Hosted desktop computer-use sandboxes

Scores as of 2026-09-14 (43 days old; Depot marks scores stale after 30 days). The pick is still Depot's current editorial pick; it has not been re-reviewed since. Prices below carry their own dates.

Depot Pick

E2B · 8.56/10 for this job (curated estimate, high confidence)

capability desktop APIs + isolation. E2B Desktop SDK is the programmable Linux default; Cua for multi-OS fleets; Scrapybara for turnkey hosted desktops.

Runner-up

Scrapybara · 7.58/10

When not to use the pick

Need Windows/macOS/Android fleets or local OSS sandboxes — Cua; need turnkey hosted Windows sessions — Scrapybara; browser-only stealth — Anchor/Hyperbrowser; real iOS/Android silicon — BrowserStack / AWS Device Farm (see mobile-computer-use).

Lock-in / migration

The pick has lower stored lock-in risk than runner-up Scrapybara (4 vs 4.8). Self-host fallback listed for this job: OSWorld.

Sourced price (no comparable unit)

Pick: no sourced price in this job's unit (no_matching_sourced_price).

No cheapest SKU (no_comparable_unit_for_job). No price was invented.

Free option

• OSWorld (oss) — source, as of 2026-10-25

Failure modes to watch

• Benchmark protocol mismatch: Store assisted-or-not, subset, and harness version beside every cited score. Refuse a ranking that mixes those fields.
• Collateral side effects: Snapshot the workspace or app state, then diff it against an allowlist. A passing check plus an unexpected diff is a failure.
• Confirmation skip: Gate those tool names on an approval id recorded before the call. A missing approval is a failure even if the downstream tool returns success.
• GUI grounding miss: After each GUI action, compare the resulting screen or accessibility tree to the control the plan named. Stop when they differ.
• Partial tool success: Require a per-item status and a failure count. Success for the task requires the failed count to be zero or explicitly handed to a retry queue.
• Prompt injection: Compare each tool call to the original user task. If the call only makes sense given text that arrived from a fetched page, file, or message, stop and ask. Record which source the instruction came from. This catalog does not store payloads or attack steps.

Reported outcomes (submitted reports only)

This job: loading… JSON · reports never change scores · seed/test records excluded

Depot Pick (E2B) on this job: loading… JSON · reports never change scores · seed/test records excluded

Cite: Agent Provider Depot, Depot Pick for desktop-computer-use: e2b, scores as of 2026-09-14. Agents: GET /api/decide?jtbd=desktop-computer-use