Most of the web package we interact pinch coming is static. The developers person a constricted magnitude of clip and attention, and attraction connected building the features that service the largest group of users. The apical of the request curve is well-served by existing software, but location is simply a long-tail of unmet needs that’s different for each user.
User needs successful mapping softwareEven if the developers were incredibly motivated to shove successful each feature, personification interfaces tin only go truthful analyzable earlier they go unusable. Every further characteristic added complicates the merchandise for each different user. If the marketplace for that characteristic is small, it tin actively make the merchandise worse for each personification who doesn’t request it.
With this discourse the emergence of LLM-assisted coding has been genuinely empowering for anyone who needed thing that fell into this agelong tail.
Software has gotten all… squishy#
It’s go readily evident that LLMs are really rather fantabulous astatine building Software for One. Personal apps that side-step each of the complexity and accountability of endeavor package and are civilization fresh for a azygous person’s workflow.
Pete Koomen astatine Y Combinator thinks location is an opportunity for what they are calling Small Software. I deliberation they are onto something.
Pi is simply a bully illustration of what I’m starting to deliberation of arsenic LLM-native software: a battle-tested core, but almost endlessly extensible conscionable by asking, wherever users are capable to stock their customizations pinch others. In the past twelvemonth your users person abruptly acquired the expertise to speak codification into existence. Most existing package can’t leverage this. Pi leans into it.
I fishy we’re going to commencement seeing much package pursuing this self-extension pattern. However astir of our existing examples of pluggable package are section software: AI agents, developer IDEs, mods for video games, Blender add-ons, CAD extensions. These thin to beryllium master devices pinch a precocious obstruction to entry.
The web is the astir successful package distribution strategy successful the world. It shouldn’t beryllium near behind.
My presumption is that there is simply a caller opportunity for Extensible Software connected the web. LLMs radically little the costs of authoring extensions, and modern sandbox primitives little the deployment costs and supply bully information boundaries. We tin build our app arsenic a solid, accountable core, and let users to safely widen it successful galore directions by having LLMs capable successful the missing pieces. We tin springiness our users ace powers.
Disclosure: I presently activity astatine Cloudflare, wherever precocious levels of vulnerability to Kenton Varda’s penning person shaped overmuch of my reasoning here. Near the end, I’ll make the lawsuit that Dynamic Workers are a peculiarly bully fresh for this model, but I’ll screen respective alternatives first.
What would this look like?#
A batch of web systems coming trust connected webhooks to let the personification to respond to changes successful the app. This ~kind of works, but it sets a really precocious barroom for extension: building and operating a wholly abstracted work positive dealing pinch immoderate transportation issues arise.
I want to beryllium capable to hook into grounds updates and descent successful my ain logic. “When I connect this tag to a record, tally my function”. “Do this action for maine connected a regular cron”.
Actually, I don’t want to person to deliberation astir that astatine all. I want to show my read-it-later app:
- Please nonstop each article I fave longer than 4000 words to my <ereader of choice>
- Look for caller papers published connected arxiv successful <my specialty> each week, adhd your ain summary of really it relates to my activity astatine the top, and tag it pinch <tag>
- The default algorithm wholly garbles <site I publication frequently>. Pull a fewer examples and make a civilization parser for it.
And past a robot will extrude the silly bits of code, hook them into immoderate extensions points, and make that happen. I should besides beryllium capable to stock what I’ve made pinch anyone other who mightiness besides want the aforesaid feature.1
Here are immoderate much areas wherever I’d emotion to spot an LLM-native hold approach.
AI Agents#
Okay, this is the evident one. pi, deepseek, and opencode, are each experimenting successful this space.
Rather than adding each caller thought to its core, Pi provides unchangeable hooks for tools, commands, events, and UI, truthful it tin move a petition into a mini TypeScript hold and reload it successful place. Those extensions tin past beryllium bundled into packages that tin beryllium shared, letting the ecosystem sorb the agelong tail of ideas without bloating the harness itself.
Deepseek showed disconnected the extensibility of its harness by demoing a personification adding a whale friend and a snake crippled to the UI conscionable by promptingHowever the assemblage of these, astatine slightest arsenic they beryllium now, is reasonably small. You person to beryllium comfortable moving civilization package connected your section machine. In firm environments the organization has to beryllium comfortable pinch you moving package that nary 1 has ever, aliases will ever, look at. Unless you sandbox Pi yourself, Pi extensions tally pinch the aforesaid permissions arsenic Pi itself.
