Nothing in this note was reproduced by us unless marked measured. "Author-reported" means the paper, README or project page says so. "Measured" for a repository means we read it or queried the GitHub API, not that we ran it. "Vendor claim" means a pricing or documentation page. "Checked on" is the day we looked. Papers are cited by arXiv identifier; no people are named.
How to read the mechanism column
- VM: one virtual machine per environment.
- container: shared host kernel, namespaced.
- shared runtime + CoW: many environments on one initialised application runtime with copy-on-write private state.
Research systems
| System | Mechanism | What it reports (author-reported unless marked) and caveats | Code and licence, checked on | What it means for Drums |
|---|---|---|---|---|
| CUA-Sandbox, arXiv 2609.32750 (26 Sep 2026), code github.com/windskyyx/Cua-Sandbox | shared runtime + CoW. OS, immutable images and initialised app processes shared; each environment gets a private state capsule (Postgres database branch via template, MySQL data directory via XFS reflink, per-branch cache and index prefixes); the browser is not shared. Scoped bindings via a signed route header; generation-atomic freeze, drain, stage, publish; fork and clone as CoW children | OSWorld (desktop), 8 active: memory 2653.8 to 837.3 MiB per env (3.2x); throughput 0.291 to 0.895 env/s (3.08x); storage 62.7 to 29.1 MiB; prepare 20.75 to 5.84 s. At 16 active: 1.517 vs 0.295 env/s, 836.5 vs 2647.0 MiB per env. Fork 0.054 s vs 4.772 s without CoW; create 0.071 s. Mixed-generation events 0 of 100 with the protocol, 100 of 100 without. Headline "6.20x, 9.2x, 504x" are VisualWebArena peaks from Figure 3 and the main text; Table 6, labelled the exact measurements for Figure 3, gives 4.3x, 1.75x, 390x and different absolute values. The WebArena and OSWorld rows agree everywhere; the VWA conflict is unresolved. 128 logical environments per RL update is not 128 executing slots. Host: 192 cores, 1.5 TiB RAM, 8 GPUs. The desktop case study is a design illustration, not a recorded run. Authors state maximum density remains unmeasured | MIT (checked 2026-10-20 and 2026-10-22). Repo created 2026-09-26, last push 2026-10-01, 26 stars, 0 forks. Web-only release (WebArena adapters). Not released: OSWorld and VisualWebArena adapters, trainer, trajectories, checkpoints. An issue comment dated 2026-10-19 said an OSWorld adapter was planned for that month; nothing had landed as of 2026-10-23. Repo docs call the shared path "an architectural MVP, not yet a production security boundary" | The closest prior art. It publishes the mechanism Drums once thought was its own, including desktop adapters for filesystem, app profile, config, display, message bus and window state, and a mid-trajectory fork. Reusable now (MIT): the route registry with its lifecycle test as a spec, the token signer, the fail-closed capability gate, the (env, site, branch, generation) identity. Drums must build all desktop pieces itself and prove its numbers against the OSWorld rows above, never against full-VM strawmen |
| CUA-Lite, arXiv 2610.26071 (19 Oct 2026), code github.com/cua-lite/cua-lite | container (shared host kernel, no KVM). OSWorld's Ubuntu desktop rebuilt into Docker containers with the real applications; the 369 evaluation tasks, setups and verifiers unchanged. One container per rollout; no shared runtime | About one sixth of OSWorld's VM memory (0.6 GB vs 3.8 GB) and about three quarters of the boot time, matched 4 GB and 4 cores, cgroup-measured, median of 20 interleaved cold starts, per instance not at concurrency. Fidelity across 13 models and 332 tasks with the same harness, verifiers and seed: average delta 2.7 points, max 5.0, Spearman 0.98. 30,000-plus verifiable training tasks across containers. Author-stated limits: Linux desktops only; verifiers not fully audited; gains not shown to transfer to unseen apps | Code real and active to 2026-10-15; no LICENSE file (checked 2026-10-21, 2026-10-22, 2026-10-23). Reuse rights unclear; running it locally for benchmarking is an open permission question, not settled | Raises the Linux-side bar: the optimised baseline Drums must beat is a real-app container with parity evidence, not a naive VM. Candidate optimised Linux baseline arm where permission allows |
