Low level of `virtual machine' interface makes meaningful security restrictions difficult to specify.
Applications
Proposed Solutions
Java - an object-oriented, stack-based virtual machine with safe execution and GC features; currently has binding for the Java language (a safe, object-oriented extension to C).
Guile - a list-oriented virtual machine with safe execution and GC features, integrated with a lower-level faux-Java byte-code virtual machine. Currently has bindings for Scheme, Tcl, and ctax languages.
Low Telescript - stack language apparently supporting suspension and (remote) resumption of execution; see MagicCap Telescript docs for general info (but note MagicCap 1.0 only supports mobile objects, not code...hmm).