Cua Gives AI Agents Their Own Computers So They Stop Messing With Yours

The Macro: Agents Need Computers, Not Just APIs

The way most AI agents interact with software today is through APIs. Agent calls API, gets data back, processes it, calls another API. Clean, structured, predictable. Also extremely limited.

The problem is that most of the world’s software does not have APIs. Your internal HR portal does not have an API. The legacy ERP system your company has been running since 2008 does not have an API. The government website where you file permits does not have an API. The CAD application your engineers use has an API, technically, but it covers maybe 20% of what the application can do.

This is why computer-use agents exist. Instead of talking to software through APIs, these agents can see the screen, move the mouse, click buttons, and type on the keyboard. They interact with applications the same way a human does. Anthropic built computer use into Claude. OpenAI is working on similar capabilities. The technology has reached the point where agents can reliably navigate most desktop and web applications.

But there is an infrastructure problem that nobody talks about enough. Where does the agent run? If you give an AI agent control of your actual computer, it can see everything on your screen. Your emails, your passwords, your bank accounts. It can click on things you did not want it to click on. It can accidentally delete files, send messages, or make purchases. Running a computer-use agent on your primary machine is like handing a stranger the keys to your house and saying “just clean the kitchen.”

What you want is a separate computer for the agent. A sandboxed environment where it can see a screen, use applications, and do its work without any access to your real machine. If it makes a mistake, the damage is contained. If it goes haywire, you kill the sandbox. Your data stays safe.

This is not a new concept. Virtual machines have existed for decades. But traditional VMs are slow, heavy, and not designed for the specific requirements of AI agents. An agent needs fast screen capture (it has to see what is happening), low-latency input (it needs to click and type in real time), and the ability to spin up and tear down environments quickly. Running a standard VirtualBox instance for every agent task is like using a dump truck to deliver pizza.

The Micro: Open Source Sandboxes for Every Agent

Cua is a three-person team out of San Francisco building open-source cloud desktops specifically designed for AI agents. The founder is Francesco Bonacci, who previously worked at Xbox and Microsoft AI. The company came through Y Combinator’s Spring 2025 batch.

The architecture has three layers, and understanding them separately helps. The bottom layer is Lume, their virtualization infrastructure. On Apple Silicon machines, it uses Apple’s Virtualization.Framework to run virtual machines at up to 97% of native CPU speed. That number matters because traditional VMs often run at 50-70% of native performance. The difference between 70% and 97% is the difference between an agent that feels sluggish and one that works at full speed.

The middle layer is what they call the Computer-Use Interface, or CUI. This is the bridge between the agent and the virtual machine. It lets agents see what is on the screen and interact with the VM through keyboard and mouse actions. Think of it as the eyes and hands that connect the AI brain to the virtual computer.

The top layer is the Computer-Use Agent framework itself. This is the part that is compatible with major LLM providers: Claude, GPT-4, Gemini, and open-source models. You can swap the underlying model without changing your agent code. It also includes smart routing that picks the best model for each task based on performance and cost.

The product is available on a pay-as-you-go credit system. You get 10 free credits to start, then buy more at roughly 100 credits per dollar. A small Linux sandbox costs about 5 credits per hour, so you are looking at around $0.05/hour for a sandboxed agent environment. That is cheap enough to run agents continuously on repetitive tasks without worrying about the compute bill.

The open-source angle is strategic. By making the core framework open, Cua gets adoption from the developer community and makes it easy for anyone building agents to try sandboxed execution. The paid product is the cloud-hosted version where you do not have to manage the infrastructure yourself. That is a proven business model: open-source the framework, charge for the hosted version.

They also built a Playground UI for non-developers, a web interface where you can spin up an agent and give it a task without writing code. And for teams building training data, there are dataset generation and trajectory recording tools that capture exactly what the agent did on screen with ground-truth annotations.

The Verdict

I think Cua is solving an infrastructure problem that is about to explode. Right now, computer-use agents are a novelty. People demo them on Twitter, everyone says “cool,” and then nobody deploys them at scale because there is no safe, affordable way to give agents their own computing environments.

As agents get more capable, the demand for sandboxed execution environments will grow proportionally. Every company that deploys computer-use agents will need something like Cua. The alternative is letting agents run on production machines, and no IT department is going to sign off on that.

The competitive field is forming. E2B offers sandboxed code execution for agents. Browserbase and similar tools provide browser-based agent environments. But Cua is going after the full desktop experience, not just code execution or browser automation. That is a bigger surface area and a harder problem, which means higher barriers to entry if they get it right.

The open-source strategy gives them distribution. The pay-as-you-go pricing lowers the barrier to experimentation. And the Apple Silicon optimization is a smart differentiator for the growing number of development teams working on Macs.

What I am watching: how many agent platforms integrate Cua as their default execution environment. If Claude Code, Codex, and the other major agent frameworks start pointing developers to Cua for sandboxed execution, the flywheel spins fast. Infrastructure plays are won on defaults, and the company that becomes the default sandbox for AI agents has a very large business ahead of it.