| OSGym, arXiv 2511.11672 (v1 11 Nov 2025, v5 2 Apr 2026) | VM. One KVM/QEMU VM per environment inside a Docker container (inference from the text and OSWorld's Docker provider). Per-VM disks from cp --reflink=always on XFS (CoW disk, not CoW process). Fixed pool of 128 pre-warmed runners per node; memory guard; step retry | 128 replicas on an 88-core, 768 GB host with a 6 GB cap per replica (a stated limit, not measured usage). USD 0.23 per replica-day = machine rental divided by 128 configured replicas, hosting only; price basis stated only as "the current market price of cloud computer on-demand rental" with no vendor, region or date. Other rows: USD 0.78 and USD 2.10 (the latter with 36 replicas at 6 GB on a 192 GB host, which exceeds 192 GB, unexplained). 378 steps/s at 1,024 replicas; 2.41 s per step at 1, 2.71 s at 1,024. "1,420 trajectories/min" = 2,863 short trajectories over 121 net seconds on 1,024 pre-warmed replicas, a burst, priced at USD 43 in the paper; at the paper's own USD 0.23 rate the same run costs USD 0.33; the paper does not define the USD 43's scope, so this is unreconciled arithmetic, not a proven contradiction. Full-crash recovery about 80 s (32 replicas) to about 354 s (1,024). Model: Qwen2.5-VL-32B SFT plus PPO, 56.3 OSWorld-Verified. "Valid trajectories" is not defined. Reset method and time: not stated | No public code. v1 abstract says open-source; no URL in v1 or v5; no official repo found (checked 2026-10-20); the organisation named in a pasted link has no such repository (GitHub API, 2026-10-23). Licence unknown | The cheap-VM yardstick. Density comparison must be operating point vs operating point, never "6 GB cap vs 0.6 GB measured". Reusable ideas only: warm pool, memory guard, CoW file trees |
| ScaleCUA, arXiv 2607.11185 (13 Jul 2026), code github.com/THUDM/SCALE-CUA | VM. One QEMU/KVM VM in Docker per worker; cold boot per rollout by default; an optional snapshot path exists in code (measured). Go controller, Python workers, Redis allocation. The "shared docker interaction probe" is a host-side HTTP shim holding the VM handle, not a shared runtime (measured, inference) | 64 H800 GPUs (16 rollout, 48 training). OSWorld RL: batch 32, n=8, 600 concurrent containers, average step 672.1 s, average rollout 539.9 s, at most 50 turns. 2.83x training speedup from visual context segmentation. 68.7% OSWorld (9B). Cost per accepted synthesised task USD 0.93 to 1.01, LLM only; VM cost not stated. Per-container vCPU and RAM not stated | Mixed, no top-level LICENSE (checked 2026-10-20 and 2026-10-23): RL trainer MIT; evaluation code Apache-2.0; snapshot assets MIT; the task-generation pipeline, the environment worker code and the dataset carry no licence. Weights inherit the base model licence. Last push 2026-08-03 | The released end-to-end online-RL computer-use stack we verified (among sources reviewed; not a field claim). The intended integration point is swapping the worker's environment backend with the same model, tasks and hyperparameters; that worker code is unlicensed, so reference-only unless upstream licenses it. Only a scaled-down subset run is feasible. Reusable: task schema, negative controls (do-nothing, wait and mouse-jiggle runs must fail) |
