ToolsMarch 12, 2026via Vercel Blog
How Notion Workers run untrusted code at scale with Vercel Sandbox
Why it matters
Notion is evolving into a developer platform by letting users build custom agents with external code execution. This requires solving hard infrastructure problems (isolation, credential security, scale) that matter to every platform betting on agentic workflows.
Key signals
- Notion Workers enable custom agents to sync external data, trigger automations, and invoke API calls
- Each Worker runs in an ephemeral Firecracker microVM with isolated kernel, filesystem, and network stack
- Vercel Sandbox uses network-level credential injection to prevent prompt injection attacks from exfiltrating secrets
- Dynamic network policies allow runtime lockdown: internet access for dependency installation, then egress restriction before untrusted code execution
- Filesystem snapshots enable cost-efficient scaling with active-CPU billing (pay only during execution, not I/O wait)
- Three primary use cases: third-party data syncing, custom automations via button triggers, and AI agent tool calls
- Architecture pattern applicable to any platform running untrusted code for agents, plugins, or workflows
The hook
Notion just shipped Workers—custom agents that can sync CRM data, trigger automations, and call any API. Here's how Vercel Sandbox keeps untrusted code from stealing your secrets.
Notion Workers let you write and deploy code to give Custom Agents new powers: sync external data, trigger automations, call any API. With Workers, developers can build agents that sync CRM data on a schedule, open issues when error rates spike, and turn Slack threads into formatted content.
Under …