Software engineers will find a way, but accountants, doctors, lawyers, and thousands of different professions merit amended devices too. They request agents that tin beryllium safely and easy tailored to their domain and their ain workflows.
If we’re going to get much group utilizing agents, that doesn’t mean making them package developers. It intends making the package fresh their needs.
Internal Corporate Platform#
All companies extremity up pinch tons of data. Employees request to position it, query it, analyse it, correlate it pinch this different information successful this different system, find customers experiencing <problem x>, find customers astir to churn, and a cardinal much things.
A batch of companies are experimenting pinch allowing AI-enthusiast labor to vibe codification their ain tooling, possibly deploy it to a PaaS. This is directionally correct, but creates a bunch of downstream problems. Once you person hundreds aliases thousands of these apps, really do you support them? How do they get entree to the information that they need? How do they get entree to only the information that they need? How tin we audit what this package is doing? If we’re relying connected entree tokens, what are their scopes? Who rotates them? How do we make judge that we’re not logging retired customer accusation to a third-party? How do we make judge we’re not violating GDPR?
Or a cardinal different compliance and information things that existent businesses request to interest themselves about.
What if we gave them a spot to deploy codification wherever location are nary auth tokens that tin leak? Where information entree is handled by an soul level squad that tin guarantee each of the compliance boxes are checked? Give them the abstraction to build their ain automations aliases civilization views, but safely.2
Spoiler: This is fundamentally Cloudflare OS.
Support Platform#
I’ve spent a batch of my profession handling tricky support tickets. Inevitably I extremity up digging done dashboards, searching logs, pulling information from a cardinal different places. Let maine create extensions that aboveground information for the personification that opened the summons from my peculiar strategy into the support interface. Give maine hooks truthful I tin footwear disconnected agents to do the first information of investigation for me, earlier I moreover look astatine it. If location are communal tasks that I request to do for illustration “reset circumstantial quota X” fto maine adhd a fastener to my position that tin do that.
Then besides fto maine stock these pinch my squad truthful we tin each thief each other.
Observability Platform#
Every Observability ToolA batch of Observability tooling has converged towards the aforesaid characteristic set: a measurement to hunt your logs pinch the small barroom chart connected top. A trace waterfall position for viewing individual traces. Customizable metrics dashboards. Maybe a work map. A fewer are experimenting with caller visualizations, particularly pinch the emergence of agents.
The venerable trace waterfall sketch is very useful for systems that are shaped arsenic petition / response, wherever you chiefly attraction astir latency and occurrence rate. A batch of america are uncovering ourselves pinch systems that are a spot more… stateful… aliases dynamic. Modern apps are moving non-deterministic agents aliases durable workflow engines wherever a azygous action mightiness return hours aliases days. Trace spans are a awesome source-of-truth to build upon, but fto maine research pinch my ain visualizations (or instal personification else’s).3
Beyond beautiful things I tin look at, fto maine inject my ain logic:
- arbitrary transforms for information connected ingestion
- have alarms footwear disconnected my ain scripts: deterministic codification aliases my ain agent
- give maine options to tally my ain codification astatine times of highest risk: deploys aliases characteristic emblem rollouts
- if I person a typical MyResourceID successful my logs, fto maine move that into a nexus that goes consecutive to that assets connected different platform
Extensible package connected the web is… harder#
I conscionable made each of that sound easy. It’s thing of the sort.
I’m a large instrumentality of Obsidian, some arsenic a instrumentality I usage each time and arsenic a portion of software.
It seems for illustration a basal markdown editor, but pinch a fewer clicks you tin widen it to do conscionable astir anything: track your tasks successful a kanban board aliases turn your notes into a database. Want to shove each your notes into a vector database for semantic search? Go for it! And if you want to spell further, the underlying web UI primitives are easy hackable.
However that powerfulness comes pinch a cost: Obsidian’s hold exemplary requires you to spot each plugin you install. A plugin tin fundamentally do anything. Obsidian fights this information situation pinch automated and manual review and by verifying plugin authors.