| CUA-Gym and CUA-Gym-Hub, arXiv 2605.25624 (v2 9 Jun 2026), github.com/xlang-ai/CUA-Gym, github.com/xlang-ai/CUA-Gym-Hub | VM for desktop (pool of 2,000 OSWorld VMs behind a router; snapshot restore per episode). Shared process with session-scoped state for the 94 mock web apps: one process, state per session id in a JSON file | 32,112 task tuples over 110 environments (16 desktop, 94 web). VM utilisation above 75%. RL cost about 23,040 GPU-hours (35B-A3B) and about 61,440 (397B-A17B), "dominated by rollout". Synthesis about USD 0.11 LLM plus USD 0.32 VM per tuple. OSWorld-Verified 54.5 to 62.1 (35B-A3B), 62.2 to 72.6 (397B-A17B). Per-domain regressions after RL in three application domains | Pipeline Apache-2.0 (checked 2026-10-20). Hub Apache-2.0 with a research-use-only trademark notice and a takedown policy. Dataset CC-BY-4.0 (clean). Models not released | Largest open programmatic-reward desktop task set; a clean-licence seed for a validity benchmark. The web-mock layer is already "one shared process, many private sessions". Rewards check final state only, so a leaking environment could pass a reward it should fail |
| MAI-Gym, arXiv 2610.20939 (14 Oct 2026), github.com/Tongyi-MAI/MAI-Gym | VM (desktop), container (Android), headless Chromium (web). Nothing shared between attempts. The paper states that "a GUI instance cannot be shared by concurrent attempts, because the agent acts on the whole screen and changes the device's files and settings." Session leases, action ids for retry-once, deadlines, verifiers in separate process groups, environment failures logged apart from zero reward | Peak 20,000 concurrent environments on 512 GPUs for about 96 h (not split by platform). Bring-up to 1,000 GUI-ready environments: 328.4 s mobile, 88.9 s computer, 94.2 s browser. Reset p50 and p95 including queueing: 37.2 and 100.1 s for computer VMs. Unscored aborts 1.2%, 1.9%, 0.0%. 76.2% OSWorld-Verified (9B). Hypervisor, VM sizes, host count and any dollar figure: unknown | No licence file (checked 2026-10-16, 2026-10-20, 2026-10-23). Repo holds a README, mocked apps and an agent policy; README says framework source will be released. Weights Apache-2.0; paper CC BY-NC-SA 4.0 | The cleanest third-party statement of the interference problem, and a scale-out answer to it without sharing. Its 37.2 s p50 desktop reset is the operating point a reset claim must beat. Nothing may be copied until a licence appears; the environment contract, leases, retry-once and "environment failure is not zero reward" are reusable as design rules |
| ComputerRL, arXiv 2508.14040 (v2 21 Oct 2025), github.com/THUDM/ComputerRL | VM. One Ubuntu VM per environment, QEMU inside Docker. Reset is a full container restart from the base image; save-state is not implemented (measured in the provider source). Defaults 4 cores, 4 GB per VM | "Thousands" of environments; RL rollout concurrency 1,024. 48.9% OSWorld (9B). The paper says stock OSWorld VMs are CPU-intensive and unstable under high concurrency. No failure rate, restart time, cost or env-vs-inference split. Failed rollouts score 0 | Apache-2.0 (checked 2026-10-20). Released: modified environment, Docker/QEMU provider, evaluation scripts, two 9B models. Not released: controller, trainer | Proof that one VM per environment worked at 1,024 concurrency for a strong lab. Its "failed rollout equals reward 0" is the pattern a valid-rollout metric exists to replace |
| EvoCUA, arXiv 2601.15876 (v2 23 Jan 2026), github.com/meituan/EvoCUA | VM. QEMU/KVM in Docker; kernel isolation stated as a security requirement because agents run arbitrary code. Patched Ubuntu 22.04 (keymap, fonts, clipboard tool). Async gateway, sharded scheduler, image pooling | "Over 100,000 concurrent sandboxes" with no methodology, duration or hardware. 56.7% OSWorld-Verified (32B). Density per host, reset time, cost: not reported. Admits sandbox non-determinism even at temperature 0 | Apache-2.0 (checked 2026-10-20). Weights and an evaluation harness only; no gateway, scheduler, image or training code | Six-figure concurrency with plain VMs plus scheduling; the bottleneck was orchestration and determinism, not per-VM overhead (inference). The three OS patches are correctness fixes a shared host can apply once |
