Agent Operating Systems (AOS): Integrating Agentic Control Planes into, and Beyond, Traditional Operating Systems

• URL: http://arxiv.org/abs/2606.01508v1
• Date: Mon, 01 Jun 2026 00:08:03 GMT
• Title: Agent Operating Systems (AOS): Integrating Agentic Control Planes into, and Beyond, Traditional Operating Systems
• Abstract summary: This paper introduces the concept of an Agent Operating System (AOS), a systems architecture that integrates an agentic control plane into existing operating systems.<n>We provide a precise definition of an AOS, explicit assumptions and non-goals, and a structured decomposition of AOS responsibilities into schedulers, context and memory management, tool and capability registries, policy and trust enforcement, and observability and audit.<n>We present security and safety implications, including agent specific threat models, and define evaluation criteria that emphasize deterministic enforcement, auditability, and operator comprehensibility.
• Score: 0.04756202129182093
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Traditional operating systems were designed around deterministic programs, explicit control flow, and human initiated workflows. Their core abstractions processes, threads, system calls, files, and permissions assume bounded behavior and predictable interaction patterns. Agentic AI systems introduce a different execution model: long-lived, goal-directed entities that reason probabilistically, invoke tools dynamically, and adapt behavior based on feedback. While agents can be implemented as user-space applications today, their execution characteristics stress OS boundaries in scheduling, memory and state management, security, observability, and governance. This paper introduces the concept of an Agent Operating System (AOS), a systems architecture that integrates an agentic control plane into existing operating systems or, in some models, subsumes selected OS responsibilities over time. We provide a precise definition of an AOS, explicit assumptions and non-goals, and a structured decomposition of AOS responsibilities into schedulers, context and memory management, tool and capability registries, policy and trust enforcement, and observability and audit. We analyze limitations of classical OS abstractions for agent workloads, propose integration models from user-space runtimes to distributed control planes, and map AOS concepts onto Linux and Windows primitives. We present security and safety implications, including agent specific threat models, and define evaluation criteria that emphasize deterministic enforcement, auditability, and operator comprehensibility. The objective is not to replace operating systems wholesale, but to establish a rigorous systems foundation for agentic computation that remains controllable, accountable, and secure at scale.

