Letting the agent loose on the user's host is a security non-starter — the LLM hallucinates a rm -rf, exfiltrates a credential, or installs a payload. Spinning up a desktop VM is the obvious answer, but every team building one ends up rebuilding the same six layers: Apple Virtualization Framework wiring, screen capture, input simulation, container orchestration, isolation policy, and a hot-start runtime that boots fast enough for a chat-speed agent loop.^[1]

Browser agents got a head start because the browser is already a sandbox. Browser Use commoditized the agent framework on top — 98k+ stars and a $17M Felicis-led seed.^{[13] [21]} Browserbase raised a $40M Series B at a $300M valuation to build managed browser infrastructure underneath.^[22] But the browser is a subset — Anthropic and OpenAI both shipped computer-use APIs at the OS level precisely because the bulk of real work happens outside the tab.^{[7] [4]}

There is no Browserbase for the desktop. Every team trying to ship a CUA-class product is paying the infrastructure tax in-house — and the tax is high enough that some give up and ship browser-only. Cua is the missing primitive: one command, MIT-licensed Linux, macOS, Windows, or Android container, exposed through a computer-use interface any LLM can drive, running at 97% native CPU on Apple Silicon.^{[1] [2]}

All three frontier labs now ship computer-use models. Anthropic opened the category with Claude 3.5 Sonnet in October 2024 — 14.9% on OSWorld, nearly 2× the next-best system, with Replit, Canva, Asana, DoorDash, Cognition, and The Browser Company on launch day.^[7] OpenAI followed with Operator in January 2025, then folded it into ChatGPT agent in mid-2025.^{[4] [20]} Google joined in October 2025 with the Gemini 2.5 Computer Use model.^[19] Three labs, one shared assumption: the customer brings the desktop.

The models crossed the human baseline. Claude Sonnet 4.5 hit 61.4% on OSWorld in September 2025 — up from Sonnet 4's 42.2% just four months earlier.^[15] Simular's Agent S crossed OSWorld's 72.36% human baseline in December 2025 at 72.6%; Claude Opus 4.6 followed at 72.7% in February 2026.^{[17] [16]} Model capability is no longer the gating risk. The bottleneck moved to the runtime — boot time, snapshot/restore, isolation, fleet orchestration — exactly the surface Cua engineers against.^[1]

Capital marked the adjacent layers — and left this one open. In eleven months, investors priced every neighboring shelf of the agent-sandbox stack: Browser Use's $17M seed, then Browserbase's $40M Series B at $300M, E2B's $21M Series A with 88% of the Fortune 100 on the platform, and Daytona's $24M Series A.^{[21] [22] [23] [24]} Browser sandboxes and code sandboxes are now funded categories. The OS-level desktop runtime — the layer the computer-use models actually assume — is the one seat still unpriced, and Cua holds the OSS default with 17.9k stars and 50k+ engineers.^{[1] [2]}

Cua Driver — background computer-use. Agents drive native apps on macOS and Windows without stealing the cursor, focus, or Space — including non-AX surfaces like Chromium web content and canvas tools (Blender, Figma, DAWs, game engines). Same CLI and MCP server from Claude Code, Cursor, Codex, and custom clients; every session recorded as a replayable trajectory.^{[1] [26]} This is the feature that turns computer-use from a demo you watch into a coworker that runs while you keep typing.

One SDK, every OS, bring your own image. Sandbox.ephemeral(Image.linux()) — or .macos(), .windows(), .android() — against the cloud or local QEMU, with custom .qcow2/.iso images self-hosted today and in the cloud next.^[1] The uniform API across six runtimes is the contract competitors with one substrate cannot offer.

Cua-Bench — the eval and RL-environment loop. Run agents against OSWorld, ScreenSpot, Windows Arena, and custom tasks; export trajectories for training.^{[1] [26]} As labs buy RL environments for computer-use post-training, the benchmark registry is a second revenue surface — and it is the founder's home turf, given Windows Agent Arena.^[3]

Hot-start under one second. The managed cloud snapshots a warm desktop image and restores it for every new agent session. The cost difference between a cold-boot VM and a hot-start image is roughly 60× — the difference between a runtime you can spin up per chat turn and one you can't.^[2]

Cross-OS fleet orchestration. macOS, Linux, Windows, and Android containers from one control plane. Windows desktops in particular are exclusive to the cloud — Apple Silicon licensing makes self-hosting Windows impractical for most teams, which makes managed the only path for the workloads that actually require it (legacy ERP, .NET, native enterprise tooling).^[2]

Observability, recording, and replay. Every agent action recorded as a video plus structured trace. The artifact stack is what turns an agent prototype into a production workload — eval harnesses, regression testing, incident debugging. The OSS gives you a container; the cloud gives you a system.^[2]

The runtime stops being a moat the moment it becomes a standard. Docker the company didn't capture the orchestration value — Kubernetes, registries, and the hyperscalers did. Cua's thesis is to be the OSS standard at the runtime layer and the first mover at the orchestration layer. Browserbase ran the same play in browsers and built a real business on it.^[5]

The operational memory compounds. Every agent run leaves a trace inside the container — what worked, what failed, which UI surfaces broke, which recovery strategies converged. That dataset is the natural input for RL training, regression evals, and reliability improvements. Cua-Bench is already in the repo for exactly this loop.^[1]

The container is the API contract that survives model churn. Frontier models cycle every six months. The OS surface doesn't. A team that builds against Cua's computer-use interface today will run the same code against whichever model is best in 18 months. Abstraction over substrate is the durable position.

Near-term ICP is every team shipping a computer-use agent: foundation labs running evals (HUD, on the customer list), legacy automation startups (Fira), academic research, YC AI cohort companies, and the 50k+ engineers already building on Cua.^[2] The buyer is a technical founder writing a research preview, or a Series-A team scaling fleet ops — both want OSS by default and managed when production demands it.

Longer-term, the category is agent infrastructure as a line item. RPA is a ~$22B (2024) market growing toward $90B+ by 2030, driven by enterprise digitization.^[6] The CUA-class agent stack is the AI-native successor — the segment where workflows RPA can't reach (legacy ERP, design tools, CAD, native apps with no API) finally become automatable. Browserbase has proven a real business sits under browser agents; the OS-level fleet is structurally a larger surface.