| UI-TARS-2, arXiv 2509.02544 (v2 5 Sep 2025), github.com/bytedance/UI-TARS | VM per GUI session on an internal platform; many Chrome instances per container for browser game environments. Lease-based lifecycle; async rollout pool | "Several thousand instances"; "millions" of rollouts; 47.5 OSWorld. No VM spec, cost, reset or failure numbers; environments described as fragile and crash-prone without figures. Reward model with a "relatively high false positive rate" | Platform not released. Related repos Apache-2.0; no UI-TARS-2 weights found (checked 2026-10-20) | VM-per-session at thousands treated as solved engineering. Browser-session sharing per container is prior art for web workloads |
| OSWorld and OSWorld 2.0, arXiv 2606.29537 (v2 13 Jul 2026), github.com/xlang-ai/OSWorld, github.com/xlang-ai/OSWorld-V2 | VM per task run (Ubuntu; the Docker provider is a QEMU VM needing KVM, Linux hosts only). Shared web tier: 31 sites behind one proxy, state picked by a cookie so many runs share one process | 108 long tasks; median human time about 1.6 h; about 27 checkpoints and about 318 tool calls per task. Best full completion 20.6%; about USD 72 of tokens per task. 30.6% to 42.6% of runs tagged "scoring/environment mismatch"; two case studies score 1.0 by bypassing the UI; agents killed whole apps and changed system settings in 35 of 108 runs of one model. Eight post-run safety checks | OSWorld and OSWorld-V2 Apache-2.0; the websites repo has no licence file in its root; task assets are a gated download (checked 2026-10-20). No macOS or ARM image | The benchmark labs will quote; a macOS-first product cannot run it as shipped. Verifier mismatch rates show why "valid rollout" must be separate from reward. The eight safety checks are reusable contamination checks |
| Echoverse, arXiv 2607.28074 (Jul 2026), github.com/microsoft/Echoverse | One app instance per task on the host OS: API server, web front end, a private copy of a SQLite seed database, own browser; no VM, no container, no process sharing. Reset copies the seed database | Graded by a database diff, not pixels, with a narrow LLM call for formatting. SFT 36.5 to 67.1 (9B); RL 58.8 to 68.0 in 50 steps on 32 GPUs. No RAM, cost or throughput numbers | MIT (checked 2026-10-20). Released: 4 of 12 worlds, 722 test tasks, harness, verifier. Not released: generators, RL code | Sidesteps OS isolation for web apps. Its verifier pattern (diff authoritative state, keep the judge narrow) and its five requirements (exact reset, volume, trustworthy reward, stationarity, safety) are ready patterns |
| VenusRL, arXiv 2610.03286 (2 Oct 2026) | microVM with page sharing: template-keyed snapshot page pools, write-protected per-sandbox mappings, memory-aware admission and migration | Up to 4.24x end-to-end training and up to 89% environment-cost improvement, combining scheduling and environment mechanisms. Sandboxes exceed 60% of non-GPU cost in its setting (not a share of total). Workload is a software-engineering agent, not a GUI desktop | Code availability and cost basis open (checked 2026-10-15) | Evidence that microVM fleets already share and reclaim memory; not a desktop comparison |
| DSec, arXiv 2609.22978 (Sep 2026) | Mixed production platform: functions, containers, microVMs with page sharing and free-page reporting, full VMs | About 160 CPU nodes; about 3M sandboxes per day, peak about 380K concurrent; 21.2% lower memory from reclamation. Not graphical desktops | Technical report; no reproduction (checked 2026-10-15) | Demand evidence and build-in-house evidence at once. The 380K are not desktops |
| Agent World Model, arXiv 2602.10090 | Synthetic database-backed tool worlds; no GUI | 1,000 executable worlds; 1,024 instances per training step; excludes UI-dependent tasks | Methods inspected (2026-10-15) | Substitution risk for the tool-shaped slice of demand |
