Simon Willison’s latest post revisits Paul Kinlan’s observation that the browser has spent three decades acting as a hardened sandbox for hostile web code. Kinlan, a Google web platform developer advocate, argues the same mechanisms could host AI agents, prompting Willison to test the idea with a prototype in practice.

Willison built Co-do, a demo that lets users pick a local folder via the <input type=\"file\" webkitdirectory> tag, configure an LLM provider, and interact through a chat UI. Under the hood it relies on the File System Access API, iframe sandbox CSP rules, and WebAssembly running in Web Workers to enforce isolation.

The result feels similar to Anthropic’s Claude Cowork, but avoids spinning up a multi‑gigabyte local container. Willison notes sparse documentation for iframe sandbox, especially across browsers, and praises Kinlan’s double‑iframe trick for tighter network control. Future work may explore broader cross‑browser support and tighter integration with LLM back‑ends for developers.