In CodeRabbit’s latest episode of The Merge, I sat down with Francesco Bonacci, CEO and co-founder of Cua AI, which builds tools and environments that let AI agents operate computers. We talked about how his team tests those tools and checks whether agents can use them to complete an assignment.
A test can establish that an agent’s click reaches the intended button. It cannot, by itself, establish that the agent chose the right button or finished the job. Cua’s engineering team tests whether computer controls work, whether agents complete their assignments, and whether the software grading those assignments scores them correctly.
Bonacci described the challenge of catching regressions in computer control across different operating environments. The release pace adds pressure. As he put it, “we pushed out 21 minor releases in one month and a half.” Cua’s technical write-up explains that its test applications independently observe whether an action produces the expected change. The test must confirm what happened in the application, even when the tool reports success.
Check the work the agent leaves behind #
To check whether an agent completed an assignment, the team uses Cua-Bench. In Cua’s separate AI Engineer World’s Fair presentation, CTO Dillon DuPont explains that each task has a known starting state, a reference solution, and an evaluator. The evaluator is software that examines files or application state to determine whether the agent succeeded.
Bonacci discussed one example from Cua’s work with Snorkel. The companies built a benchmark using KiCad, an application for designing electrical circuits. The assignments require agents to place components in circuit diagrams, connect them, and edit their properties.
Even basic interactions remain difficult. Speaking about dragging and scrolling, Bonacci said, “that stuff is actually hard for agents even today.” An agent working in KiCad also has to understand the circuit assignment. Successfully moving a component represents progress, but the circuit may still be incomplete. Cua’s evaluators inspect the saved circuit’s components and connections and compare them with a reference to grade the work.
In its June evaluation, Cua tested seven models on 25 KiCad tasks. Each model had up to 200 interaction steps to complete each task. The model with the most completed assignments finished six out of 25. Cua reported that some attempts made reasonable progress but ran out of steps before finishing.
Test the software doing the grading #
Those scores depend on the grading software recognizing success and failure correctly. A faulty rule could give full credit to work that fails the assignment.
Cua checks for that possibility through its evaluator-review process before publishing an evaluation environment. For selected tasks, one agent attempts to follow the assignment, while another tries to earn credit by deliberately violating it. The evaluator should reward the correct attempt and penalize the other. A reviewer examines both recorded attempts and produces findings with evidence and proposed fixes.
For developers, this means deciding what evidence will count as completion and reviewing the code used to produce and check that result. When a coding agent writes the software, CodeRabbit’s CLI skills let that agent request a code review, apply fixes, and request another pass. Task evaluations then test whether the software enables an agent to complete the user’s assignment. Review also needs to cover what an agent can access. Bonacci described using isolated environments to keep agents from taking over a user’s computer and to help protect sensitive data. Changes to an agent’s tools can affect those protections.
CodeRabbit’s Security Architecture Review examines how proposed changes affect permissions, sensitive operations, and data flows. The assessment is available for pull requests with security coverage and enough relevant evidence, and complements security testing and human review.
In his own work, Bonacci describes planning during the day and leaving agents running overnight. He wants to hand over more tasks, comfortable that the work won’t leave him with “a problem for me to fix later on.”