In Sugar whenever you join a group activity the application is downloaded and run from the group. Whilst their security system is fairly untested I think that this is a more sensible model than moving everything into the browser.

There's some more information on the security system here: http://wiki.laptop.org/go/Bitfrost