Related papers

• Formal Verification of Agentic Systems over Operational Data [59.98246281888422]
  Agentic systems driven by large language models (LLMs) are increasingly deployed in real-world where they act on persistent operational data.<n>Existing approaches do not provide such system-level guarantees.<n>We study here the verification of agentic systems comprising a single LLM and a tool orchestration harness over relational operational data.
  arXiv  Detail & Related papers  (2026-08-04T13:01:30Z)
• The Agent Operating System (AOS): A Reference Operating Architecture for Distributed Agentic Systems [0.04756202129182093]
  This paper proposes the Agent Operating System (AOS), a vendor-neutral reference operating architecture for distributed agentic systems.<n>AOS is not presented as a replacement for existing frameworks or infrastructure; it is proposed as the operating architecture through which heterogeneous components can be composed into governable reliable, observable, and interoperable agentic systems.
  arXiv  Detail & Related papers  (2026-08-04T06:50:49Z)
• PhyAgentOS: A Self-Evolving Operating System for Embodied Agents with Decoupled Cognitive Planning and Physical Execution [49.776611937968]
  We present PhyAgentOS, a foundation delivering scheduling, verification, memory, benchmarking, and safety as system-level services.<n>Its Session-Centered treats a session, not an action, as the minimum unit of scheduling, compatibility, supervised execution, evidence collection, and acceptance.<n>SessionVerifier distinguishes execution termination from semantic task completion via evidence-grounded verdicts of success, failure, or replan.<n> Benchmarking reuses the deployment session and verification path, so results trace to real execution.
  arXiv  Detail & Related papers  (2026-07-18T04:46:53Z)
• AgenticOS: An Intent-Oriented Secure Operating System Architecture for Autonomous AI Agents [9.964434409587222]
  AgenticOS is an intent-oriented secure OS architecture.<n>AgenticOS consolidates delegable, auditable software capabilities into OS-native ones.
  arXiv  Detail & Related papers  (2026-06-19T06:14:37Z)
• Large Language Models for Agentic NetOps and AIOps: Architectures, Evaluation, and Safety [14.195825134031795]
  Large language models are increasingly being used to support network operations (NetOps) and artificial intelligence for IT operations (AIOps)<n>In both NetOps and AIOps, this shift is changing how tasks are managed.<n>Agent-based operations work as managed, from gathering evidence to taking action, following permissions, policies, and checks, and providing rollback options when necessary.
  arXiv  Detail & Related papers  (2026-05-12T20:31:41Z)
• Clawed and Dangerous: Can We Trust Open Agentic Systems? [12.04979073308511]
  Open agentic systems combine planning with external capabilities, persistent memory, and privileged execution.<n>This paper introduces a six-dimensional analytical taxonomy and synthesizes 50 papers spanning attacks, benchmarks, defenses, audits, and adjacent engineering foundations.<n>Our review shows that the literature is relatively mature in attack characterization and benchmark construction, but remains weak in deployment controls, operational governance, persistent-memory integrity, and capability revocation.
  arXiv  Detail & Related papers  (2026-03-27T09:45:12Z)
• Security Considerations for Artificial Intelligence Agents [7.055090485438426]
  This article details Perplexity's observations and recommendations concerning the security of frontier AI agents.<n>We map attack surfaces across tools, connectors, hosting boundaries, and multi-agent coordination.<n>We identify standards and research gaps, guidance for secure multi-agent system design aligned with NIST risk management principles.
  arXiv  Detail & Related papers  (2026-03-12T17:49:39Z)
• Autonomous Action Runtime Management(AARM):A System Specification for Securing AI-Driven Actions at Runtime [0.0]
  This paper introduces Autonomous Action Management (AARM), an open specification for securing AI-driven actions at runtime.<n>AARM intercepts actions before execution, accumulates session context, evaluates against policy and intent alignment, enforces authorization decisions, and records tamper-evident receipts for forensic reconstruction.<n>AARM is model-agnostic, framework-agnostic, and vendor-neutral, treating action execution as the stable security boundary.
  arXiv  Detail & Related papers  (2026-02-10T05:57:30Z)
• Just Ask: Curious Code Agents Reveal System Prompts in Frontier LLMs [65.6660735371212]
  We present textbftextscJustAsk, a framework that autonomously discovers effective extraction strategies through interaction alone.<n>It formulates extraction as an online exploration problem, using Upper Confidence Bound--based strategy selection and a hierarchical skill space spanning atomic probes and high-level orchestration.<n>Our results expose system prompts as a critical yet largely unprotected attack surface in modern agent systems.
  arXiv  Detail & Related papers  (2026-01-29T03:53:25Z)
• CaMeLs Can Use Computers Too: System-level Security for Computer Use Agents [60.98294016925157]
  AI agents are vulnerable to prompt injection attacks, where malicious content hijacks agent behavior to steal credentials or cause financial loss.<n>We introduce Single-Shot Planning for CUAs, where a trusted planner generates a complete execution graph with conditional branches before any observation of potentially malicious content.<n>Although this architectural isolation successfully prevents instruction injections, we show that additional measures are needed to prevent Branch Steering attacks.
  arXiv  Detail & Related papers  (2026-01-14T23:06:35Z)
• Architecting AgentOps Needs CHANGE [0.0]
  We argue that architecting Agentic AI systems requires a shift from managing control loops to enabling dynamic co-evolution among agents, infrastructure, and human oversight.<n>We introduce a conceptual framework comprising six capabilities for operationalizing Agentic AI systems: Contextualize, Harmonize, Anticipate, Negotiate, Generate, and Evolve.
  arXiv  Detail & Related papers  (2026-01-10T06:51:39Z)
• DRIFT: Dynamic Rule-Based Defense with Injection Isolation for Securing LLM Agents [52.92354372596197]
  Large Language Models (LLMs) are increasingly central to agentic systems due to their strong reasoning and planning capabilities.<n>This interaction also introduces the risk of prompt injection attacks, where malicious inputs from external sources can mislead the agent's behavior.<n>We propose a Dynamic Rule-based Isolation Framework for Trustworthy agentic systems, which enforces both control and data-level constraints.
  arXiv  Detail & Related papers  (2025-06-13T05:01:09Z)
• Cognitive Kernel: An Open-source Agent System towards Generalist Autopilots [54.55088169443828]
  We introduce Cognitive Kernel, an open-source agent system towards the goal of generalist autopilots.<n>Unlike copilot systems, which primarily rely on users to provide essential state information, autopilot systems must complete tasks independently.<n>To achieve this, an autopilot system should be capable of understanding user intents, actively gathering necessary information from various real-world sources, and making wise decisions.
  arXiv  Detail & Related papers  (2024-09-16T13:39:05Z)
• Towards an Interface Description Template for AI-enabled Systems [77.34726150561087]
  Reuse is a common system architecture approach that seeks to instantiate a system architecture with existing components. There is currently no framework that guides the selection of necessary information to assess their portability to operate in a system different than the one for which the component was originally purposed. We present ongoing work on establishing an interface description template that captures the main information of an AI-enabled component.
  arXiv  Detail & Related papers  (2020-07-13T20:30:26Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.