AgentsAutonomy & tool use
Cua plugin runs Nous Research's Hermes Agent tasks inside disposable virtual machines
Cua's MIT-licensed cua-spaces plugin makes Cua Spaces a terminal backend for Hermes Agent. Shell, file and code work runs in a throwaway Linux or Windows VM that can be local, on a separate machine or in Cua's cloud, and users can watch it live.
From the r/AISEOInsider (via last30days) article of October 23, 2026 and cited sources: The plugin works like Hermes' existing Docker or Modal backends. [5] [9] [10]
SOURCES[5] cua-spaces · Hermes Plugin Catalog hermes-agent.nousresearch.com[9] hermes-cua-spaces PR #3 (0.3.0) github.com[10] trycua/hermes-cua-spaces (GitHub) github.com
AT Pulse research deskPublished · Updated · 5 min read · AI-assisted analysisAI-assisted, not human-edited. Methodology Corrections Who owns this site
- Original source
- r/AISEOInsider (via last30days) article, independent perspective
- Brief by
- AT Pulse research desk AI-assisted; publisher and contact on the desk page
- When
- October 23, 2026 article published
- Covered
- Oct 23 edition
- Evidence
- 12 sources across 6 sites
- 1Hermes Agent Local Sandbox Ends the Click-Yes-All-Day…reddit.com
- 2NEW Hermes AI Computer Update is INSANE!reddit.com
- 3Linked video: Hermes Agent Local Sandbox Ends the…youtube.com
- 4Hermes Agent security docshermes-agent.nousresearch.com
- 5cua-spaces · Hermes Plugin Cataloghermes-agent.nousresearch.com
- 6Cua · Y Combinatorycombinator.com
RisingHow it’s measured
YouTube video · 21.5K views · 160 likes
Reach blends public engagement (views, likes, comments, shares, stars) from the platforms where the story or its original source lives: YouTube, Hacker News, GitHub, Substack and similar. A video and the article written from its transcript share one score, taken from the video. Platforms with no data are left out rather than counted as zero, and the age of a story never lowers its score.
The plugin works like Hermes' existing Docker or Modal backends. Hermes stays on the host, while terminal, file, background-process and code tools run inside a Space. By default it uses a Linux image, deletes each Space on exit and waits up to 600 seconds for a Space to be created. Version 0.3.0 added desktop and browser tools inside Linux Spaces. [5] [9] [10]
Skipping approval prompts isn't new. Hermes already skips dangerous-command checks on container backends such as Docker, Modal and Daytona, because the sandbox is treated as the security boundary. The plugin skips prompts only for throwaway Spaces. Named Spaces that users create themselves still ask for approval. [4] [7]
What is new is a full desktop VM that people can watch and take over, compared with a headless container. Isolation is partial, though. On macOS and Windows Spaces, browser and computer_use still run on the host, and Hermes skills, caches and credentials are not copied into the Space. [3] [9] [10]
the plugin moves risky agent commands into disposable VMs that people can watch. Implication: teams can supervise and debug agents visually. Teams that only need isolated shell commands already have Hermes' Docker backend.
Sources are gathered; writing the dossier now.
Executive brief
A new MIT-licensed plugin, cua-spaces, sends Nous Research's Hermes Agent's terminal, file and code work into disposable virtual machines called Cua Spaces. Commentary says it ends constant approval prompts. The most consequential fact is that the approval skip isn't new. Hermes already skips dangerous-command checks on its Docker, Modal and Daytona backends (Hermes security docs). What the plugin adds is full Linux or Windows machines you can watch live, run locally, on your own hardware or in Cua's cloud (plugin catalog). Only Cua and Hermes materials document it, and no independent review was found.
What changed and event timeline
Spring 2025: Cua joins Y Combinator
Cua, founded by ex-Microsoft engineer Francesco Bonacci, describes itself as virtual desktops for AI agents and claims "up to 97% native CPU speed" on Apple Silicon ().
Plugin enters Hermes' verified catalog
Hermes maintainer teknium1 wrote and merged the catalog listing. "Verified" means the plugin's origin was checked: the repo is owned by trycua and its commits come from trycua.com authors ().
Cua drafts its own guide
A draft docs PR for "Run Hermes Agent on Cua Spaces" was held back until Hermes announced the launch ().
Version 0.3.0 adds desktop tools
Bot Desktop,
computer_useand the browser can now run inside Linux Spaces. This requirescua0.7.0 or later ().Promotional coverage appears
A YouTube video and a Reddit post present the plugin as a new way out of the trade-off between agent freedom and host safety. Both also promote a paid coaching community (;).
Capabilities and access
- Version and requirements:
cua-spaces0.4.0, MIT licence, needs Hermes ≥0.21.6, pinned at reviewed commit 82bb8d3 (catalog). - Setup: install Cua and run
cua auth login, thenhermes plugins install cua-spaces, thenhermes config set terminal.backend cua. - Defaults:
image: linux(Windows optional),delete_on_exit: true,create_timeout: 600seconds.
Read the full section
- Version and requirements:
cua-spaces0.4.0, MIT licence, needs Hermes ≥0.21.6, pinned at reviewed commit 82bb8d3 (catalog). - Setup: install Cua and run
cua auth login, thenhermes plugins install cua-spaces, thenhermes config set terminal.backend cua. - Defaults:
image: linux(Windows optional),delete_on_exit: true,create_timeout: 600seconds. The Space can run locally, on Cua's cloud or on a named host. - Discrepancy: the video says Spaces can run Mac (2:–). The plugin's image setting offers only Linux or Windows, and desktop features don't work on macOS or Windows Spaces.
