▶ LOG 001 · A POINT OF VIEW ON WHERE THE DESKTOP GOES NEXT
The industry is racing to put an AI inside your computer so it can watch everything you do. We think that is exactly backwards. Put the computer inside the AI — a Linux desktop in the cloud, running in your browser, that you shape, talk to, and reach into with your hands, where everything the AI does is logged and everything it collected can be destroyed with one press.
The computer is the agent. Agents are computers.
The future is not the AI recording your desktop — it’s the desktop living inside the AI. Linux in the browser · voice + hands as native input · every action logged · a self-destruct that means it[001.1] THE STALE DESKTOP
Look at the most polished desktop in the world in 2026 and notice how little of it you are allowed to change.
macOS 26 “Tahoe” shipped Apple’s biggest visual redesign in a decade, Liquid Glass, and the reaction from the people who love the Mac most was disbelief. John Gruber wrote that the Mac of ten years ago looked remarkably better than Tahoe at its best, and that in ordinary use whole menus and window titles can render illegible.1 Six Colors found the new toolbars “lifeless” on the Mac, flat grey ovals over featureless white.2 TechRadar, initially charmed, came back months later to say the design was far worse than they’d first thought.3 The rumor mill now expects macOS 27 to walk parts of it back.4
The interesting thing is not that Apple made a design mistake. Everyone does. It is that when the most centrally controlled desktop on earth gets worse, its users have no recourse but to wait. Apple’s own launch copy celebrated “more personalization” on the Mac: tinted icons and colored folders.5 That is the ceiling of customization on a $3,000 machine. You may choose the color of the folder. You may not choose the window manager, the compositor, the shell, the panel, or whether your menu bar is transparent.
Meanwhile, on the other side of the fence, an entire culture has grown up around the opposite premise. KDE Plasma 6.6 shipped in February 2026 with OCR in screenshots and per-window recording exclusion, and its community raised over $400,000 in a single fundraiser; tiling compositors like Hyprland have turned desktop configuration into a craft with its own aesthetics and its own forums.6 Linux lets a person change the desktop environment, the display server, the window manager, the shell, the theme engine, the compositor — and a distribution can be an immutable workstation or a gaming console from the same base.7 People do this not because they are hobbyists but because a computer you cannot shape is a computer that is not really yours.
[001.2] THE WRONG DIRECTION
The current answer to “how does AI meet the desktop?” is to bolt a model onto your local machine and let it look. Microsoft Recall was the purest form of it: a screenshot of your screen every five seconds, indexed and searchable, so the AI could remember what you saw. Security researchers called it a privacy nightmare and a keylogger with better branding; Signal’s Meredith Whittaker called it a dangerous honeypot for hackers; the UK data regulator opened an inquiry within two days; Microsoft pulled it, then relaunched it as opt-in with the sharpest edges filed off.8910
The AI browsers tried the same move one layer up: put the agent in the window you already use and let it act for you. OpenAI’s ChatGPT Atlas launched in October 2025 to a splashy demo and stopped working as a browser on August 9, 2026 — ten months. Google folded Project Mariner into a Chrome feature in May.11 Along the way the security story got ugly: an independent test found Atlas blocked roughly six percent of the malicious pages thrown at it, a number that tells you how new and unsolved the prompt-injection attack surface is when an agent can see and act on everything you can.12
The pattern is consistent. Every design that has the AI watch the human’s computer inherits the human’s entire attack surface, the human’s entire privacy exposure, and a trust problem it cannot engineer away, because the whole premise is surveillance of a machine you consider private.
[001.3] THE INVERSION
When OpenAI and Anthropic needed to give an AI a computer, neither of them gave it yours.
ChatGPT agent, in OpenAI’s own words, does its work “using its own virtual computer” — a browser, a terminal, a filesystem, all inside a sandbox the model inhabits and the user can watch, interrupt, or take over.13 Anthropic’s computer use ships a reference environment that is, precisely, a Linux desktop in a container: a virtual X display, a lightweight window manager, a panel, Firefox and LibreOffice preinstalled, driven by the model through screenshots and clicks.14 The agent’s computer is a disposable cloud Linux box that it lives inside. That is the architecture the smartest people in the field chose when the safety and the capability both mattered.
Our claim is simply that this should be true for the human, too. Not an AI grafted onto the laptop under your fingers, but a computer that lives where the AI lives — a real Linux machine in the cloud, rendered in your browser, that the model inhabits natively. The AI does not need to record your desktop, because your desktop is the sandbox, and the sandbox is transparent by construction.
This is not a thought experiment. The pieces exist. Kasm streams containerized Linux desktops to a plain browser tab with no client install; linuxserver’s Webtop puts a full Linux desktop in a browser from one Docker command; daedalOS is a complete desktop environment written for the browser.15 Our own sandbox work at Tenki gives every visitor an isolated 16-core, 64 GB Ubuntu machine cloned from a golden snapshot in seconds, with agent CLIs and a code editor preinstalled, driven from a desktop-style front end — the SandboxEverything OS that AgentCamp OS grows out of.16 Nothing here is speculative. It is an assembly.
[001.4] LINUX IN THE BROWSER
Linux because it is the only desktop you can actually shape — and because it is already the native habitat of every agent toolchain: the CLIs, the sandboxes, the runners, the containers. A cloud Linux desktop can be snapshotted, cloned, forked, shared as a link, and destroyed, in ways a laptop never can. Your environment becomes a file you own.
