smolmachines / smolvm as a sandbox for untrusted Python & JavaScript

Simon Willison's research tested smolmachines' smolvm as a sandbox for untrusted Python and JavaScript, finding that the Claude Code for web environment lacks /dev/kvm and CPU virtualization flags, so the test battery was run on GitHub Actions runners that expose /dev/kvm. The tests, executed via a temporary workflow, aimed to enforce RAM and CPU limits, block network access, and restrict filesystem access to designated files for user-provided data transformation tasks.

Research: smolmachines / smolvm as a sandbox for untrusted Python & JavaScript https://github.com/simonw/research/tree/main/smolmachines-untrusted-sandbox readme I tasked Claude Fable 5 running in Claude Code for web with the following research task: Put https://smolmachines.com through its paces as a fast secure sandbox. Explore what it would take to use this to run untrusted Python and JavaScript code in a way that is limited in what RAM and CPU time it can take up protection against "while true" with no network access and filesystem access only to designated files Goal is to be able to use this to execute user-provided tasks for things like data transformations It quickly ran into a problem: the Claude Code for web environment can't run smol machines https://smolmachines.com . Quoting the notes it wrote https://github.com/simonw/research/blob/5e6861e54441472d194de96b49b901fd99ebc153/smolmachines-untrusted-sandbox/notes.md environment-check : - This Claude Code container: Linux 6.18.5-fc-v20 itself a Firecracker guest , 4 vCPU, 15GB RAM. No /dev/kvm, no vmx/svm CPU flags→ no nested virt. smolvm machine run fails as expected: "kvm not available".- Plan B: GitHub Actions ubuntu runners DO expose /dev/kvm → run the real test battery via a temporary workflow on this branch, collect logs, remove workflow in final commit. And Plan B is what it did https://github.com/simonw/research/blob/5e6861e54441472d194de96b49b901fd99ebc153/.github/workflows/smolvm-sandbox-test.yml , installing smolvm and running these tests https://github.com/simonw/research/blob/5e6861e54441472d194de96b49b901fd99ebc153/smolmachines-untrusted-sandbox/run-tests.sh directly in a GitHub Actions runner against that branch. That was a creative solution to the environmental limits posed by Claude Code for web. Another example of Fable being relentlessly proactive https://simonwillison.net/2026/Jun/11/fable-is-relentlessly-proactive/ . Tags: research https://simonwillison.net/tags/research , sandboxing https://simonwillison.net/tags/sandboxing , ai https://simonwillison.net/tags/ai , github-actions https://simonwillison.net/tags/github-actions , generative-ai https://simonwillison.net/tags/generative-ai , llms https://simonwillison.net/tags/llms , claude-mythos-fable https://simonwillison.net/tags/claude-mythos-fable