Hacker News

> But it doesn't matter, because LLMs that try to use a class will get an error message and rewrite their code to not use classes instead.

This is true in a sense, but every little papercut at the lower levels of abstraction degrades performance at higher levels as the LLM needs to spend its efforts on hacking around jank in the Python interpreter instead of solving the real problem.

This is very cool, but I'm having some trouble understanding the use cases.

Is this mostly just for codemode where the MCP calls instead go through a Monty function call? Is it to do some quick maths or pre/post-processing to answer queries? Or maybe to implement CaMeL?

It feels like the power of terminal agents is partly because they can access the network/filesystem, and so sandboxed containers are a natural extension?

I really don't understand the use-case here.

My models are writing code all day in 3/4 different languages, why would I want to:

a) Restrict them to Python

b) Restrict them to a cutdown, less-useful version of Python?

My models write me Typescript and C# and Python all day with zero issues. Why do I need this?

> and rewrite their code to not use classes instead

Only if the training data has enough Python code that doesn't use classes.

(We're in luck that these things are trained on Stackoverflow code snippets.)

3 reasons why Python is much better than JS for this IMO.

1. Large built-in standard library (CSV, sqlite3, xml/json, zipfile).

2. In Python, whatever the LLM is likely to do will probably work. In JS, you have the Node / Deno split, far too many libraries that do the same thing (XMLHTTPRequest / Axios / fetch), many mutually-incompatible import syntaxes (E.G. compare tsx versus Node's native ts execution), and features like top-level await (very important for small scripts, and something that an LLM is likely to use!), which only work if you pray three times on the day of the full moon.

3. Much better ecosystem for data processing (particularly csv/pandas), partially resulting from operator overloading being a thing.

Having been doing Python for over a decade and JavaScript. I would pick Python any day of the week over JavaScript. JavaScript is beautiful, and also the most horrific programming language all at once. It still feels incomplete, there's too many oddities I've run into over the years, like checking for null, empty, undefined values is inconsistent all around because different libraries behave differently.

For historical reasons (FFI), Python has access to excellent vector / tensor mathematics (numpy / scipy / pandas / polars) and ML / AI libraries, from OpenCV to PyTorch. Hence the prevalence of Python in science and research. "Everybody knows Python".

I do like Typescript (not JS) better, because of its highly advanced type system, compared to Python's.

TS/JS is not inherently fast, it just has a good JIT compiler; Python still ships without one. Regarding security, each interpreter is about as permissive as the other, and both can be sealed off from environment pretty securely.

A big benefit of letting agents run code is they can process data without bloating their context.

LLMs are really good at writing python for data processing. I would suspect its due to Python having a really good ecosystem around this niche

And the type safety/security issues can hopefully be mitigated by ty and pyodide (already used by cf’s python workers)

https://pyodide.org/en/stable/

https://github.com/astral-sh/ty

Agreed, however AI adoption is finally putting pressure on CPython to have a JIT in the box, so there is that.

And on GPU side, the existing libraries provide DSL based JITs, thus for many scenarios the performance is not much different from C++.

Now NVidia is also on the game with the new tile based architecture, with first party support to write kernels in Python even.

Tangentially i wonder if the recent changes in the GIL will percolate to mercurial as any improvements.

Yep still using good old hg for personal repos - interop for outside project defaults to git since almost all the hg host withered.

For me it's the opposite. I'm actively looking for tools in Python because at least they're gonna be lightweight and easy for me to debug.

Really tired of every AI-related tool released as of late being a half-GB node behemoth with hundreds of library dependencies.

Or alternatively some cryptic academic Rust codebase.

Don't extrapolate

There is a ton of wheel reinvention going on right now cause everyone wants to be cool in the age of ai

Use boring tech, you'll thank me and yourself later

Which in this case means, just use regular python. Your devops team is unlikely to allow knock off python in production. TS is fine too, I mainly write Go

Python has uv, ruff, ty

I remember the time when Python was the underdog and most of AI/ML code was written in the Matlab or Lua (torch). People would roll their eyes when you told them that you were doing deep learning with Python (theano).

Can we please make as little js as possible?

Why would one drag this god forsaken abomination on server-side is beyond me.

Even effing C# nowdays can be run in script-like manner from a single file.

—

Even the latest Codex UI app is Electron. The one that is supposed to write itself with AI wonders but couldn’t manage native swiftui, winui, and qt or whatever is on linux this days.

Python has the advantage that everybody sort of knows it is bad and slow, which is an important trait for a glue language. This increases the incentive to do the right thing: call a library written in C or Fortran or something.

Can't be sure where this might end, but the primary goal is to enable codemode/programmatic tool calling, using the external function call mechanism for anything more complicated.

I think in the near term we'll add support for classes, dataclasses, datetime, json. I think that should be enough for many use cases.

there’s no way around VMs for secure, untrusted workloads. everything else, like Monty has too many tradeoffs that makes it non-viable for any real workloads

disclaimer: i work at E2B, opinions my own

Pydantic + FastAPI are my two favorite python shops right now, they’re always dropping fun new projcts

uv is written in Rust, not Python.

