Ephemera Cell runs untrusted AI code in capability-limited WASM sandbox

A capability sandbox for model-written code

Ephemera Cell, a newly released open-source project announced in a dev.to post, targets a problem that sits between permission prompts and true isolation: once an AI agent's generated code is allowed to execute, what actually stops it from spawning a shell, opening network sockets or wandering through the host filesystem? The project, licensed under Apache-2.0 and installable from PyPI, runs untrusted workloads — agent tool calls, MCP tools, plugins, code interpreters — inside a WASI runtime restricted by explicit capabilities, where the guest holds only what it was granted and everything else is denied by default.

According to the dev.to announcement, the distinction the project draws is between asking whether code may run at all and asking how much it may do once running. Permission systems answer the first question. Ephemera Cell is built for the second.

Sitting under the stack, not replacing it

The author positions Cell as an execution primitive rather than an agent framework. The intended flow places it beneath an existing stack: an agent selects a tool, the tool's code executes as a WebAssembly module inside Cell, and a bounded result comes back. Any language that compiles to WASI/WASM can serve as a guest, and the post says the repository's CI exercises several toolchains.

Eight attacks, one comparison

To make the security argument concrete, the post describes running eight documented attack primitives — covering shell access, fork, sockets, host filesystem access and symlink-style escapes — against both a stock python:3.12-slim container and Ephemera Cell. In that comparison the container blocked zero of the eight vectors while Cell blocked all eight.

Two caveats come with those numbers. First, they are self-reported by the project's author, although the attack scripts ship in the repository so others can reproduce the results. Second, the author is explicit that this is a measured comparison for those specific vectors, not a general security guarantee: a module can still misbehave inside whatever budgets it received, and Cell makes no claim about whether guest code is benign.

Warm per-call isolation

The performance argument is about granularity. Cold-starting a container for every tool call is expensive, which pushes systems toward coarse, occasional sandboxing. According to the post, Cell instead keeps runtimes warm and isolates each call, with pooled warm runs in the sub-millisecond range for a simple guest. The author qualifies those numbers as workload- and machine-specific, with raw benchmark results published alongside the code.

An MCP runtime with metadata attached

The project also ships an MCP stdio server with no external dependencies, in which tools are themselves WebAssembly modules executing inside the same boundary. Responses can carry execution metadata — fuel consumed, milliseconds spent, the policy applied and the outcome — so a caller learns what a tool returned and under which limits in a single place. A companion GitHub Action runs WASM in CI under the same class of limits, including an isolated path with operating-system-level walls.

Why it matters

Agent frameworks increasingly execute model-written code, and isolation is often the weakest link: containers can be too heavy to spin up per call, while plain interpreters run with far more authority than a task needs. Capability-based WASM execution offers a middle path — narrow, measurable, and cheap enough to apply to every call rather than occasionally. Attaching cost and policy data to each result also makes execution auditable, which matters as tool-calling chains compound trust decisions across many steps.

The scoping is unusually honest for the space: the project does not claim to solve prompt injection or make models safe, only to bound what their code can reach. The open question is validation. The benchmark and attack-suite claims come from the author alone, and the invitation to run the scripts and try to break the sandbox is exactly the kind of scrutiny a security primitive needs before it earns a place beneath production agents.