| SoftwareGym, arXiv 2610.12611 | Synthesised GUI applications | Reports transfer to OSWorld; no independent reproduction | Page dated 2026-10-14 (checked 2026-10-15) | Substitution risk for the synthesisable GUI slice |
| Trace2World, arXiv 2610.30792 (22 Oct 2026) | Executable app environments reconstructed from real interaction traces | 1,570 traces into 50 environments across ten apps; 91.1% of 200 workflows reproduced end to end vs 59.8% for the strongest matched baseline; 94.0% of simulated training gains retained on real devices vs 54.7% under self-validation | No code link verified (checked 2026-10-23) | If this class of result holds, synthesised environments absorb the web-shaped slice; real-OS environments become the residue for desktop-native, stateful and fidelity-critical work |
Released tooling closest to the macOS design
| System | Mechanism | What it reports | Code and licence, checked on | What it means for Drums |
|---|---|---|---|---|
| Cua Driver, Lume, Cua Bench (github.com/trycua/cua) | Driver: per-process input on macOS via a private window-server path with a focus-without-raise record, Accessibility actions, per-window capture; a "session" is a lease with its own overlay cursor on one shared desktop. Lume: macOS and Linux VMs on Apple's virtualisation framework (clone by APFS clonefile of a stopped VM; no save-to-disk snapshot found). Bench: task runner | Driver docs (vendor claim): all sessions still share one screen, keyboard and focus, and native input is admitted one action at a time; keep one controller per shared desktop. Background delivery refuses real drags, modified clicks, hover, canvas apps and games. Keyboard delivery is process-scoped: a key posted to a pid lands in that app's key window | Driver, Lume, Bench: MIT. Several other crates and apps in the monorepo: FSL-1.1-MIT. An old package and a bundled detector: AGPL. Driver 0.38.0 (2026-10-20), Lume 0.6.1, Bench 0.3.1 (checked 2026-10-20) | Same OS and tools, no isolation. Reusable (MIT): per-process input recipes, Accessibility path, per-window capture, focus guards, the documented list of what fails in the background, Bench's task shape with a non-FSL backend. The driver's per-pid path is used by Drums only as the positive control that must leak. FSL and AGPL parts are off limits |
| OpenGCUA, arXiv 2610.22200, github.com/Tongyi-MAI/OpenGCUA | Agent harness and SDK driving a real Mac through Cua Driver 0.36.0; background Accessibility delivery with staleness tokens and typed errors. One runtime per Mac per user (a lock file); clipboard is whole-Mac; no environment, VM, snapshot or reset code; roadmap lists reproducible macOS environments as planned | Four real macOS tasks evaluated; on OSWorld-v2 the full configuration raised mean partial score 19.6 points and cut steps 53.0% across eight models vs GUI-only (author-reported) | Apache-2.0; releases v0.1.0 to v0.1.2 (2026-10-16 to 2026-10-19); 336 stars (checked 2026-10-20) | A worked example of window-scoped background input, staleness tokens and a capability list; no isolation. The single-runtime lock would have to go |
What the map shows
- Correct incumbent map (inspected sources only): VM-based = OSGym, ScaleCUA, ComputerRL, EvoCUA, UI-TARS-2, MAI-Gym; VM-free container = CUA-Lite; shared runtime plus branch = CUA-Sandbox (desktop unreleased). None trains on macOS.
- Sharing exists in web tiers everywhere: CUA-Gym's mocks, OSWorld 2.0's websites, CUA-Sandbox's app servers, Echoverse's per-task instances, UI-TARS-2's game browsers.
- Scale is not the open problem: fleets reach 600 (ScaleCUA) to 20,000 (MAI-Gym) environments, author-reported.
- No source gives environment cost per valid rollout.
- Only one source runs a check with the protection off to show the detector fires: CUA-Sandbox's 0 of 100 vs 100 of 100 stale-generation test. It covers stale requests, not input or clipboard cross-talk.
