Agent libOS: A Library-OS-Inspired Runtime for Long-Running, Capability-Controlled LLM Agents
2026-06-02 • Operating Systems
Operating SystemsArtificial IntelligenceCryptography and Security
AI summaryⓘ
The authors present Agent libOS, a special runtime system designed to help large language model (LLM) agents act more like long-running software processes. Instead of just responding to requests, these agents can keep track of their work, manage subtasks, wait for human input, and handle tools safely. Agent libOS runs on top of regular operating systems and carefully controls agent actions like file access or approvals to maintain security and auditability. The authors built a Python prototype showing how agents can be managed, resumed, and checked without blindly trusting the tools they use.
Large Language ModelsAgentRuntimeLibrary Operating SystemProcess ManagementCapabilitiesTool WrappersHuman ApprovalSchedulingAudit
Authors
Yingqi Zhang
Abstract
Large language model (LLM) agents are evolving from request-response assistants into long-running software actors: they maintain state across model calls, fork subtasks, wait for external events, request human authority, generate tools, and perform side effects that must be resumed and audited. This paper presents Agent libOS, a library-OS-inspired runtime substrate for LLM agents. Agent libOS runs above a conventional host operating system; it does not implement hardware drivers, kernel-mode isolation, or a POSIX-compatible operating system. Instead, it treats an agent as an AgentProcess: a schedulable execution subject with process identity, parent-child lineage, lifecycle state, a tool table derived from an AgentImage, typed Object Memory, explicit capabilities, human queues, checkpoints, events, and audit records. Its central design rule is tools are libc-like wrappers; runtime primitives are the authority boundary. Filesystem access, object access, sleeps, human approval, JIT tool registration, and external side effects are checked at primitive boundaries under explicit capabilities and policy. We describe the design, threat model, Python prototype, and safety-oriented evaluation. The current prototype implements async scheduling, namespace-local Object Memory, runtime-integrated human approval, one-shot permission grants, per-process working directories, shell and image-registration primitives, