Terminal AI agents are increasingly working on developers' primary machines, where a single failed command can cost an evening of recovery. The open-source utility terminal-mac offers an alternative path: on Macs with M-series chips, it boots an isolated virtual macOS, displays it directly in the terminal, and provides the agent with control tools, while the Cua Driver adds interface interaction through the accessibility tree. The fresh release v0.2.0-6, published on November 3, 2026, currently has an early release candidate status, making the advice from the Tips AI channel authors—run agents in a sandbox but keep backups—timely.

What Happened

On November 3, 2026, release v0.2.0-6 of the open-source utility terminal-mac was released, which the repository author positions as an early release candidate. The project (github.com/govijr/terminal-mac, MIT license, approximately 1,136 stars on GitHub) boots a full guest macOS on Apple silicon via Apple Virtualization and displays it directly in the terminal window—supporting Kitty, iTerm2, and Ghostty. The agent interacts with this virtual machine through MCP tools: screenshot, click, type, key, and skill, verifying the result at each step in an observe-act-verify loop. Installation is reduced to a single curl command; on first launch, the macOS image is downloaded from Apple servers, the virtual disk occupies 64 GiB by default, and the requirements are a Mac with an M-chip and macOS 14 or newer. The catalyst for the discussion was a post from the Tips AI channel: its author advises giving terminal agents an isolated sandbox, supplementing it with the open-source computer-use driver Cua Driver, and mentions the tool Lume for launching macOS and Linux VMs.

Context

The question of isolation for terminal agents arises because assistants like Claude Code, Codex, and Cursor execute commands and edit files by default on the machine where they are running. The classic pattern for agent infrastructure is a separate guest system with a limited blast radius: anything the agent breaks or deletes remains inside the virtual machine, while the owner's logins and work sessions are out of its reach. terminal-mac implements this scheme using Apple's own hypervisor, and since the macOS image is downloaded from Apple's servers, the guest environment is close to a familiar desktop. The second element of the setup concerns graphical interface control: in addition to the vision-only approach, where the agent reads screenshots and calculates click coordinates, there is the accessibility tree—a structured representation of interface elements that macOS provides to programs. The post's author considers the second path more promising and mentions Lume for orchestrating multiple environments, which launches macOS and Linux VMs via CLI, HTTP API, and MCP.

Why This Matters for the Industry

For builders, this is a ready-made framework for agent infrastructure: isolation at the hypervisor level reduces the risk that an agent will break the host machine, reach into other sessions, or perform irreversible actions, while terminal-mac specifically covers the macOS scenario within the CLI, where many terminal coding assistants operate today. The thesis about cheap control of native applications via the accessibility tree remains a claim without measurements: if independent checks show token savings and increased reliability compared to screenshots, the pattern may migrate to standard harnesses for agent evals; if not, terminal-mac will remain a niche macOS tool. An important detail for the market: both utilities are distributed under the MIT license, so the "safe sandbox for agents" layer is zeroed out as a barrier to entry, and defensibility does not arise automatically from it—the moat must be built at a higher level: in orchestration, VM templates, and command-line tools.

Why This Matters for Users

For readers, the practical path is short: on a Mac with an M-chip and macOS 14 or newer, the setup deploys in about ten minutes—one curl installer command for terminal-mac, launching the virtual machine with the terminal-mac up command, and waiting for the macOS image to download. After this, an agent—such as Claude Code, Codex, or Cursor—can be pointed to a separate virtual machine with a 64 GiB disk by default: inside the sandbox, there are separate accounts and projects, and experiments with native applications will not affect the main system, even if the agent makes a mistake. Cua Driver is installed with another command and opens up control of the guest interface, so agent workflows can be tested directly on a miniature real desktop. For important data, it is worth keeping backups: the project is young, and the author themselves calls the release early.

What Is Still Unknown / Limitations

The main unconfirmed thesis: the accessibility tree is allegedly cheaper in tokens and more reliable than vision-only work with screenshots; the provided sources contain no quantitative measurements—no token usage, click accuracy, or latency—so this is a hypothesis requiring verification. The maturity of terminal-mac is low: v0.2.0-6 is an early release candidate, the build is self-signed and lacks notarization, there is no command to delete the VM, and version control and rollbacks remain the user's responsibility. Reproducibility is limited to the Apple ecosystem: a Mac with an M-chip, macOS 14 or newer, and a guest image downloaded from Apple are required. Finally, predictions that VM isolation will become a hygiene minimum for agent infrastructure and that the accessibility tree will replace screenshots are trend assessments rather than measured data: comparison results are not present in the sources.

Sources

Author

Look at AI, editorial team