How Notion Workers run untrusted code at scale with Vercel Sandbox
Notion just shipped Workers—custom agents that can sync CRM data, trigger automations, and call any API. Here's how Vercel Sandbox keeps untrusted code from stealing your secrets.
Why it matters
Notion is evolving into a developer platform by letting users build custom agents with external code execution. This requires solving hard infrastructure problems (isolation, credential security, scale) that matter to every platform betting on agentic workflows.
The key facts
7 to knowNotion Workers enable custom agents to sync external data, trigger automations, and invoke API calls
Each Worker runs in an ephemeral Firecracker microVM with isolated kernel, filesystem, and network stack
Vercel Sandbox uses network-level credential injection to prevent prompt injection attacks from exfiltrating secrets
Dynamic network policies allow runtime lockdown: internet access for dependency installation, then egress restriction before untrusted code execution
Filesystem snapshots enable cost-efficient scaling with active-CPU billing (pay only during execution, not I/O wait)
Three primary use cases: third-party data syncing, custom automations via button triggers, and AI agent tool calls
Architecture pattern applicable to any platform running untrusted code for agents, plugins, or workflows
Go to the source
Vercel Blogvercel.com
Publisher excerpt: Notion Workers let you write and deploy code to give Custom Agents new powers: sync external data, trigger automations, call any API. With Workers, developers can build agents that sync CRM data on a schedule, open issues when error rates spike, and turn Slack threads into formatted content. Under…