Screenshot-click-type is not the hard part. Any demos that stop at "the model can use a mouse" are selling the wrong layer.
The hard part is a private Linux desktop per bot, view-only by default, human takeover when needed, a vault that never puts secrets in the transcript, and a harness that can swap Grok / Claude / Codex / Ollama on the same task.
That is Sub8.
Topology
- Host app on your machine — orchestration, UI, policy.
- Docker / Colima VM — the agent's desktop. Host files are off-limits by construction.
- Two tunnels: computer-use (pixels + input) and docker exec (shell when you allow it).
If the agent can see your home directory, you do not have computer-use. You have remote code execution with a cute cursor.
Why host files are off-limits
Coding agents fail in interesting ways: rm -rf, credential scrapes, "helpfully" rewriting configs outside the repo. Isolation is not paranoia. It is the product boundary that lets you run long tool-call loops overnight without babysitting.
View-only by default. Human takeover when the agent is stuck. Secrets in a vault — never pasted into the chat transcript the model can echo later.
Model-agnostic as an eval feature
Being able to swap models on the same isolation harness is not a marketing checkbox. It is how you measure post-training effects on tool use: same desktop, same task, different model. If your sandbox is glued to one vendor's computer-use API, you cannot run that comparison.
What broke in alpha
Permissions and display plumbing ate more time than the model. Credential injection paths that looked safe until the transcript leaked them. The interesting failures were harness failures — not "the LLM clicked the wrong button."
Live: https://sub8.grok.me
Isolation first. Then the mouse.