Agent libOS: A Library-OS-Inspired Runtime for Long-Running, Capability-Controlled LLM Agents

• URL: http://arxiv.org/abs/2606.03895v1
• Date: Tue, 02 Jun 2026 16:53:24 GMT
• Title: Agent libOS: A Library-OS-Inspired Runtime for Long-Running, Capability-Controlled LLM Agents
• Abstract summary: Large language model (LLM) agents are evolving from request-response assistants into long-running software actors.<n>This paper presents Agent libOS, a library-OS-inspired runtime substrate for LLM agents.
• Score: 0.6345523830122165
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Large language model (LLM) agents are evolving from request-response assistants into long-running software actors: they maintain state across model calls, fork subtasks, wait for external events, request human authority, generate tools, and perform side effects that must be resumed and audited. This paper presents Agent libOS, a library-OS-inspired runtime substrate for LLM agents. Agent libOS runs above a conventional host operating system; it does not implement hardware drivers, kernel-mode isolation, or a POSIX-compatible operating system. Instead, it treats an agent as an AgentProcess: a schedulable execution subject with process identity, parent-child lineage, lifecycle state, a tool table derived from an AgentImage, typed Object Memory, explicit capabilities, human queues, checkpoints, events, and audit records. Its central design rule is tools are libc-like wrappers; runtime primitives are the authority boundary. Filesystem access, object access, sleeps, human approval, JIT tool registration, and external side effects are checked at primitive boundaries under explicit capabilities and policy. We describe the design, threat model, Python prototype, and safety-oriented evaluation. The current prototype implements async scheduling, namespace-local Object Memory, runtime-integrated human approval, one-shot permission grants, per-process working directories, shell and image-registration primitives, Deno/TypeScript JIT tools over a libOS syscall broker, filesystem/object bridge tools, an injectable Resource Provider Substrate, deterministic demos, real-model smoke scripts, and 123 regression tests at the time of writing. Rather than improving planner accuracy, Agent libOS demonstrates a runtime substrate in which long-running LLM agents can be scheduled, authorized, resumed, and audited without treating tool dispatch as the trust boundary.