For a notes app this is apt the correct tradeoff. It useful because the stakes are debased and the organization is comparatively small. But this exemplary falls isolated the infinitesimal you want the aforesaid level of extensibility successful package holding different people’s data: customer records, financial transactions, backstage messages. Extensibility and web services person ever been a challenge.
Executing arbitrary codification is rife pinch information and maltreatment challenges. An incomplete list:
- Errors aliases infinite loops successful the user’s codification should ne'er return down your service
- With entree to keys, customer extensions tin guardant them to a 3rd party
- Likewise if you expose delicate data, make judge it can’t beryllium exfiltrated
- Make judge this strategy can’t beryllium abused to do a Denial of Service attack
- Make judge the personification can’t accidentally Denial of Service you
- Protect against Spectre attacks
- If group tin usage free compute to excavation crypto connected your dime, they will
- and galore more…
But surely personification has done this?#
Before we constitute this disconnected arsenic infeasible, location is simply a clear illustration wherever this benignant of extensibility connected the web has worked astatine immense scale: Salesforce.
Yes, that Salesforce. And they’ve been doing it since 2007. (As a constituent of reference, AWS S3 and EC2 were launched in 2006.)
You'll beryllium forgiven if you get mislaid trying to understand what Salesforce doesAsk astir technologists what Salesforce is and you’ll either get a blank look aliases possibly thing to the effect of “Aren’t they a CRM?”. However it’s much meticulous to picture Salesforce arsenic a monolithic multi-tenant programmable platform. In the nascent unreality era this trim against the grain: nary containers, and forcing group into penning this weird, civilization Java-like language, Apex.
However pinch the emergence of serverless, the level starts to look a batch much familiar. Consider immoderate examples:
If I request to expose a civilization endpoint, I tin do truthful pinch a fewer lines of code. The level handles routing, authentication, tenant isolation, execution. There is nary webserver to deploy. Squint and you tin spot it arsenic a precursor to modern serverless.
Or what astir moving civilization logic on a schedule?:
There are besides higher-level primitives truthful you tin point-and-click your measurement into a civilization application, but astatine its bosom Salesforce is safely running your civilization logic straight successful consequence to app events, wrong transactions, and allowing you to encode the particulars of your business into their app.
Two decades agone Salesforce didn’t person a ton of options for a measurement to cheaply tally sandboxed codification connected behalf of their users, truthful they built out a compiler, type system, runtime, modular library, debugger, integrated SQL into the language, tons of fancy database tricks and heaps more, and past built retired a full acquisition ecosystem. The problems it solved for businesses were valuable capable to warrant hiring humans who specialized successful their peculiar improvement platform.
We tin beryllium inspired by what they’ve done without copying it exactly. We person a batch much options successful 2026, truthful let’s look astatine what the technical requirements are for building thing for illustration this, and past what technologies mightiness fit.
New writing, occasionally.
Get my posts successful your inbox. No fixed schedule, nary noise.
A caller primitive#
We request a primitive to build this extensibility around. In bid to make it work, it needs to person a mates of properties.
Cheap Economical to run#
If you are going to person thousands aliases millions of users moving snippets of civilization code, the thought of spinning up a custom-container-per-user is simply a non-starter. It needs to costs ~$0 erstwhile it’s not being executed, and each execution ideally needs to beryllium tiny-fractions-of-a-penny cheap.
Add to that costs to build aliases compile, shop the built artifacts, cod logs, and more. Especially pinch RAM prices successful 2026, really overmuch representation overhead is required to service a petition will mostly find really galore users you tin battalion onto a azygous machine.
Fast acold starts#
We each want our web services to beryllium fast, truthful if we’re moving personification codification arsenic portion of the captious way of responding to a request, we can’t hold a infinitesimal positive for a instrumentality to rotation up. Ideally a acold commencement is measured successful single-digit milliseconds.
If you are only offering extensions that respond to events aliases tally connected a schedule you tin apt spend higher startup times.
Control complete limits#
Users of platforms do each sorts of weird, edge-case things. One of my favourite stories from an engineer astatine Heroku was that personification had published a very celebrated getting-started guideline that had the user deploy the pursuing Python app:
while True: print("hello world!");From the system’s position you person a brand-new app abruptly travel into beingness and instantly start spewing millions of lines of logs per 2nd that will ne'er stop, and the personification expects something reasonable to hap erstwhile they tally the tail command.
