, isolated-vm, vm2, quickjs-emscripten, QuickJS-NG, ShadowRealm, and Deno Workers. The Claude Code angle makes this directly relevant — it demonstrates agentic coding assistants being used for applied security research. Practical reference for engineers building AI tools or platforms that need to safely execute user-provided JavaScript.
Infrastructure
JavaScript Sandboxing Research
Simon Willison leveraged Claude Code as a research agent to systematically evaluate eight JavaScript sandboxing approaches for safely executing untrusted code, demonstrating how AI assistants can accelerate security research for developers building user-code execution platforms.
Monday, March 23, 2026 12:00 PM UTC2 MIN READSOURCE: Simon WillisonBY sys://pipeline
Tags
infrastructure