Before anyone else's agent runs on a Kubi screen, every part of it runs on lab servers we rent by the hour and delete when a test ends. Here is what those runs changed.
A wrong call has to fail loudly
The first time an agent drove a screen end to end, it reported success on a step that had done nothing: it had sent a field the API didn't know, and the call quietly ignored it. Now every call that strays from the contract gets a 400 that names the field. An agent can recover from an error it can read; it can't recover from a success that isn't one.
270 actions, checked one by one
Clicks, double clicks, drags, scrolls, key chords and typing each have a test that drives a real screen and checks what happened on it. The suite passes 270 of 270 from a laptop against the image customers get. Three models, Claude Opus 5.5, GPT-5.4 and SWE-2, each finished 7 of 7 tasks that cross several apps.
A person's input has to feel local
When someone takes control of a screen, their typing goes through the browser, our relay and the host. In the lab a keypress reached the screen in 103 ms, and 208 ms with 40 ms of network delay added. That is the difference between taking over a desktop and fighting one.
The agent and the person share one desktop
A click planned on an old screenshot is dangerous if a person moved a window since. Kubi refuses an action based on a screenshot older than anyone's input, and Take control makes the agent's calls wait with a clear answer until the person hands the screen back.
Assume the screen is hostile
Customers have root inside their screens, so we tested a screen that lies. A guest that returned a 512 MB “screenshot”, garbage, or a reply that trickled in byte by byte found the host capping, cutting and timing it out. A call whose result is unknown now says so, and is never retried into a second click.
What's next
The same tests run again on the production servers before the first invite. Follow along on the changelog, or sign up.
