{"slug": "ephemora-cell-a-capability-based-wasm-sandbox-for-untrusted-ai-code", "title": "Ephemora Cell: a capability-based WASM sandbox for untrusted AI code", "summary": "A developer released Ephemora Cell, an open-source capability-based WASI/WASM sandbox for running untrusted AI agent code, MCP tools, and plugins under explicit, enforceable limits. In the project's published comparison, a stock python:3.12-slim container blocked 0 of 8 documented attack primitives while Ephemora Cell blocked all 8, with pooled warm runs reported in the sub-millisecond range on its benchmarks. The project also ships a dependency-free MCP stdio server and a GitHub Action for running WASM in CI under the same class of limits.", "body_md": "AI agents do not only answer questions. They write code, call tools, and load plugins. The hard part is not starting that work. It is what the code is allowed to do once it runs.\n\nPermission systems answer “may it run?”\n\nThey do not answer “how far may it run?”\n\nEphemora Cell is a small open-source execution layer for that second question. It runs untrusted workloads inside a capability-limited WASI runtime: agents, MCP tools, plugins, code interpreters.\n\nRepo: [https://github.com/MichaelS1011/ephemora-cell](https://github.com/MichaelS1011/ephemora-cell)\n\npip install ephemora-cell · Apache-2.0\n\nThe shape of the problem\n\nAI Agent → Tool / MCP → Ephemora Cell → WASM → bounded result\n\nCell is not an agent framework. It sits under the stack you already have. The guest gets only the capabilities you grant. Everything else is closed by default.\n\n**Same attacks, different boundary**\n\nWe ran eight documented attack primitives against:\n\na stock python:3.12-slim container\n\nEphemora Cell\n\nIn that comparison: Docker 0/8 blocked, Cell 8/8 blocked.\n\nShell, fork, sockets, host filesystem, symlink-style escapes, and related vectors are covered by the suite in the repo. Reproduce with the scripts under assets/ and benchmarks/.\n\nThis is not a universal security guarantee. It is a measured comparison for those vectors. Cell does not decide whether guest code is “good.” A module can still misbehave inside the budgets it received.\n\n**Performance** (why you can sandbox every call)\n\nCold-starting a container for every tool call is expensive. Cell is aimed at warm, per-call isolation. On our published benchmarks, pooled warm runs sit in the sub-millisecond range for a simple guest; raw results live under benchmarks/results/. Always treat latency numbers as workload- and machine-specific.\n\n**MCP**: tools need a runtime\n\nAn MCP tool is not only a JSON schema. It is code that runs.\n\nCell ships a dependency-free MCP stdio server. Tools are WASM modules executed inside the same boundary. Responses can carry execution metadata: cost (fuel, ms), policy, and outcome — so “what did it return?” and “under which limits?” stay together.\n\npip install ephemora-cell\n\nephemora-cell-mcp\n\nThere is also a GitHub Action to run WASM in CI under the same class of limits (including an isolated path with OS-level walls).\n\nAny language that compiles to WASI/WASM can be a guest. The repo CI exercises several toolchains.\n\n**What Cell is — and is not**\n\nIs: an execution primitive with explicit, enforceable limits and inspectable results.\n\nIs not: a claim that models are safe, that prompt injection is solved, or that residual risk is zero.\n\nTrust comes from a narrow boundary and budgets you can measure — not from a promise that the guest is benign.\n\nIf you build agents or MCP tools and care about what happens after the tool is selected, take a look at the repo, run the attack scripts, and break it. Technical criticism is welcome, especially on the WASI surface and the vector suite.", "url": "https://wpnews.pro/news/ephemora-cell-a-capability-based-wasm-sandbox-for-untrusted-ai-code", "canonical_source": "https://dev.to/michaels1011/ephemora-cell-a-capability-based-wasm-sandbox-for-untrusted-ai-code-3eii", "published_at": "2026-09-13 22:00:00+00:00", "updated_at": "2026-09-13 22:21:24.538432+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-tools", "developer-tools", "ai-infrastructure"], "entities": ["Ephemora Cell", "MichaelS1011", "GitHub", "WASI", "WASM", "Docker", "MCP", "Apache-2.0"], "alternates": {"html": "https://wpnews.pro/news/ephemora-cell-a-capability-based-wasm-sandbox-for-untrusted-ai-code", "markdown": "https://wpnews.pro/news/ephemora-cell-a-capability-based-wasm-sandbox-for-untrusted-ai-code.md", "text": "https://wpnews.pro/news/ephemora-cell-a-capability-based-wasm-sandbox-for-untrusted-ai-code.txt", "jsonld": "https://wpnews.pro/news/ephemora-cell-a-capability-based-wasm-sandbox-for-untrusted-ai-code.jsonld"}}