Agent Operating Systems (AOS): Integrating Agentic Control Planes into, and Beyond, Traditional Operating Systems
2026-06-01 • Cryptography and Security
Cryptography and SecurityArtificial Intelligence
AI summaryⓘ
The authors explain that current operating systems are built for straightforward, predictable programs, but new AI agents act differently — they run for a long time, set their own goals, and change their behavior based on feedback. This creates challenges for how operating systems manage things like memory, security, and scheduling. They propose a new system architecture called an Agent Operating System (AOS) that adds special support for these AI agents, either alongside or inside existing operating systems. The paper breaks down what an AOS should do, examines how it fits with current OS designs, and discusses security and auditing needs to keep AI agents controlled and safe.
operating systemagentic AIschedulingmemory managementsecurityobservabilityauditabilitycontrol planetrust enforcementsystem calls
Authors
Ankur Sharma, Deep Shah
Abstract
Traditional operating systems were designed around deterministic programs, explicit control flow, and human initiated workflows. Their core abstractions processes, threads, system calls, files, and permissions assume bounded behavior and predictable interaction patterns. Agentic AI systems introduce a different execution model: long-lived, goal-directed entities that reason probabilistically, invoke tools dynamically, and adapt behavior based on feedback. While agents can be implemented as user-space applications today, their execution characteristics stress OS boundaries in scheduling, memory and state management, security, observability, and governance. This paper introduces the concept of an Agent Operating System (AOS), a systems architecture that integrates an agentic control plane into existing operating systems or, in some models, subsumes selected OS responsibilities over time. We provide a precise definition of an AOS, explicit assumptions and non-goals, and a structured decomposition of AOS responsibilities into schedulers, context and memory management, tool and capability registries, policy and trust enforcement, and observability and audit. We analyze limitations of classical OS abstractions for agent workloads, propose integration models from user-space runtimes to distributed control planes, and map AOS concepts onto Linux and Windows primitives. We present security and safety implications, including agent specific threat models, and define evaluation criteria that emphasize deterministic enforcement, auditability, and operator comprehensibility. The objective is not to replace operating systems wholesale, but to establish a rigorous systems foundation for agentic computation that remains controllable, accountable, and secure at scale.