Live data from Hacker News

Monty: A minimal, secure Python interpreter written in Rust for use by AI

github.com

161–170 of 179 posts

Re: Monty: A minimal, secure Python interpreter written in Rust for use by AI

#161
I really like this for CodeAct, but like with other similar tools it's unclear how to implement data pipelining to leverage, like, lockstep batching to remote providers, or paged attention-like optimisations. Basically, let's say I want to run agent for every row in the table, I would probably want to batch most calls...

It's something, I think, missing from smolagents ecosystem anyway!

Re: Monty: A minimal, secure Python interpreter written in Rust for use by AI

#162

Earlier quoted context omitted.

What kind of type checking do you think Rust does at runtime?

Google it and try it yourself.

I’m familiar with Rust’s runtime checks, Java has more of those. I’m curious what exactly do you mean.

Re: Monty: A minimal, secure Python interpreter written in Rust for use by AI

#163
post #5

I got a WebAssembly build of this working and fired up a web playground for trying it out: https://simonw.github.io/research/monty-wasm-pyodide/demo.ht... It doesn't have class support yet! But it doesn't matter, because LLMs that try to use a class will get an error message and rewrite their code to not use classes instead. Notes on how I got the WASM build working here: https://simonwillison.net/2026/Feb/6/pydantic…

I really don't understand the use-case here. My models are writing code all day in 3/4 different languages, why would I want to: a) Restrict them to Python b) Restrict them to a cutdown, less-useful version of Python? My models write me Typescript and C# and Python all day with zero issues. Why do I need this?

It’s a sandbox. If your model generates and runs a script for each email in your inbox and has access to sensitive information, you want to make sure it can’t communicate externally.

Re: Monty: A minimal, secure Python interpreter written in Rust for use by AI

#164
post #12
post #8

This feels like the time I was a Mercurial user before I moved to Git. Everyone was using git for reasons to me that seemed bandwagon-y, when Mercurial just had such a better UX and mental model to me. Now, everyone is writing agent `exec`s in Python, when I think TypeScript/JS is far better suited for the job (it was always fast + secure, not to mention more reliable and information dense b/c of typing). But I think…

Can we please make as little js as possible? Why would one drag this god forsaken abomination on server-side is beyond me. Even effing C# nowdays can be run in script-like manner from a single file. — Even the latest Codex UI app is Electron. The one that is supposed to write itself with AI wonders but couldn’t manage native swiftui, winui, and qt or whatever is on linux this days.

> and qt or whatever is on linux this days.

When you put it like that I can see why people end up with electron!

Re: Monty: A minimal, secure Python interpreter written in Rust for use by AI

#165

Earlier quoted context omitted.

TBF is the Python ecosystem any different? None and dict everywhere, requirements.txt without pinned versions... I'm not complaining either, as I wouldn't expect a unified typed experience in ecosystems where multiple competing type checkers and package managers have been introduced gradually. How could any library from the python3.4 era foresee dataclass es or the typing module? Such changes take time, and I favor a…

It was better because it had no silent errors, like 1+”1”. Far from perfect, the fact it raised exceptions and enforced the philosophy of “don’t ask for permission but forgiveness” makes the difference. IMHO It’s irrelevant it has a slightly better typesystem and runtime but that’s totally irrelevant nowadays. With AI doing mostly everything we should forget these past riddles. Now we all should be looking towards fa…

> With AI doing mostly everything we should forget these past riddles.

How I finally was able to make a large Rust project without having to sacrifice my free time to really fully understand Rust. I have read through the Rust book several times but I never have time to fully “practice” Rust, I was able to say screw it and built my own Rust software using Claude Code.

Re: Monty: A minimal, secure Python interpreter written in Rust for use by AI

#166
post #12

Earlier quoted context omitted.

Can we please make as little js as possible? Why would one drag this god forsaken abomination on server-side is beyond me. Even effing C# nowdays can be run in script-like manner from a single file. — Even the latest Codex UI app is Electron. The one that is supposed to write itself with AI wonders but couldn’t manage native swiftui, winui, and qt or whatever is on linux this days.

I would say the same about Python, a language that has clearly got far too big for its boots.

How so? Python aged really well feature-wise. The only thing that was missing is great tooling and, thanks to Astral, this is solved too.

Re: Monty: A minimal, secure Python interpreter written in Rust for use by AI

#167
Potentially unrelated tangent thought:

The Man Who Listens to Horses (1997) is an excellent book by Monty Roberts about learning the language of horses and observing and listening to animals: https://www.biblio.com/search.php?stage=1&title=The+Man+Who+...

Video demonstration of the above: https://www.youtube.com/watch?v=vYtTz9GtAT4

Re: Monty: A minimal, secure Python interpreter written in Rust for use by AI

#168
post #63

Earlier quoted context omitted.

Docker and other container runners allow it. https://containers.dev/ allows it too. https://github.com/microsoft/litebox might somehow allow it too if a tool can be built on top of it, but there is no documentation.

Every time I use Docker as a sandbox people warn me to watch out for "container escapes". I trust Firecracker more because it was built by AWS specifically to sandbox Lambdas, but it doesn't work on macOS and is pretty fiddly to run on Linux.

Outside of VM usage, the answer seems to be (on top of containerization and selinux) writing a tight seccomp filter.

Gleaned from https://github.com/containers/bubblewrap/blob/0c408e156b12dd... and https://github.com/containers/bubblewrap/tree/0c408e156b12dd...

Re: Monty: A minimal, secure Python interpreter written in Rust for use by AI

#169

Earlier quoted context omitted.

It was better because it had no silent errors, like 1+”1”. Far from perfect, the fact it raised exceptions and enforced the philosophy of “don’t ask for permission but forgiveness” makes the difference. IMHO It’s irrelevant it has a slightly better typesystem and runtime but that’s totally irrelevant nowadays. With AI doing mostly everything we should forget these past riddles. Now we all should be looking towards fa…

> With AI doing mostly everything we should forget these past riddles. How I finally was able to make a large Rust project without having to sacrifice my free time to really fully understand Rust. I have read through the Rust book several times but I never have time to fully “practice” Rust, I was able to say screw it and built my own Rust software using Claude Code.

And also with Ada which would be even safer. And the same it is for me... we all got trained in skills are slowly going to fade away.

Re: Monty: A minimal, secure Python interpreter written in Rust for use by AI

#170
post #136

Doesn't the agent already have bash though? My current security model is to give it a separate Linux user. So it can blow itself up and... I think that's about it?

> Doesn't the agent already have bash though? You don't have to give it bash, depending on your tools at least. > So it can blow itself up and... I think that's about it? And exfiltrate data via the Internet, fill up disk space...

It can already exfiltrate stuff in a VM though right? Like people will run this thing in a sandboxed environment in docker in a VM but then hook it up to GMail and also feed it random web content (web search tool, Twitter integration etc.).

I saw at least some interest in a better security model where for example instead of giving it the API keys, there's a broker that rewrites the curl requests and injects keys so the agent doesn't see them.

I'm not sure what that looks like for your emails or web content though, since using placeholders there would defeat the purpose.

Post reply on HN