- Clean task licences: OSWorld (Apache-2.0), CUA-Gym dataset (CC-BY-4.0). Not clean: ScaleCUA task pool and environment worker, CUA-Lite, MAI-Gym, OSWorld-web, the macOS task sets we found (CC BY-NC), CUA-Gym-Hub clones of named products (research use only).
What we got wrong and fixed
This log is what makes the rest of the note credible. Each entry is dated.
- 2026-10-16. The novelty and blanket-necessity case was downgraded a week before the full read: "Drums must exist because nothing scales" was already contradicted as a blanket claim.
- 2026-10-16. MAI-Gym read in both directions. Its verbatim problem statement is the cleanest third-party validation of the interference problem; its solution is a substitute (scale-out with isolation, not sharing). Both recorded.
- 2026-10-22. CUA-Sandbox code identity. An earlier pass had placed CUA-Sandbox's code in the trycua/cua monorepo. Wrong: trycua/cua is an unrelated product. The paper's code is windskyyx/Cua-Sandbox (the paper's original URL redirects there; its citation file binds it to arXiv 2609.32750).
- 2026-10-23. Two of three "working differentiators" were prior art. After the full read, "VM-free desktop" turned out to be CUA-Lite's published result, and "shared runtime plus mid-trajectory branch" turned out to be CUA-Sandbox's published mechanism. An internal note from early that afternoon saying "no paper has mid-trajectory branch" was corrected the same afternoon. The remaining space is integration plus economics.
- 2026-10-23. No novel-mechanism claim survives the literature. Recorded as a thesis change: withdrawn, any novel-mechanism or unowned-market claim. Whether CUA-Sandbox's prior art anticipates any specific Drums design is a technical comparison not yet done; any patent conclusion needs legal review.
- 2026-10-23. CUA-Sandbox web vs desktop gains. The headline 6.20x, 9.2x and 504x are "up to" web peaks resting on Figure 3, which Table 6 contradicts. The desktop (OSWorld) numbers are 3.2x memory and 3.08x throughput at 8-way, agreeing everywhere. We quote the desktop rows and name the web conflict.
- 2026-10-23. OSGym cost unpack, corrected the same day. First reading: the USD 0.23 per replica-day was a secondary-market or self-host story and hyperscaler metal would land at a few dollars per replica-day. Corrected: the price regime is unknown (no vendor, region or date); the USD 43 vs USD 0.33 gap is unreconciled arithmetic rather than a proven contradiction; inference and GPU costs are not itemised rather than proven zero; the denominator is 128 configured replicas with occupancy unstated; the hyperscaler range was removed as unverified; a "6 GB cap vs 0.6 GB measured" ratio is not a valid comparison.
- 2026-10-23. OSGym mechanism. An externally pasted recommendation called OSGym "Docker, not VMs". The paper's abstract describes KVM VMs with CoW disks; the pasted repository link does not exist (GitHub API, 2026-10-23).
- 2026-10-23. Vendor status. A first reading said one vendor had "exited"; corrected to: its hosted fleet product ended 2026-10-18, its per-seat bring-your-own-compute product continues, its MIT SDK remains.
- 2026-10-23. ScaleCUA wording. "Only released end-to-end stack" was over-broad (true among sources reviewed that night, not a field claim); "internal benchmarking is low-risk" was wrong (a missing licence is unresolved permission, not an exemption); third-party checkpoints show training activity, not verified reproduction.
- 2026-10-20 to 2026-10-23. Experiment direction. The 2026-10-15 plan was Linux-first with LibreOfficeKit; 2026-10-20 moved to macOS-first sessions per Mac with a Linux arm on the same Mac; the 2026-10-23 memo records that the L1 negative and the deep read "both say the current build path is not it". The site presents experiment 1 as a feasibility measurement, not as the thesis.