The browser because, as of late 2025, it is finally a full computer. WebGPU shipped across Chrome, Edge, Firefox and Safari 26 in November 2025,17 which means the tab can run real models locally: speech recognition, speech synthesis, hand tracking, even small language models — without a byte leaving the device. The browser is the one operating system every human already has, on every screen they own, with a security model built for untrusted code. It is the right host for a desktop precisely because it was never designed to trust anyone.
So the shape of the thing is: a Linux machine in the cloud that does the heavy work and holds your environment, a browser on any device that renders it and runs the private, local, real-time layer — your voice, your hands, your log — and an AI that lives in the machine, not in your laptop.
[001.5] VOICE
Voice on the desktop has failed for twenty years because it was a dictation feature pretending to be an interface. It works now for one reason: the model on the other end can act. Say “open the terminal next to the browser and run the tests,” and the model does not transcribe it — it calls tools: open a window, place it, run a command in the sandbox, read the output back. The desktop exposes its window manager and its machine as a tool surface; the voice is just the fastest way to reach it.
Two ways to build the pipe, and we use both:
private path · everything local except the model call · the model sees only what you said and what the tools returned
The private path runs OpenAI’s Whisper entirely in the browser through Transformers.js and ONNX Runtime Web — a quantized whisper-base is around 40 MB, cached after the first load, and works offline.18 Kokoro-82M runs neural text-to-speech the same way on a consumer GPU.19 The fast path uses a speech-to-speech model over WebRTC — OpenAI’s Realtime API and Google’s Gemini Live both connect natively from a browser, land in the 300–600 ms range end to end, support tool calling and MCP, and let you interrupt the model mid-sentence.20 We do not use the browser’s built-in speech recognition as the default, and we say why: in Chrome it streams your audio to Google, in Edge to Azure, Firefox hides it behind a flag, and only Safari can do it on-device.21 The user should always know which path their voice is on. In our desktop, they do — it is in the log.
[001.6] HANDS
Apple settled the interaction model for hands with Vision Pro: look at a thing, pinch to act on it, move your hand to drag it — no controller, no cursor, and, in Apple’s own WebKit implementation, the pinch is the whole gesture vocabulary.22 You do not need a $3,500 headset for that. You need a webcam.
entirely on-device · the webcam feed never leaves the browser · a visible hand cursor shows exactly what the system thinks you are doing
Google’s MediaPipe hand tracker runs in the browser from a CDN import and returns 21 three-dimensional landmarks per hand in real time; pinch detection is a distance check between landmark 4 and landmark 8, and its Gesture Recognizer ships pre-trained poses like open palm and closed fist for free.23 A gesture layer sitting above the window manager turns that into the same pointer events a mouse would send, so every window, every button, every drag already works. The camera is a private, local input device exactly like the microphone — and like the microphone, it appears in the log the moment it is on.
[001.7] THE LOG
You should never have to wonder what the AI did. You should be able to read it.
Every action in the sandbox — every window the model opened, every command it ran, every file it touched, every voice request, every gesture the camera resolved, every tool call and its result, every moment a microphone or camera was live — is written to one log. Not a debug file. A window on the desktop, open by default, readable by a human, exportable in one click. Entries are hash-chained so the log cannot be quietly edited after the fact.
This is no longer just a value. From August 2, 2026 the EU AI Act’s transparency obligations are enforceable: people must know when they are dealing with an AI, deployers must keep records of what agentic systems did, and Article 13 asks that anyone affected can see why an action was allowed or denied.24 The compliance industry is now selling hash-chained audit trails to bolt onto agents that were never designed to be seen.25 We think the right response is to design the desktop so that transparency is not an audit product but the default view. The log is the UI.
[001.8] SELF-DESTRUCT
Transparency without control is a confession, not a right. So the desktop carries one more first-class control, and it is not buried in settings: self-destruct. Press it and everything the system collected is gone — the log, the sandbox machine and its snapshots, voice transcripts, gesture data, cached models, session keys, the account’s trace on the server. Irreversible, verified, and confirmed back to you with a count that reads zero.
That is the direct opposite of the watching-AI model, where your history accumulates by default and deletion is a support ticket. Here the machine is disposable by design — it was cloned from a snapshot in seconds and it can be destroyed in seconds — so the promise costs nothing to keep. You can always see everything we know. You can always make it nothing.
| the watching AI | the desktop inside the AI | |
|---|---|---|
| where the computer is | your laptop, watched | a cloud Linux machine you own the snapshot of |
| what the AI sees | your whole screen, always | the sandbox, and only what the log shows |
| customization | icon tints | the window manager, the shell, all of it |
| voice & hands | dictation, a novelty | native input that calls tools, on-device |
| your data | accumulates by default | logged in the open, destroyed on demand |
[001.9] WHAT WE ARE BUILDING
AgentCamp OS is this desktop: a Linux machine in the cloud, in your browser, built on the same per-visitor sandboxes we run for hackathons and workshops, with a desktop shell you can theme and rearrange, voice and hand input as native devices, a Log window open by default, and a self-destruct that works. It is open source, it speaks MCP so your own agents can operate it the way you do, and it is where the AgentCamp community will build, learn, and demo — because the best way to argue for a new kind of computer is to hand people one.
The computer is the agent. Agents are computers. That is the whole log, and everything that follows is the build.
This is Log 001. The log will keep going, in public, entry by entry, as we build. If you think we’re wrong, the argument is open — and if you think we’re right, come build it with us.
Kept only in your browser’s local storage for this page. Nothing here is sent anywhere. That is the whole point — and so is the button.
SOURCES