Star History Monthly October 2026 | Execution

You give a coding agent a task and walk away. When you come back it has finished. Along the way it ran tests, installed packages, opened a browser and read a config file with your cloud keys in it. Nothing went wrong this time. You still click "allow" a little slower the next day.

The agent needs to run things to be useful. The problem is where: on your laptop, as you, with everything you can reach. It is like handing a contractor the keys to every room in your house.

This month's four projects give the agent a room of its own. Each draws the walls differently: a fenced box, a whole computer with a screen, a desk in the company building, or a private copy of every app for every employee.

The demand shows in our data. OpenShell, NVIDIA's agent sandbox, gained 4,745 stars in September after 545 in August. Cua gained 5,610 after 1,344, and Coder, a repo from 2021, gained 2,490 after 352.

The lineup

Project	What the agent gets	Where it runs	Stars
OpenShell	A fenced box	Your machine or your cluster	~16K
Cua	A whole computer with a screen	Your Mac, or machines you own	~30K
Coder	A developer's workspace	Your company's servers	~17K
Cloudflare OS	A private copy of every app	Cloudflare's network	~11K

Fence it - OpenShell

🔗 https://github.com/NVIDIA/OpenShell

OpenShell runs an agent inside a box and checks everything that tries to leave it.

You ask a coding agent to upgrade a library and fix whatever breaks. On your laptop it works as you, so it can also read the cloud keys in your home folder. With OpenShell you draw the walls first: this project folder, the package registry, GitHub, nothing else. The agent never holds your keys; OpenShell adds the GitHub token on the way out, and only for GitHub.

When the agent wants something outside the walls, say a changelog on a blog, it asks. OpenShell first works out, from the rules, what saying yes would newly allow. You approve one site instead of the whole internet.

It runs Claude Code, Codex, OpenCode and Copilot's CLI. NVIDIA opened the repo in February and shipped 0.1.0 on September 25. Nearly all of September's stars arrived in its last three days.

• Tradeoffs

  • The box only holds if you write the rules well. A rule that allows "any website" is still a rule
  • Needs Linux, a Mac with Apple silicon, or Windows through WSL, plus a container runtime

• Best for: running coding agents you don't fully trust on code you do.

Give it a computer - Cua

🔗 https://github.com/trycua/cua

Cua gives an agent a whole computer, screen included.

It is built for teams that train and test agents on real desktops. Start 50 identical Mac virtual machines from one snapshot, give each a task like "export last quarter's numbers from this spreadsheet into a chart," let an agent try, score every attempt, and keep the recordings as training data. Cua's own benchmark shows the gap: on 25 expert tasks in KiCad, a circuit design program, the best frontier agent passes 6.

It also works for one person. If an internal app has no API, give an agent a desktop and watch it fill in the forms. Since the Cua Spaces app came out on October 1, you and the agent can use that desktop at the same time, each with your own cursor. "Teleport" moves an app you are signed into, say Chrome, into the agent's machine, after you approve.

The spike in our data came on September 19, when the team posted CUA-S1, a small model for computer-use decisions, on Hacker News.

• Tradeoffs

  • The desktop app needs macOS 26 or newer. Linux and Windows get the automation tools but not the app
  • The app is free, but its license is source-available rather than open source. The virtual machine tools and SDK are MIT

• Best for: training and testing agents that use real apps.

Keep it in-house - Coder

🔗 https://github.com/coder/coder

Coder gives every developer, and now every agent, a workspace on servers the company controls.

A bank with 300 developers describes a development machine once, and Coder creates one per engineer on the bank's own cloud. That was Coder's business long before agents. Its homepage now says: "Your developers have guardrails. Your AI doesn't."

In May the team added Coder Agents. A developer writes a ticket, "add pagination to the orders API." Coder starts a fresh workspace, runs its agent there, and the agent opens a pull request. The model keys live on Coder's central server, never in the workspace, so a bad command has nothing to steal, and the audit log shows who asked for what. Claude Code or Codex can run inside a workspace too, with their own keys.

Coder had the steadiest climb of the four, 2,490 stars in September against 352 in August.

• Tradeoffs

  • It is a whole platform. You need a server, a database and someone to run them
  • The agent features sit next to a paid tier aimed at large teams

• Best for: companies that already run developer workspaces and want agents under the same rules.

Give everyone one - Cloudflare OS

🔗 https://github.com/cloudflare/cloudflare-os

Cloudflare OS gives every employee an agent and a private copy of each app it makes for them.

Someone in sales asks for a dashboard of this quarter's deals at risk. The agent builds a small app, and it runs in a sandbox that belongs to that one person. A bug in it can't leak another person's deals, and if the salesperson wants a new filter, the agent adds it without touching anyone else.

Outside systems go through gatekeepers, one per service. When the agent needs a GitHub repo, a gatekeeper is created for that repo only. It logs every action and holds anything with side effects, say posting a comment, for a human to approve. The agent doesn't wait: it gets a pretend answer and carries on, and you come back from a meeting to a short list of yes-or-no questions.

Cloudflare built this for its own staff and opened the code in August. The lead contributor is Kenton Varda, the engineer behind Cloudflare Workers, and the agent loop inside is Pi, from our August post.

• Tradeoffs

  • It runs on Cloudflare's network. Local runs are for trying it out
  • The README calls it early access with "many rough edges"

• Best for: a company that wants every employee to have an agent without the security team losing sleep.

Closing Thoughts

Over the past months we have followed the agent stack one layer at a time: Skills taught it, Harness wrapped it, Output kept what it makes honest. This month is the floor it stands on, and that floor has a history.

Two companies were selling a safe place for agents to run before any of this month's four showed up. Daytona went from 20K stars in October 2025 to 67K by April 2026. E2B, the older of the two, has climbed slowly for three years. OpenShell is on the chart for scale.

Then Daytona's line goes flat. In June the company moved development to a private codebase and left the public repo with a notice that it will receive no further updates. A community fork, Nightona, continues from the last open release.

This month's four come from a different place: a chip maker, a startup, a workspace company, and a network company that built the thing for itself. For each of them the sandbox serves a bigger business, and all four have an interest in where you run your agents.

So this layer raises two questions: which box is safest, and who owns the box. The star counts say people are choosing now.