Vercel Sandbox Powers Notion Workers with Secure Code Execution at Scale.

Vercel has become the infrastructure backbone for Notion's new developer platform, providing the secure execution environment that powers Notion Workers through its Sandbox technology.

Notion Workers allow developers to write and deploy custom code that extends Custom Agents with new capabilities: syncing external data, triggering automations, and calling any API. With this integration, developers can build agents that sync CRM data on a schedule, open issues when error rates spike, or turn Slack threads into formatted content.

Notion faced a complex infrastructure problem when building its developer platform. The company wanted to let anyone extend their platform with custom code, but every Worker would run arbitrary code generated by a third-party developer or agent on behalf of a Notion user, potentially inside an enterprise workspace.

Without proper isolation, a Worker would run in the same environment as the Custom Agent, with access to its secrets, permissions, and everything else in that execution context. A single prompt injection could exfiltrate credentials or access another user's data.

The requirements were strict: hard isolation between Workers, credential security for API keys, network controls for enterprise customers, scalable performance for millions of concurrent users, fast cold starts with state preservation, and a billing model built for agents with low CPU utilization rates.

Vercel Sandbox runs each Notion Worker in an ephemeral Firecracker microVM. Every VM boots its own kernel, providing stronger isolation than containers. Each execution gets its own filesystem, its own network stack, and its own security boundary. When the Worker finishes, the microVM is either destroyed or snapshotted for later retrieval.

The platform provides several critical capabilities specifically designed for workloads like Notion Workers. Sandbox's firewall proxy can intercept and inject API keys into outbound requests at the network level, so credentials never enter the execution environment. For agent-driven workloads, this eliminates the most dangerous prompt injection vector: an agent being tricked into exfiltrating secrets.

Network policies allow Notion to define which external services a Worker can reach, critical for enterprise customers with compliance requirements. Dynamic policies can be applied per-execution, giving Notion granular control without sacrificing flexibility.

The architecture scales to support millions of users running concurrent executions without performance degradation, while maintaining the fast cold starts necessary for responsive agent interactions. Vercel's billing model aligns with the low CPU utilization rates typical of agent workloads, making it economically viable at scale.

This integration represents a significant shift in how platforms can safely expose extensibility to developers and AI agents. By delegating the complex security and isolation challenges to Vercel's infrastructure, Notion can focus on building developer-friendly APIs and agent capabilities rather than managing microVM orchestration.

The announcement comes as Vercel continues to expand its platform capabilities, following recent updates to its AI Gateway and broader infrastructure offerings. The company has positioned itself as critical infrastructure for AI-native applications that require secure execution of untrusted code.

For developers building on Notion's platform, this means Workers can safely interact with external services without exposing sensitive credentials or creating security vulnerabilities. The underlying Sandbox architecture handles the isolation complexity transparently, allowing developers to focus on building useful integrations rather than security infrastructure.

Vercel detailed the technical architecture in a blog post covering security boundaries in agentic architectures and the specific challenges of running untrusted code at scale.