What is webAssembly sandbox?
Answer in brief
Running code compiled to WebAssembly in a runtime that only grants the capabilities you pass in.
WebAssembly sandbox in agent sandboxes
WebAssembly runtimes (such as Wasmtime) are capability-based: a module has no filesystem or network access unless the host provides it. This makes Wasm attractive for running small, untrusted snippets — including Python via Pyodide — with low startup cost. Compatibility with native packages and system tools is the main limitation.
Cite this page
Agent Sandboxes. (2026). What is webAssembly sandbox?. agentsandboxes.org. Last reviewed November 8, 2026. https://agentsandboxes.org/glossary/wasm-sandbox/
Found an error or a missing sandbox? Submit a correction — every entry links to the sources it relies on.