To protect your strategy you request to beryllium capable to enforce limits connected fundamentally everything: CPU, memory, number and size of web requests, consequence size, log measurement and rate, and overmuch more.
Solid isolation boundary#
I mean this successful some the responsibility isolation and information isolation senses. No matter what the personification does: crashes, runs an infinite loop, allocates representation arsenic accelerated arsenic possible, it should person nary effect connected immoderate different user.
And actively malicious codification must not beryllium capable to flight aliases inspect different tenants. This includes speculative execution attacks for illustration Spectre.
Allow the codification to return actions (safely)#
Custom codification that can’t impact thing is useless, truthful we request immoderate controlled measurement for personification codification to interact pinch the remainder of the world. In the simplest lawsuit you tin exemplary things arsenic a axenic function. The user’s code receives immoderate information arsenic input and tin respond pinch an answer. If location is nary I/O allowed, and a constrained output, this is rather safe, if limiting.
export default function shouldWeOrderPizzaTonight(data: Input): boolean { // see the options very carefully const haveFoodAtHome = data.fridge.hasIngredients; const haveEnergy = data.body.checkCapacity; const haveTime = !data.schedule.isTight; // return haveFoodAtHome && haveEnergy && haveTime; // we don't judge successful data-driven determination making successful this household return true; }If you request to expose much to the user, past things get a small much tricky. When we want our ain codification to call an API, we typically adhd immoderate benignant of API cardinal that we tin connect to our requests:
const response = await fetch(api, { headers: { Authorization: `Bearer ${env.API_KEY}`, }, });But this benignant of elasticity is dangerous! Malicious codification tin instantly leak that information by POSTing it to a third-party. Even exposing earthy fetch intends that the personification tin now usage your infrastructure to DoS personification if they want.
The astir communal solution for this coming is adopting a proxy. The personification is fixed an opaque token that is meaningful only to the proxy. The proxy validates the request, and past replaces the opaque token pinch the existent credential, before forwarding the petition to the destination. The proxy tin also enforce an allowlist of imaginable destinations and rate-limits connected requests. This is strictly amended than earthy fetch, but still has immoderate problems.
const response = await fetch(apiViaProxy, { headers: { Authorization: `Bearer REPLACE_THIS_WITH_MY_API_KEY_IN_PROXY`, }, });You whitethorn want to restrict what the codification tin do to only a subset of what the API allows, which requires very fine-grained authentication that astir APIs do not offer. There tin beryllium beautiful dire consequences if that API provides excessively overmuch power, aliases is exploitable successful ways you cannot foresee.
Even if the work provides fine-grained permissions, for illustration the expertise to publication your email, that may still beryllium acold much entree than you want to springiness the code. If you want to springiness the codification only entree to 1 specific email, there’s mostly nary token you tin make that allows only this.
You tin effort to enforce that successful a proxy, but now you are tasked pinch filtering retired each requests that don’t match some constrictive group of criteria, and keeping that up-to-date arsenic the backing API evolves. Our proxy codification quickly becomes very complicated. It’s difficult to expect everything a personification mightiness do here. Testing this logic and making judge it’s bulletproof is challenging.
async function proxyFetch(url: URL, headers: Headers) { const opaqueToken = headers .get("Authorization") ?.replace(/^Bearer\s+/i, ""); const grant = await parseToken(opaqueToken); if (!grant || grant.action !== "read-email") { throw new Error("Forbidden"); } const allowedPath = `/email/v1/users/messages/${encodeURIComponent(grant.messageId)}`; if ( url.origin !== "https://email.service.com" || url.pathname !== allowedPath ) { throw new Error("Forbidden"); } const newHeaders = new Headers(); // Forward only explicitly permitted headers. for (const name of ["accept", "if-none-match"]) { const value = headers.get(name); if (value !== null) { newHeaders.set(name, value); } } // Replace the opaque token pinch the existent credential. newHeaders.set("Authorization", `Bearer ${EMAIL_API_KEY}`); return fetch(url, { headers: newHeaders }); }And this is the filtering logic for conscionable 1 cognition connected conscionable 1 endpoint. In general, starting pinch a batch of power and past trying to restrict it precisely is simply a difficult problem.
