Vercel releases fx, a 6.3 MiB Zig harness for coding agents

• fx is an Apache-2.0 coding-agent harness and CLI written in Zig, with the fx launch post claiming a 6.3 MiB binary, 10-microsecond cold starts, and single-digit-megabyte baseline memory use.
• The harness exposes terminal, structured-output, editor, and browser surfaces: the launch post names fx ask --json, fx acp, and WebAssembly alongside the interactive CLI.
• Skills, plugins, and MCP extend a deliberately small core, while the launch post says sessions and usage remain local and product telemetry is absent.
• Vercel paired the sandboxing use case with a $1 million bounty: the Sandbox challenge targets Firecracker VM escapes and egress-firewall bypasses, while rauchg's post says disclosed escapes will be patched and shared.

The fx browser demo runs the full CLI as Zig-compiled WebAssembly on a browser workspace powered by just-bash. The ACP documentation says an editor connection inherits fx's configuration, project instructions, skills, sessions, permissions, sandbox, and tools.

Vercel positioned fx as infrastructure for benchmarking, evals, gyms, sandboxing, and embedding, rather than as a feature-heavy terminal workspace. The launch post says its native binary has no runtime to install, avoids work or I/O before accepting input, and minimizes the system prompt, tool set, and feature surface to reduce time to first token and context use.

The project's homepage currently lists a 6.39 MiB build and calls the project experimental, with frequent changes expected. A native CLI remains the primary surface, but the release also treats the same runtime as an embeddable component.

The official embedding guide splits fx into four execution paths:

• Interactive terminal: fx runs as a native process.
• One-shot machine calls: fx ask --json returns structured output, according to the launch post.
• Editor or client integration: fx acp runs as a native process over stdio.
• JavaScript embedding: createFxAgent() loads fx-core.wasm, while createFxTerminal() adds the interactive terminal.

The WebAssembly guide says the terminal API runs in browsers; the headless API also runs in Node.js when JSPI is enabled. The CLI reference lists --json support beyond ask, including status, permissions, model, workspace, session, and usage commands.

fx is model- and provider-agnostic, with local and cloud inference both in scope. Its extension layer consists of skills, plugins, and MCP, according to the launch post; the project repository publishes it under Apache-2.0.

The privacy claim is equally specific: Vercel says fx has no product telemetry, keeps sessions and usage local, and sends source code or prompts only to inference endpoints. With local inference and automatic updates disabled, the launch post calls the setup fully hermetic.

Vercel's fx announcement lists sandboxing as a workload, and the company has opened Vercel Sandbox to external testing through HackerOne. The $1 million pool pays up to $50,000 per report for either of two outcomes:

• Escaping the Firecracker microVM to the host.
• Defeating the host-side egress boundary, such as reaching the internet when blocked or reaching a disallowed domain under an allowlist.

Vercel said researchers may use any model in the challenge, and rauchg's post promised patches, iteration, and public findings if escapes surface. The formal scope has an important edge case: cramforce's reply says a sandbox can expose capabilities that make a host-kernel zero-day or one-day exploitable without a technical sandbox escape.

Dekhorthy separately described a collaboration system for moving prompts between teammates' agent sessions, transferring a worktree bundle with task context across workstations, Mac minis, or cloud environments, and managing sessions and artifacts from a phone.

A follow-up said senders could either queue a prompt or interrupt and send it, with the latter behavior close to steering in dexhorthy's reply.