AI EngineerVideoSource Linked

Gadgets: Personal app vibe coding that is actually safe — Kenton Varda, Cloudflare

Kenton Varda argues that personal AI-generated apps need per-user code and strong isolation, not one server-owned version. The demo shows agents modifying app code inside a constrained local runtime.

AI Engineer · Aug 5, 2026

Open Source Open Markdown Open JSON

Source Summary

The prototype treats each gadget as an app instance tied to one document, while blueprints share code without user data. Agents can modify each app, whose UI runs in a **null-origin iframe** under a restrictive **Content Security Policy**.

Practical Implication

For personal agent-built tools, design the sandbox and capability boundary before trusting generated code. The demonstrated stack uses **Cloudflare Workers and Durable Objects** and can run locally through the open-source **workerd runtime**.

Agent-Ready Context

The prototype treats each gadget as an app instance tied to one document, while blueprints share code without user data. Agents can modify each app, whose UI runs in a **null-origin iframe** under a restrictive **Content Security Policy**.

For personal agent-built tools, design the sandbox and capability boundary before trusting generated code. The demonstrated stack uses **Cloudflare Workers and Durable Objects** and can run locally through the open-source **workerd runtime**.

Iframe isolation contains many browser-code failures, but it does not by itself explain authorization for external services. The talk says a connector system exists without detailing its security model, and the recorded prototype was not released during the presentation.

Connected Context · Feed7 Judgment

This moves sandbox-first design from coding-agent infrastructure into personal, document-scoped generated apps: code sharing is separated from user data, and untrusted UI receives a deliberately narrow browser boundary. It also identifies a remaining gap in the prior sandbox picture—runtime containment is insufficient unless connector credentials and external-service capabilities are independently authorized.

Project-scoped TokensProject-scoped credentials supply the kind of capability boundary the gadget connector model leaves unspecified: sandboxed code should receive authority limited to the external resource it needs.From fork() to Fleet: Designing an Agent Sandbox Cloud — Abhishek Bhardwaj, OpenAIThe microVM design provides a stronger server-side isolation and recovery model, while Gadgets applies a lighter null-origin iframe boundary to generated browser UI; the appropriate boundary depends on where untrusted code executes.Give every agent in Herdr its own Vercel SandboxBoth isolate each generated workload as its own instance, but Herdr also preserves a review boundary by returning an opt-in patch, whereas Gadgets focuses on containing the running app and separating its document data from shared code.

Context Map

infracodingsecurity#sandboxing#computer-use#generative-media

Uncertainty

Iframe isolation contains many browser-code failures, but it does not by itself explain authorization for external services. The talk says a connector system exists without detailing its security model, and the recorded prototype was not released during the presentation.