Dive into Claude Code: The Design Space of Today's and Future AI Agent Systems

• URL: http://arxiv.org/abs/2604.14228v1
• Date: Tue, 14 Apr 2026 17:59:37 GMT
• Title: Dive into Claude Code: The Design Space of Today's and Future AI Agent Systems
• Abstract summary: Claude Code is an agentic coding tool that can run shell commands, edit files, and call external services on behalf of the user.<n>This study describes its comprehensive architecture by analyzing the publicly available TypeScript source code.
• Score: 42.345465506597044
• License: http://creativecommons.org/licenses/by-nc-sa/4.0/
• Abstract: Claude Code is an agentic coding tool that can run shell commands, edit files, and call external services on behalf of the user. This study describes its comprehensive architecture by analyzing the publicly available TypeScript source code and further comparing it with OpenClaw, an independent open-source AI agent system that answers many of the same design questions from a different deployment context. Our analysis identifies five human values, philosophies, and needs that motivate the architecture (human decision authority, safety and security, reliable execution, capability amplification, and contextual adaptability) and traces them through thirteen design principles to specific implementation choices. The core of the system is a simple while-loop that calls the model, runs tools, and repeats. Most of the code, however, lives in the systems around this loop: a permission system with seven modes and an ML-based classifier, a five-layer compaction pipeline for context management, four extensibility mechanisms (MCP, plugins, skills, and hooks), a subagent delegation mechanism with worktree isolation, and append-oriented session storage. A comparison with OpenClaw, a multi-channel personal assistant gateway, shows that the same recurring design questions produce different architectural answers when the deployment context changes: from per-action safety classification to perimeter-level access control, from a single CLI loop to an embedded runtime within a gateway control plane, and from context-window extensions to gateway-wide capability registration. We finally identify six open design directions for future agent systems, grounded in recent empirical, architectural, and policy literature.

Related papers

• Syll: Open-Source Personal Automation with Cross-Surface Execution [73.77463150026068]
  We present Syll, an open-source, self-hosted multimodal agent harness.<n>Syll unifies MCP/API tools, CLI execution, and visual control in a modular runtime.<n>Our implementation has been validated on production desktop applications including Adobe Photoshop, Adobe Audition, Stardew Valley, Finder.
  arXiv  Detail & Related papers  (2026-05-28T17:59:31Z)
• Code as Agent Harness [107.31925305395957]
  In emerging agentic systems, code is no longer only a target output.<n>Code increasingly serves as an operational substrate for agent reasoning, acting, environment modeling, and execution-based verification.<n>This survey provides a unified roadmap toward executable, verifiable, and stateful AI agent systems.
  arXiv  Detail & Related papers  (2026-05-18T17:59:03Z)
• AgentWard: A Lifecycle Security Architecture for Autonomous AI Agents [16.761926457126428]
  This paper presents AgentWard, a lifecycle-oriented, defense-in-depth architecture that systematically organizes protection across five stages.<n>AgentWard integrates stage-specific, heterogeneous controls with cross-layer coordination, enabling threats to be intercepted along their propagation paths while safeguarding critical assets.
  arXiv  Detail & Related papers  (2026-04-27T16:22:27Z)
• Sema Code: Decoupling AI Coding Agents into Programmable, Embeddable Infrastructure [17.924525595609833]
  We present Sema, an open AI coding framework built on the principle of being embeddable pluggable, and frameworkfirst.<n>Sema decouples the core agent engine from all client layers, it as a standalone npm library that any runtime can drive.<n>Sema powers a VSCode extension and a multi-channel messaging gateway, which we name SemaClaw, to unify agent interactions across platforms such as Telegram and Feishu.
  arXiv  Detail & Related papers  (2026-04-13T06:20:11Z)
• A Systematic Taxonomy of Security Vulnerabilities in the OpenClaw AI Agent Framework [9.723337441030283]
  Vulnerabilities cluster along two axes: (1) the system axis, reflecting the architectural layer (exec policy, gateway, channel, sandbox, browser, plugin, agent/prompt); and (2) the attack axis, reflecting adversarial techniques (identity spoofing, policy bypass, cross-layer composition, prompt injection, supply-chain escalation).<n>We present a systematic taxonomy of 190 advisories filed against OpenClaw, an open-source AI agent runtime, organized by architectural layer and trust-violation type.
  arXiv  Detail & Related papers  (2026-03-29T04:51:27Z)
• Interpretable Context Methodology: Folder Structure as Agentic Architecture [0.0]
  Current approaches to AI agent orchestration typically involve building multi-agent frameworks that manage context passing, memory, error handling, and step coordination through code.<n>This paper presents Model Workspace Protocol (MWP), a method that replaces framework-level orchestration with structure.<n>Plain markdown files carry the prompts and context that tell a single AI agent what role to play at each step. Local scripts handle the mechanical work that does not need AI at all.
  arXiv  Detail & Related papers  (2026-03-17T00:03:23Z)
• Just Ask: Curious Code Agents Reveal System Prompts in Frontier LLMs [65.6660735371212]
  We present textbftextscJustAsk, a framework that autonomously discovers effective extraction strategies through interaction alone.<n>It formulates extraction as an online exploration problem, using Upper Confidence Bound--based strategy selection and a hierarchical skill space spanning atomic probes and high-level orchestration.<n>Our results expose system prompts as a critical yet largely unprotected attack surface in modern agent systems.
  arXiv  Detail & Related papers  (2026-01-29T03:53:25Z)
• AJAR: Adaptive Jailbreak Architecture for Red-teaming [1.356919241968803]
  AJAR is a proof-of-concept framework designed to bridge the gap between "red-teaming" and "action security"<n>AJAR decouples adversarial logic from the execution loop, encapsulating state-of-the-art algorithms like X-Teaming as standardized, plug-and-play services.<n> AJAR is open-sourced to facilitate the standardized, environment-aware evaluation of this emerging attack surface.
  arXiv  Detail & Related papers  (2026-01-16T03:30:40Z)
• UniVA: Universal Video Agent towards Open-Source Next-Generation Video Generalist [107.04196084992907]
  We introduce UniVA, an omni-capable multi-agent framework for next-generation video generalists.<n>UniVA employs a Plan-and-Act dual-agent architecture that drives a highly automated and proactive workflow.<n>We also introduce UniVA-Bench, a benchmark suite of multi-step video tasks spanning understanding, editing, segmentation, and generation.
  arXiv  Detail & Related papers  (2025-11-11T17:58:13Z)
• Rethinking Testing for LLM Applications: Characteristics, Challenges, and a Lightweight Interaction Protocol [83.83217247686402]
  Large Language Models (LLMs) have evolved from simple text generators into complex software systems that integrate retrieval augmentation, tool invocation, and multi-turn interactions.<n>Their inherent non-determinism, dynamism, and context dependence pose fundamental challenges for quality assurance.<n>This paper decomposes LLM applications into a three-layer architecture: textbftextitSystem Shell Layer, textbftextitPrompt Orchestration Layer, and textbftextitLLM Inference Core.
  arXiv  Detail & Related papers  (2025-08-28T13:00:28Z)
• Cognitive Kernel: An Open-source Agent System towards Generalist Autopilots [54.55088169443828]
  We introduce Cognitive Kernel, an open-source agent system towards the goal of generalist autopilots.<n>Unlike copilot systems, which primarily rely on users to provide essential state information, autopilot systems must complete tasks independently.<n>To achieve this, an autopilot system should be capable of understanding user intents, actively gathering necessary information from various real-world sources, and making wise decisions.
  arXiv  Detail & Related papers  (2024-09-16T13:39:05Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.