- 2026-10-23. macOS privacy-grant pre-seeding. One third-party report (macOS 26.3) wrote privacy rows by file; an Apple staff forum reply says on macOS 27 grants come only from System Settings or device management, and our macOS 27 machine matched. We trust the newer source and plan on manual clicks.
- 2026-10-22. CGSession on macOS 15. Internal documents claimed the console-parking helper exists on macOS 15; Gate 0 on the Studio found it missing on 15.7.5. See desktop isolation on macOS.
- 2026-10-25. Prime Intellect Sandboxes. An earlier "browser-only" assessment was corrected before it reached anyone: Sandboxes are a microVM product with filesystem checkpoint and fork; the earlier note had conflated a browser framework with the product.
Vendor products
All vendor claims from pricing or documentation pages; nothing purchased or run.
| Vendor | Mechanism | What they state | Checked on | What it means for Drums |
|---|---|---|---|---|
| Cua (cua.ai) | Bring-your-own-compute desktops (container or VM) on the user's machines; Lume for macOS VMs | Hosted fleets ended 2026-10-18 per the vendor's page. The remaining product is per-seat SaaS at USD 0, 18 and 30 per seat; one desktop per space; no density or training-fleet product | 2026-10-20, 2026-10-23, 2026-10-25 | No hosted training fleet left to beat. The MIT SDK is a baseline arm |
| Prime Intellect Sandboxes | Hardware-isolated microVMs booting any OCI image, with filesystem checkpoint and fork (files only; memory does not carry over); checkpoint storage billed separately at an unpublished rate | USD 3.35 per hour per 100 sandboxes at 1 vCPU, 1 GiB, 5 GiB each (2026-10-25). Earlier launch rates and per-core rates differ by page and date | 2026-10-15, 2026-10-20, 2026-10-25 | The closest shipped analogue to disk-level state branching; a real same-workload hosted arm |
| E2B Desktop | Firecracker-class sandboxes with a code-defined desktop template | vCPU USD 0.000014 per second, RAM USD 0.0000045 per GiB-second, billed per second while running (allocated, not used). Team arithmetic: 2 vCPU and 4 GiB about USD 0.166 per hour | 2026-10-20, 2026-10-25 | A second hosted arm for the Linux benchmark |
| Boat | Persistent Ubuntu VMs with Docker, GUI, SSH, disk snapshots and forks | USD 20 for 2,000,000 seconds of a 4 vCPU, 8 GB VM (about USD 0.036 per hour, team arithmetic), USD 20 monthly minimum | 2026-10-15, 2026-10-20 | A list-price floor for cheap Linux environments; density alone may not beat it |
| Modal | Sandboxes; a hands-off training library (2026-10-21) and an open-source training server deployed in the user's workspace | Sandboxes about USD 0.19 per hour for 1 core and 2 GiB (team arithmetic from per-second rates). Names sandboxes for RL rollouts as a primitive. Ships no computer-use desktop environments | 2026-10-20, 2026-10-23 | A host moving into the training side; raises build-vs-buy pressure on the trainer, not on the environment layer |
| Hosted Macs (AWS EC2 Mac, MacStadium, Scaleway, others) | Dedicated Apple hardware | AWS M4, M4 Pro 48 GB and M4 Max 128 GB about USD 1.23, 1.97 and 6.25 per hour (third-party price mirror), 24 h minimum allocation to comply with Apple's licence. MacStadium M4 Pro 48 GB USD 349 per month (about USD 0.48 per hour). Scaleway M4 Pro 64 GB EUR 0.49 per hour, 24 h minimum. Two smaller hosts out of stock | 2026-10-20 | Three prices for the cost formula: owned hardware, AWS, Scaleway |
| Other named, unassessed | OpenEnv (BSD-3 environment API), BrowserGym (licence unasserted), several cloud-computer and environment-content vendors, one execution router with generation-aware routing | Vendor positioning only; no claims verified | 2026-10-15 to 2026-10-23 | Generic sandbox lifecycle and routing are table stakes; "we run sandboxes" is not a product |