{
  "id": 7183849,
  "title": "Ephemora Cell: a capability-based WASM sandbox for untrusted AI code",
  "url": "https://urgent.news/2026/09/13/ephemora-cell-a-capability-based-wasm-sandbox-for-untrusted-ai-code",
  "topic": "ai",
  "section": "AI",
  "published": "2026-09-13T22:00:00.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/michaels1011/ephemora-cell-a-capability-based-wasm-sandbox-for-untrusted-ai-code-3eii"
  },
  "original_language": "en",
  "account": "Ephemora Cell is a capability-based WASM sandbox designed to contain untrusted AI code. This technology addresses the critical issue of determining not only whether untrusted code can run, but also the extent to which it can operate once executed.\n\nEphemora Cell operates within a capability-limited WASI runtime, providing protection for agents, MCP tools, plugins, and code interpreters. The sandbox is not an agent framework, but rather a layer situated beneath existing stacks. Once code is granted access, nothing else is permitted by default.\n\nTo illustrate its effectiveness, Ephemora Cell was subjected to eight documented attack vectors against a stock python:3.12-slim container. The results demonstrated that Cell successfully blocked all of these attacks - whereas Docker failed to block any of them.\n\nHowever, it's crucial to understand that Ephemora Cell does not validate the 'goodness' of the guest code. It merely provides a boundary within which the code can function. Misbehaviour can still occur if the code consumes its allocated resources.\n\nPerformance is a key advantage of Ephemora Cell. Traditional container startup times are costly, but Ephemora Cell excels in providing swift, per-call isolation. Benchmarks indicate sub-millisecond execution times for simple guest tasks.\n\nEphemora Cell is compatible with any language that can compile to WASI/WASM, making it a versatile tool. It includes an MCP stdio server to execute WASM modules within the same secure boundary. The results, including execution metadata, are returned alongside the response.\n\nEphemora Cell is not a solution to all security concerns. It does not claim to make models safe or eliminate residual risk. Instead, it offers a narrow security boundary and the ability to measure budgets, providing trust through these mechanisms rather than a blanket promise of safety.",
  "summary": "AI agents do not only answer questions. They write code, call tools, and load plugins. The hard part is not starting that work. It is what the code is allowed to do once it runs. Permission systems answer “may it run?” They do not answer “how far may it run?” Ephemora Cell is a small open-source execution layer for that second question. It runs untrusted workloads inside a capability-limited WASI…",
  "key_points": [
    "Ephemora Cell is a capability-based WASM sandbox for untrusted AI code.",
    "Successfully blocked eight attack vectors against python:3.12-slim container.",
    "Sub-millisecond execution times for simple guest tasks."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}