I think the hard part about that is you first have to train the model on a BUTT TON of that new language, because that's the only way they "learn" anything. They already know a lot of Python, so telling them to write restricted and sandboxed Python ("you can only call _these_ functions") is a lot easier.

But I'd be interested to see what you come up with.

My understanding is that "the class restriction" isn't trying to implement any kind of security boundary — they just haven't managed to implement support yet.

https://github.com/butter-dot-dev/bvisor is pushing in that direction

Yours is a valid approach. But you always gotta wonder if there’s some way around it. Starting with runtime that has ways of accessing every aspect of your system - there are a lot of ways an attacker might try to defeat the blocks you put in place. The point of starting with something super minimal is that the attack surface is tiny. Really hard to see how anything could break out.

rlm-rs: https://crates.io/crates/rlm-rs src: https://github.com/synth-laboratories/Horizons

They plan to use to for "Code Mode" which mean the LLM will use this to run Python code that it writes to run tools instead of having to load the tools up front into the LLM context window.

It's pydantic, they're verifying types and syntax, those don't require the stdlib. Type hints, syntax checks, likely logical issues,etc.. static type checking is good with that, but LLMs can take to the next level where they analyze the intended data flow and find logical bugs, or good syntax and typing but not the intended syntax.

For example, incorrect levels of indentation. Let me use dots instead of space because of HN formatting:

for key,val in mydict.items():

..if key == "operation":

....logging.info("Executing operation %s",val)

..if val == "drop_table":

....self.drop_table()

This uses good syntax, and I the logging part is not in the stdlib, so I assume it would ignore it or replace it with dummy code? That shouldn't prevent it from analyzing that loop and determining that the second if-block was intended to be under the first, and the way it is written now, the key check isn't done.

In other words, if you don't want to do validate proper stdlib/module usage, but proper __Python__ usage, this makes sense. Although I'm speculating on exactly what they're trying to do.

EDIT: I think I my speculation was wrong, it looks like they might have developed this to write code for pydantic-ai: https://github.com/pydantic/pydantic-ai , i'll leave the comment above as-is though, since I think it would still be cool to have that capability in pydantic.

Not sure if this is what you are looking for, but here is Python compiled to WASM: https://pyodide.org/en/stable/

Web demo: https://pyodide.org/en/stable/console.html

No one is going to let an LLM get prompted by end users to write python code I just run on my server, there's no real debate on that.

> Doesn't the agent already have bash though?

You don't have to give it bash, depending on your tools at least.

> So it can blow itself up and... I think that's about it?

And exfiltrate data via the Internet, fill up disk space...

We already have a starting point:

https://play.rust-lang.org

https://github.com/rust-lang/rust-playground

Didn’t Anthropic recently acquire some JavaScript engine, though?

I figured that that was because they want tighter integration and a safer execution environment for code written by the LLM. And sandboxing is already very common for JavaScript in browsers.

best answer is probably to have a layered approach - use this to limit what the generated code can do, wrap it in a secure VM to prevent leaking out to other tenants.

Of course not, especially when the security model is about access to resources like file systems that are outside the scope of what the Rust compiler can verify. While you won't have a data race in safe Rust you absolutely can have data races accessing the file system in any language.

Their security model, as explained in the README, is in not including the standard library and limiting all access to the environment to functions you write & control. Does that make it secure? I'll leave it to you to evaluate that in the context of your use case/threat model.

It would appear to me that they used Rust primarily because a.) they want to deliver very fast startup times and b.) they want it to be accessible from a variety of host languages (like Python and JavaScript). Those are things Rust does well, though not to the exclusion of C or other GC-free compiled languages. They certainly do not claim that Rust is pixie dust you sprinkle on a project to make it secure. That would clearly be cargo culting.

I find this language war tiring. Don't you? Let's make 2026 the year we all agree to build cool stuff in whatever language we want without this pointless quarreling. (I've personally been saying this for three years at this point.)

Python already has a lot of half-baked (all the way up to nearly-fully-baked) interpreters, what's one more?

https://en.wikipedia.org/wiki/List_of_Python_software#Python...

How do I sandbox CPython using OS features?

(Genuine question, I've been trying to find reliable, well documented, robust patterns for doing this for years! I need it across macOS and Linux and ideally Windows too. Preferably without having to run anything as root.)

The repo does make a case for this, namely speed, which does make sense.

I do both and compile times are very unfriendly to AI!

this is pretty performant for short scripts if you measure time "from code to rust" which can be as low as 1us.

Of course it's slow for complex numerical calculations, but that's the primary usecase.

I think the consensus is that LLMs are very good at writing python and ts/js, generally not quite as good at writing other languages, at least in one shot. So there's an advantage to using python/js/ts.