A amended measurement is to manus the untrusted codification a narrow capability. At a precocious level you tin deliberation of a capacity arsenic a reference to a circumstantial function, specified arsenic 1 for fetching 1 approved-in-advance email:
// Trusted big code const getApprovedEmail = () => fetchEmailById(123, auth); // Untrusted hold code export default async function doSomethingWithAnEmail( { getApprovedEmail }: Capabilities, ) { const email = await getApprovedEmail(); // do thing pinch the email }If we region ambient I/O, the codification tin only return actions via the references it has been passed. This shape is much easier to logic about. We don’t person to muck astir pinch complicated proxy logic. The API credential is ne'er exposed to the untrusted codification astatine all. And without immoderate other outbound capability, there’s nary measurement to leak data.4
As a bonus, generating logic from a TypeScript meaning of capabilities is overmuch easier and token-efficient for an LLM than handing it a heap of OpenAPI JSON definitions.
If you are acquainted pinch IFTTT, it doesn’t springiness you a Twitter API key, it gives you twitter.post_new_tweet(). You don’t get a afloat email client, you get email.send_me_email.
This is the style we mostly want for safe extensible software.
What exertion fits?#
The much agent-brained among you person noticed by now that these are the aforesaid properties that you are looking for from an supplier execution platform. That’s not a coincidence! This is fundamentally the aforesaid problem: how can you tally logic connected behalf of a personification that you cannot trust.
The solution abstraction has a number of options:
Interpreter#
Building their ain connection worked for Salesforce 20 years ago, and this shape still works today.
You tin usage an off-the-shelf embeddable expert for illustration Lua or QuickJS aliases roll your own.
V8 Isolates#
If you return the expert attack to it’s logical conclusion, you’ll yet extremity up wanting to move to bytecode, and adding a JIT, and…
Jumping consecutive to V8 saves you the time. Google has dumped tremendous amounts of money and developer clip into hardening the V8 JavaScript engine. Cloudflare uses v8 isolates as its isolation bound for Workers, but it’s not the only action successful this space.
- Cloudflare has Dynamic Workers
- celld has (implemented immoderate parts of) Dynamic Workers
- Node has isolated-vm
- Rivet has secure-exec
MicroVMs#
Full VMs emulate a batch of virtual hardware: USB, graphics, disks, etc, which is what allows you to tally afloat desktop environments successful them, but that comes astatine a cost. Millions of lines of codification and complexity that needs to footwear up and takes up resources.
MicroVMs portion that backmost to the bone, moving very constrained operating systems, but the payoff is that they tin start in nether a 2nd and person a very mini representation overhead pinch beardown isolation boundary.
MicroVMs person much overhead than the different options, but person immoderate chopped benefits:
- POSIX
- potential to utilize a batch of CPU and RAM
- full OS tin of moving binaries
If you chiefly want to let the personification to tally immoderate spot of logic, telephone immoderate API endpoints, run a workflow, past the overhead of this attack mightiness make it overkill. However even if you spell pinch thing for illustration V8 isolates aliases WASM arsenic your isolation primitive, microVMs could still beryllium rather useful for authoring, compiling / bundling, and testing personification extensions.
This is simply a very basking abstraction pinch a batch of options:
- Firecracker
- libkrun
- AWS Lambda MicroVMs
- @deno/sandbox.
- smolvm
- Tensorlake
- Daytona
- Probably a cardinal more…
WASM + WASI#
WebAssembly starts retired pinch a blank slate. The codification tin run, allocate memory, but location are nary built-in modules for making an HTTP request, aliases reference an situation variable. This makes it an attractive candidate from a information perspective!
WASI defines a modular interface wherever the big tin specify the capabilities that get passed to the untrusted WASM code.
By integrating astatine this little level, you tin get a batch of imaginable capacity and let users to constitute in any connection that tin compile to WebAssembly, but the instrumentality concatenation grows importantly successful complexity.
You tin besides tally WebAssembly wrong a V8 isolate aliases microVM. None of these options are mutually exclusive.
If the isolation primitive does not supply its ain capacity model, it’s still a useful measurement of thinking through really you expose functionality. A proxy tin activity successful immoderate cases, but you should besides see using an Object Capability protocol for illustration Cap’n Web pinch immoderate of these primitives.
