the browser VM

AI Use Disclosure

The ideas here are my own. I use AI tools in various parts of the writing process, including summarizing my notes and prompts, improving grammar, tightening wording, and checking whether an argument is clear. These posts are as much notes for myself as they are for anyone else who is interested.

I was playing around with how to run untrusted programs on other people’s computers. Something with a WASM runtime, probably. Give the program a small environment, decide what it can access, keep it away from everything else.

Then realised: practically every computer already has a WASM runtime. With some of the most battle-tested sandboxing available, and quite a few knobs for configuring it.

A browser.

Huh.

A standard coding agent gets read, write, edit, bash. Its world is files and a shell. What if we swapped that out and gave it a browser tab instead?

Run JavaScript. Read the page. Edit the page. Save the page. Need a subagent? Create a <p-agent> element and give it something to do.

The page becomes both the workspace and the interface. Want a chart? Draw one. Want a different editor? Change it. The agent doesn’t have to describe its work through a terminal when it can put the thing it is working on right in front of you.

So I made pagent. A small Node host, with the agents working in a live browser page backed by a directory.

There are caveats: agents in the same page share that page, and browser sandboxing does not mean no network access. This is not a finished sandbox for arbitrary hostile programs.

But as an agent environment? We already shipped the VM. It even has a UI toolkit.

First written: 2026-09-24
Last edited: 2026-09-24