Related papers

• PhyAgentOS: A Self-Evolving Operating System for Embodied Agents with Decoupled Cognitive Planning and Physical Execution [49.776611937968]
  We present PhyAgentOS, a foundation delivering scheduling, verification, memory, benchmarking, and safety as system-level services.<n>Its Session-Centered treats a session, not an action, as the minimum unit of scheduling, compatibility, supervised execution, evidence collection, and acceptance.<n>SessionVerifier distinguishes execution termination from semantic task completion via evidence-grounded verdicts of success, failure, or replan.<n> Benchmarking reuses the deployment session and verification path, so results trace to real execution.
  arXiv  Detail & Related papers  (2026-07-18T04:46:53Z)
• AgenticOS: An Intent-Oriented Secure Operating System Architecture for Autonomous AI Agents [9.964434409587222]
  AgenticOS is an intent-oriented secure OS architecture.<n>AgenticOS consolidates delegable, auditable software capabilities into OS-native ones.
  arXiv  Detail & Related papers  (2026-06-19T06:14:37Z)
• Syll: Open-Source Personal Automation with Cross-Surface Execution [73.77463150026068]
  We present Syll, an open-source, self-hosted multimodal agent harness.<n>Syll unifies MCP/API tools, CLI execution, and visual control in a modular runtime.<n>Our implementation has been validated on production desktop applications including Adobe Photoshop, Adobe Audition, Stardew Valley, Finder.
  arXiv  Detail & Related papers  (2026-05-28T17:59:31Z)
• AgentHijack: Benchmarking Computer Use Agent Robustness to Common Environment Corruptions [78.49000936275773]
  We introduce AgentHijack, a benchmark designed to evaluate the robustness of computer-use agents under common corruptions.<n>We evaluate a variety of desktop tasks that utilize MLLM-based agents and discover that even minor instances of corruption can result in substantial performance degradation.<n>We propose AgentHijack-Agent, a framework that integrates an action generator with enhanced grounding capabilities and an onlooker responsible for behavior summarization and environment checking.
  arXiv  Detail & Related papers  (2026-05-25T11:09:22Z)
• Securing LLM Agents Need Intent-to-Execution Integrity [49.490963596514185]
  We argue that securing LLM agents requires defining an end-to-end correctness property that specifies when an agent's execution faithfully reflects the user's intent.<n>We observe that LLM agents are structurally analogous to compilers, where security violations correspond to mis-executions that do not preserve user intent.<n>We derive four integrity properties that must hold simultaneously: emphTool Integrity, emphInstruction Integrity, emphJudgment Integrity, and emphData Flow Integrity.
  arXiv  Detail & Related papers  (2026-05-16T12:53:31Z)
• Cochise: A Reference Harness for Autonomous Penetration Testing [1.3124479769761592]
  We present cochise, a 597 LOC Python reference harness for autonomous penetration-testing.<n>Cochise connects an LLM-driven agent to a Linux host over SSH and supports controlled target environments.<n>We release replay and analysis tools: (i) cochise-replay for offline visualization of captured runs, (ii) cochise-analyzelogs and cochise-analyze-a-graphs for cost, token duration, and compromise analysis.
  arXiv  Detail & Related papers  (2026-05-12T07:28:12Z)
• AgentWall: A Runtime Safety Layer for Local AI Agents [0.0]
  AgentWall is a runtime safety and observability layer for local AI agents.<n>It intercepts every proposed agent action before it reaches the host environment, evaluates it against an explicit declarative policy, requires human approval for sensitive operations, and records a complete execution trail for audit and replay.<n>We present the design, architecture, threat model, and policy model of AgentWall, and demonstrate 92.9% policy enforcement accuracy with sub-millisecond overhead across 14 benchmark tests.
  arXiv  Detail & Related papers  (2026-03-24T11:39:35Z)
• Agent Audit: A Security Analysis System for LLM Agent Applications [8.09697219899781]
  Agent Audit is a security analysis system for LLM agent applications.<n>It analyzes Python agent code and deployment artifacts through an agent-aware pipeline.<n>It detects 40 vulnerabilities with 6 false positives, substantially improving recall over common SAST baselines.
  arXiv  Detail & Related papers  (2026-03-24T06:44:51Z)
• AgentFactory: A Self-Evolving Framework Through Executable Subagent Accumulation and Reuse [14.413401094877122]
  Recent works on LLM-based agent self-evolution primarily record successful experiences as textual prompts or reflections.<n>We propose AgentFactory, a new self-evolution paradigm that preserves successful task solutions as executable subagent code.<n>Saved subagents are pure Python code with standardized documentation, enabling portability across any Python-capable system.
  arXiv  Detail & Related papers  (2026-03-18T17:58:25Z)
• Quine: Realizing LLM Agents as Native POSIX Processes [0.6700873164609007]
  This paper presents Quine, a runtime architecture and reference implementation that realizes LLM agents as native POSIX processes.<n>The mapping is explicit: identity is PID, interface is standard streams and exit status, state is memory, environment variables, and lifecycle is fork/exec/exit.<n>A reference implementation of Quine is publicly available on GitHub.
  arXiv  Detail & Related papers  (2026-03-08T05:32:46Z)
• DeepAgent: A General Reasoning Agent with Scalable Toolsets [111.6384541877723]
  DeepAgent is an end-to-end deep reasoning agent that performs autonomous thinking, tool discovery, and action execution.<n>To address the challenges of long-horizon interactions, we introduce an autonomous memory folding mechanism that compresses past interactions into structured episodic, working, and tool memories.<n>We develop an end-to-end reinforcement learning strategy, namely ToolPO, that leverages LLM-simulated APIs and applies tool-call advantage attribution to assign fine-grained credit to the tool invocation tokens.
  arXiv  Detail & Related papers  (2025-10-24T16:24:01Z)
• DRIFT: Dynamic Rule-Based Defense with Injection Isolation for Securing LLM Agents [52.92354372596197]
  Large Language Models (LLMs) are increasingly central to agentic systems due to their strong reasoning and planning capabilities.<n>This interaction also introduces the risk of prompt injection attacks, where malicious inputs from external sources can mislead the agent's behavior.<n>We propose a Dynamic Rule-based Isolation Framework for Trustworthy agentic systems, which enforces both control and data-level constraints.
  arXiv  Detail & Related papers  (2025-06-13T05:01:09Z)
• GuardAgent: Safeguard LLM Agents by a Guard Agent via Knowledge-Enabled Reasoning [79.07152553060601]
  We propose GuardAgent, the first guardrail agent to protect target agents by dynamically checking whether their actions satisfy given safety guard requests.<n>Specifically, GuardAgent first analyzes the safety guard requests to generate a task plan, and then maps this plan into guardrail code for execution.<n>We show that GuardAgent effectively moderates the violation actions for different types of agents on two benchmarks with over 98% and 83% guardrail accuracies, respectively.
  arXiv  Detail & Related papers  (2024-06-13T14:49:26Z)
• Agents: An Open-source Framework for Autonomous Language Agents [98.91085725608917]
  We consider language agents as a promising direction towards artificial general intelligence. We release Agents, an open-source library with the goal of opening up these advances to a wider non-specialist audience.
  arXiv  Detail & Related papers  (2023-09-14T17:18:25Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.