However there’s 1 solution present that I want to item successful particular…
Cloudflare’s Dynamic Workers#
Cloudflare’s Dynamic Workers were built pinch precisely this kind of usage successful mind. The trading for them has (understandably) been focused connected code mode and supplier use-cases, but IMO it’s overmuch broader than that.
Beyond gathering the criteria I projected above, they are the closest point to a production-ready out-of-the-box model for building extensible web apps that I’ve been capable to find successful 2026. (But I stake location will beryllium much soon)
There are a fistful of things that they supply that you’ll request to build retired yourself pinch different solutions:
Observability#
(My time occupation and individual soapbox)
Both you and your users request visibility into what their codification is doing. Cloudflare Workers have OpenTelemetry tracing built into the runtime itself and have first-class primitives that allow you a batch of power complete emitted telemetry.
Multi-tenant information storage#
While not each hold strategy needs users to beryllium capable to shop their ain data, this gives users a batch much flexibility.
Give them their very ain SQLite database pinch Durable Object facets. Or springiness them their ain R2 bucket.
Durable Execution#
The emergence of Temporal et al has shown that a batch of problems use from Durable Execution. Dynamic Workflows lets users to return actions complete minutes aliases days, pinch due retries and backoff.
Source Control#
Users astir apt request to type and iterate connected their extensions, and you can’t expect that everyone uses GitHub. Build root power into your product.
Hosted LLMs#
Users tin usage LLMs to thief draught their extensions, but you tin besides expose LLMs done Workers AI truthful users tin usage them successful their extensions (with due token budgets and complaint limits).
export async function analyzeArticle(env: Env, article: Article) { return consequence = await env.AI.run( messages: [ { role: "system", content: "Decide whether the supplied article talks astir tiny kittens.", }, { role: "user", content: article.text, }, ], ) }Self-hosting JavaScript Tooling#
A batch of JavaScript tooling is itself written successful JavaScript, which intends that building and testing hold codification mightiness not request a abstracted instrumentality aliases VM.
import { toggle shape } from 'sucrase'; export function transpileUserCode(source: string): TranspileResult { try { const result = transform(source, { transforms: ['typescript'], disableESTransforms: true }); return { type: 'success', code: result.code }; } catch (err) { return { type: 'failure', error: String(err) } }; } }Demo Time#
As I was penning this station I thought “What if I turned my fixed blog into the world’s smallest vibe-coding platform?”5
I wanted to see a guideline to moving pinch Dynamic Workers and immoderate cool demos, but this blog station is already measurement excessively long. I divided that retired into a guideline to Working with Dynamic Workers but still wanted to embed the last demos here.
The demo’s harness is based astir the thought of a customizable scraper. Given a URL, it will fetch the contents (unless they artifact Cloudflare), and walk those contents and a fewer utilities to the user’s code. See the guideline for a afloat explanation.
All of the examples tally connected Cloudflare Workers, and the root is editable. Modify any of them to tally your ain script, aliases if you want to constitute your ain choose “Write your own” and there’s an LLM punctual to get you started.
Each illustration runs done the aforesaid harness, but exercises a different combination of libraries and capabilities. Choose one, prime a suggested URL, aliases your own, and deed Run.
Here beryllium dragons#
One past thought.
I’ve worked astatine platforms for almost a decade. I don’t mean to make “turn your app into a platform” sound easy. Platforms are hard: difficult to design, difficult to run, difficult to debug.
Exposing APIs to customers intends a batch of upfront thought, and semipermanent support (though possibly LLMs can make this a batch easier?).
But they are besides really fun, some arsenic a personification and a creator. You tin beryllium genuinely amazed by the creativity of your users arsenic they do things that you ne'er considered aliases would person moreover thought possible.
Platforms are hard, but it’s worthy it.
Appendix#
Some things that were influential successful drafting this blog post:
- Kenton Varda’s galore writings and talks
- Let’s put AI successful tons of small boxes
- Fine-Grained Sandboxing pinch V8 Isolates
- sandstorm.io
- Cloudflare OS
- Ink and Switch’s Malleable Software
- Andy Matuschak’s Apps and programming: 2 accidental tyrannies
English (US) · 
Indonesian (ID) · 
