Vercel Releases Run SDK for Secure Agentic Code Execution

AIDeveloper44 Team

Overview of the Run SDK

Vercel has announced the release of the Run SDK, a tool designed to address security and state management challenges in AI agent development. As Large Language Model (LLM) agents increasingly generate TypeScript or JavaScript code to coordinate tools and process data, executing this code within a primary application environment poses significant security risks. The Run SDK offers a sandbox environment that isolates untrusted code while maintaining a communication channel with the host application through a controlled interface.

Standard execution methods, such as the native eval function in Node.js, grant executed code the same permissions and access as the host application. This includes sensitive environment variables, internal network services, and the local filesystem. The Run SDK mitigates these risks by moving execution into a specialized environment where access to the system is denied by default.

Architecture and Sandboxing Mechanism

The Run SDK utilizes QuickJS, a small and embeddable JavaScript engine, to create a fresh execution context for every run. This context is initialized inside a worker thread, which creates a boundary between the guest code and the host environment. Unlike standard Node.js environments, the sandbox does not have access to the network, the filesystem, or ambient Node.js modules. Execution is confined to the code provided in the source string and the specific functions explicitly passed by the application.

Communication between the application and the sandbox occurs through serialization. When the guest code calls a function provided by the host, the arguments and return values are serialized across the boundary. This architectural choice ensures that the application’s internal clients, such as database connectors or API keys, remain within the trusted host environment and are never directly exposed to the untrusted code.

Defining Capabilities with Host Functions

The primary method for an application to interact with the guest code is through hostFunctions. These are standard JavaScript functions defined in the application and exposed as callable globals within the sandbox. This design allows developers to define a narrow and specific API for the agent to use. For example, rather than providing an agent with a generic HTTP client that could reach any internal service, a developer might provide a store.listOrders(customerId) function. The logic for authentication and database querying remains safely tucked inside the host function, while the agent only sees the final result.

Host functions can also be asynchronous. Because the interface supports Promises, existing service clients can be wrapped and exposed to the sandbox without significant refactoring. This concurrent capability allows agents to perform multiple operations, such as fetching data from a CRM and a billing system simultaneously, before processing the combined results within the sandbox.

Human-in-the-Loop and Authentication Support

A distinctive feature of the Run SDK is its native support for interrupting and resuming execution. In many agentic workflows, certain actions require human oversight or secondary authentication—such as authorizing a financial refund or publishing a document. The Run SDK provides a getHostFunctionContext utility that allows a host function to trigger an interruption.

When a run is interrupted, the SDK returns a signed token rather than a final result. The application can store this token and the details of the request (e.g., "Publish draft 123?") while waiting for a user to provide approval. Once the user responds, the application can resume the run using the token. Crucially, the Run SDK does not restart the program from scratch; it replays the execution and uses recorded results for host functions that have already settled. This ensures that work completed before the interruption—such as a database read—is not repeated unnecessarily when the execution continues.

Resource Limits and Security Hardening

To prevent malicious or poorly written code from consuming excessive system resources, the Run SDK allows developers to set strict limits. These limits can be applied globally through a createRunner instance or per individual run. Configurable parameters include execution timeouts and memory usage limits. For instance, a runner can be configured to terminate any script that exceeds 32 megabytes of memory or runs for longer than 10 seconds.

Beyond resource management, the SDK implements security hardening by disabling dynamic evaluation within the guest environment and hardening built-in JavaScript prototypes. While the host functions themselves remain trusted application code, the sandbox ensures that the generated program cannot escape its confined context. Vercel notes that while the Run SDK is optimized for JavaScript computation, workloads requiring full operating system access or package installation should still utilize Vercel Sandbox.

Integration and Ecosystem

The Run SDK is already integrated into Vercel's broader AI ecosystem. It serves as the underlying runtime for the "code mode" tool execution in the AI SDK. The technology originated as an internal module called js-exec within the just-bash project, where it allowed agents to write TypeScript against virtual filesystems. By extracting this into a standalone SDK, Vercel enables developers to implement similar sandboxed execution in any application running Node.js 22.13 or newer, as well as Bun.

Enjoyed this?

Get more posts like this delivered to your inbox.

Subscribe