Developer mavdol released Capsule, a Rust‑based runtime that executes untrusted code inside WebAssembly sandboxes. Leveraging WASI 0.2, wasmtime, and the component model, it isolates tasks from the host OS while exposing a thin SDK for Python and TypeScript. The approach follows recent Python sandboxing debates on Hacker News.

Using a simple @task decorator in Python or a task() wrapper in TypeScript, developers can declare CPU compute tier, RAM, timeout, allowed files and retry count per function. Example code shows an analyze_data routine that returns a JSON payload after running safely in the Wasm environment, with resource limits enforced automatically.

Capsule targets AI‑agent pipelines, where isolated, resource‑controlled steps prevent a rogue module from compromising the host. Early adopters can install via pip or npm, run tasks with the capsule CLI, and receive structured execution metadata including fuel consumption. The project is open‑source on GitHub, inviting community feedback to mature the sandbox model.