Each Dot is a 4 GB virtual machine, not a browser tab
Invisible Dots gives every agent a QEMU virtual machine with a Linux desktop, shell, files, persistent disk, memory notes, skills, and browser profiles. The sample configuration assigns 4 GB of memory and a 40 GB copy-on-write disk to one running Dot. When work arrives, the control plane wakes that machine, delivers the task, and lets it sleep again after an idle period.
That design buys separation and continuity at a visible cost. Our checkout contained 877 files, about 132,504 lines of source, and occupied 13.6 MB before installation. The host still has to store a golden Ubuntu image, a runtime image, and a growing disk overlay for every Dot. This is closer to running a small virtual lab than adding an automation library to a Node application.
Setup needs x86-64 virtualization and 20 GiB free
The quickstart supports Linux and Windows hosts with hardware virtualization enabled. It calls for Node 24 or newer, Go 1.25 or newer, Git, QEMU 8.2 or newer, at least 20 GiB of free space, and an OpenRouter key. macOS is excluded. A path containing non-ASCII characters or a comma also needs an alternate INVISIBLE_DOTS_HOME, an unusually specific but useful warning.
After the CLI build, setup --all builds the guest daemon, installs or checks QEMU, enables KVM or Windows Hypervisor Platform, builds the web client, and obtains the VM images. Our npm install took 13 seconds, pulled 686 packages, and occupied 608 MB. The repository has no Dockerfile because the runtime unit is a hardware-accelerated VM; Docker appears only in development smoke tests.
What happened when we ran it
Our sandbox built commit 7f2c17e in 40 seconds after the 13-second install. Vitest then ran for 131 seconds and exited with code 1. It reported 2,102 passing tests, 1 failure, and 3 skipped tests out of 2,106. The suite spread work across 150 test files, of which 149 passed and 1 failed.
The failing file was apps/cli/test/secret-input.test.ts, with 1 failure among its 6 tests. The log excerpt does not include the test name or assertion, so it cannot tell us whether the defect affects masking, terminal input, or another behavior in that file. Npm audit found 0 known vulnerabilities. Those results cover the Node workspace, not the real-VM acceptance run, which the guide says is manual and requires KVM plus an OpenRouter key.
Permission prompts do not isolate every guest secret
Every tool maps to allow, ask, or deny. Pending approvals survive restarts, and an approved call runs at most once. The host API uses a bearer token, while the web interface stays on a loopback address the guest cannot reach. Inside the VM, the model's commands run as a separate user that cannot read the agent engine's token or approve its own tool calls.
The guide also names the gaps. A model command can read the credentials of a browser identity proxy from that browser's environment and session file. Each Dot can reach services on the host's loopback through 10.0.2.2, so other unauthenticated host services remain a concern. No limit stops a command from consuming all CPU, memory, or disk assigned to its VM. Our 8 GB sandbox did not start a Dot or test those boundaries.
The patched browser reduces fingerprints but cannot promise access
Each identity uses a separate Firefox profile with persistent cookies, logins, and a fingerprint applied inside a patched browser engine. Browser actions arrive through an MCP client, and identities may use their own proxies. The main repository calls the system undetectable, but its guide narrows that claim: bot-check measurements live in the separate invisible Playwright project, and a site can still refuse an agent for its behavior.
We did not run anti-bot suites, browse authenticated sites, or compare fingerprints. The 2,102 passing Vitest cases are not evidence that a retailer, bank, or social network will accept this browser. Terms still apply, as the project disclaimer says. The optional WhatsApp path is even clearer: it uses an unofficial client, and the guide warns that automation can get the account restricted or banned.
Alpha means no backups, quotas, or multi-host control
The status page lists snapshots, rollback, backups, quotas, network policies, multiple hosts, organizations, roles, macOS, and MCP integrations beyond the browser as unavailable. The web screen is a read-only series of pictures rather than an interactive remote desktop. A Dot also has no web-search tool, fetch tool, or sub-agents; it reaches pages through its browser and runs one persistent conversation.
Those omissions matter more than the 40-second build. Persistent disks and durable queues reduce accidental loss during a crash, but they do not replace a backup you can restore. Per-task cost limits help with model spend, while the missing compute quotas leave the VM itself exposed to runaway work. Start with a disposable identity and data you can recreate.
October activity is fresh, but the release is only an image
GitHub showed 31,811 stars, no open issues or pull requests, and a last push on October 8, 2026. The latest release, published October 7, is named golden-b326f2a1d4fe; it contains Ubuntu 24.04 and pinned guest software for the image builder. The guide is explicit that no application package or hosted service exists yet. Users clone and build the rest on their own machine.
Invisible Dots has unusually candid documentation for an alpha system, and our run got 2,102 tests over the line. The remaining failed secret-input test, manual real-VM acceptance, and absent recovery controls keep it in the evaluation lab. Its VM-per-agent model is the reason to try it and the reason many developers should choose a narrower browser tool instead.