The report
A public advisory for Prefab UI describes a generative-UI execution path where supplied Python code runs in Pyodide but can reach host Deno APIs through the js bridge. In the identified versions, the host process carried filesystem and network capabilities that were not meant to be available to guest code. This is an isolation-boundary report, not evidence that a public attacker exploited every running service. Inspect the advisory.
The failure mode is a mismatch between the language sandbox and the embedding runtime. Running code in a WebAssembly-based interpreter does not automatically remove the authority of any host object deliberately exposed to that interpreter. If a bridge hands guest code a route to privileged host methods, the real control is the embedding policy and operating-system authority, not the name of the guest environment. The Case dossier records the disclosed version range and execution constraints.
The boundary to test
A meaningful reproduction uses harmless filesystem or network markers and checks what guest code can access under the actual launch flags and host bridge policy. The same code may produce different results when the Deno process has narrower permissions. Documentation promising a sandbox does not prove the configured host denies every prohibited effect.
This is distinct from the Beta9 image-builder concern: Prefab's reported route crosses from a guest language runtime into exposed host APIs, whereas Beta9's reported issue is privileged build execution and insufficient namespace separation. Both illustrate why a capability boundary must be verified at the point where a side effect becomes possible.