Technical analysis for researchers and developers
- What it is: a Hermes terminal backend, the same role Docker or Modal play. Hermes itself still runs on the host.
- What runs where: terminal, file, background-process, code and desktop tools run in the Space.
- State: your Hermes skills, cache and credentials are not copied into the Space, so each Space starts from its base image.
Read the full section
- What it is: a Hermes terminal backend, the same role Docker or Modal play. Hermes itself still runs on the host. Commands are executed through
cua sandbox exec -i(PR #3). - What runs where: terminal, file, background-process, code and desktop tools run in the Space. Browser and
computer_usestay on the host for macOS and Windows Spaces (repo). - State: your Hermes skills, cache and credentials are not copied into the Space, so each Space starts from its base image.
- Testing: the developers report 64 unit tests and 15 live checks across Linux, macOS and Windows (PR #3). No public benchmark of overhead or reliability exists.
Claims and evidence
- Approval prompts are skipped only for throwaway Spaces. Named Spaces you create yourself keep the prompts.
- "Up to 97% native speed" comes from Cua's own materials only (YC page). No independent measurement was found.
- GitHub popularity: the video cites about 17,400 stars and 1,100 forks (2:04). The repo currently shows 30.7k stars and 2.2k forks (trycua/cua).
Read the full section
- Approval prompts are skipped only for throwaway Spaces. Named Spaces you create yourself keep the prompts. The plugin documentation states this openly, and Greptile's automated code review raised no defects (PR #142165).
- "Up to 97% native speed" comes from Cua's own materials only (YC page). No independent measurement was found. The figure refers to Lume virtual machines on Apple Silicon, not to Spaces in general.
- GitHub popularity: the video cites about 17,400 stars and 1,100 forks (2:04). The repo currently shows 30.7k stars and 2.2k forks (trycua/cua).
- Running agents in parallel: the video says parallel Hermes agents get separate Spaces (4:27). The default create-a-fresh-Space-per-session setting is consistent with this.
Context and prior work
- Earlier Hermes sandboxes: Hermes already supported Docker, Modal, Daytona and Vercel sandbox backends.
- Docker hardening: Hermes' Docker backend drops all Linux capabilities and caps processes at 256 (fast.io overview).
- Cua's wider stack: Lume virtual machines built on Apple's Virtualization.Framework, the Cua Driver, the CUA-S1 models and Cua Bench (trycua/cua).
Read the full section
- Earlier Hermes sandboxes: Hermes already supported Docker, Modal, Daytona and Vercel sandbox backends. All of them bypass approval because "the container itself is the security boundary" (Hermes security docs).
- Docker hardening: Hermes' Docker backend drops all Linux capabilities and caps processes at 256 (fast.io overview).
- Cua's wider stack: Lume virtual machines built on Apple's Virtualization.Framework, the Cua Driver, the CUA-S1 models and Cua Bench (trycua/cua).
- What is new: full desktop virtual machines you can watch and take over, compared with headless containers.
Limitations, safety and contested findings
- Performance: Windows Spaces on Apple Silicon run under emulation and are slow (catalog).
- Isolation gaps: browser and
computer_usestill run on the host for macOS and Windows Spaces. Bot Desktop works only in Linux Spaces. - Cloud data: cloud Spaces send your commands and files to Cua's servers.
Read the full section
- Performance: Windows Spaces on Apple Silicon run under emulation and are slow (catalog).
- Isolation gaps: browser and
computer_usestill run on the host for macOS and Windows Spaces. Bot Desktop works only in Linux Spaces. - Cloud data: cloud Spaces send your commands and files to Cua's servers. Local Spaces stay on your machine.
- Secrets: any environment variables you deliberately pass into a sandbox can be read and exfiltrated by code running there (Hermes security docs).
- Licensing: the plugin is MIT, but Cua Spaces itself uses FSL-1.1-MIT, which becomes MIT after two years (trycua/cua). The video's "free, use however you want" applies only to the plugin (2:58).
Business and practitioner implications
- Easier oversight: watching the screen live and taking over the mouse (4:52) helps with supervision and debugging.
- Cost and dependency: the first Space takes minutes to build while the image downloads (2:40).
- Headless work: teams that only need isolated shell commands already have an option in Hermes' Docker backend.
Read the full section
- Easier oversight: watching the screen live and taking over the mouse (4:52) helps with supervision and debugging. Docker backends don't offer this.
- Cost and dependency: the first Space takes minutes to build while the image downloads (2:40). Expect to budget compute, and possibly a Cua cloud account.
- Headless work: teams that only need isolated shell commands already have an option in Hermes' Docker backend.
- Before relying on it: don't treat the 97% figure, or the absence of approval prompts, as proof of safety. Test throwaway versus named Spaces yourself, and check what data leaves your machine.
The source trail.
Sources (12)
Hermes Agent Local Sandbox Ends the Click-Yes-All-Day Problem
Feed excerpt only. A transcript of the video linked from this page is supplied (linked video auto captions; https://www.youtube.com/watch?v=a2syHBs_ia4); automatic text may contain errors.
reddit.comNEW Hermes AI Computer Update is INSANE!
Related coverage; assess separately
reddit.comLinked video: Hermes Agent Local Sandbox Ends the Click-Yes-All-Day Problem
linked video auto captions
www.youtube.com