Vercel Run SDK runs untrusted agent code in a sandbox with human approval pauses

What Vercel released

Vercel has released the Run SDK, a package for executing untrusted JavaScript and TypeScript without giving that code direct access to the surrounding application or system. The problem it targets is specific: agents increasingly write small TypeScript programs to coordinate tools and process their results, and running that generated code with eval hands it the same authority as the host application, including its secrets and internal services, with no durable way to pause when a step needs authentication or a human decision.

A sandbox with a narrow interface

According to Vercel, each invocation gets a fresh QuickJS context inside a worker thread, with no direct route to Node.js or the network. The application instead exposes selected operations as host functions: ordinary functions that become callable globals inside the sandbox. Calls cross the boundary through serialization, and because host functions may return promises, existing service clients can sit behind the interface without ever being passed into the sandbox. The database client and its credentials stay in the application; the generated program only ever sees the operations exposed to it.

Vercel recommends that host functions map to concrete product actions, such as refunding an order, rather than a generic request function, since narrow operations give the application a clear place to check the user and the target of the action.

The package is the internal module behind code mode tool execution in the AI SDK. There, giving an agent a program changes the unit of work: one model response can describe several calls and the logic connecting them. In Vercel's example, an account and its invoices are fetched concurrently, overdue invoices are filtered inside the program, and only the summary returns to the application. That pattern suits agents working across several internal services — a support agent can inspect billing data without pulling an entire billing response into its context.

Interruptible runs for auth and approval

Reading data is different from acting on it. When generated code reaches a sensitive operation, a host function can interrupt execution and request approval. The interrupted result carries a signed token that the application saves alongside the approval request; when a decision arrives, the token resumes the run. Resumption replays the program, but host function calls that already settled return their recorded results, so completed work is not executed again — the interrupted function receives the approval and continues from there. Vercel says the same mechanism covers workflows waiting on authentication, with the application owning the waiting period and no need to keep the worker alive.

Limits, isolation boundaries and origins

A runner factory sets shared limits — Vercel's example uses a ten-second timeout and a 32 MB memory ceiling — and limits can also be applied per run, with defaults covering the QuickJS heap and the values crossing the host boundary. Dynamic evaluation is disabled and built-in prototypes are hardened. Importantly, the boundary applies to the generated program only; host functions remain trusted application code and must perform their own authorization checks. Vercel positions the SDK for JavaScript computation inside an application and points workloads that need an operating system, package installation, or process-level isolation to Vercel Sandbox instead.

The runtime began life as js-exec inside just-bash, where agents wrote TypeScript against a virtual filesystem and command set. Vercel extracted the layer, tested the mechanism in its eve project, and it now powers code mode in the AI SDK, where existing AI SDK tools are mapped to host functions. The SDK supports Node.js 22.13+ and Bun, and a browser playground lets you try it with only the page's host functions reachable.

Why it matters

Agent frameworks keep rediscovering that code execution is the general-purpose tool, but eval-style execution erases the line between what the agent may do and what the application may do. By making capabilities explicit host functions and making runs pausable through signed, resumable tokens, Run SDK offers a concrete template for scoped authority and human-in-the-loop control. The caveat is that safety now depends on the shape of the host-function surface: the sandbox isolates the generated program, but authorization logic stays entirely with the application.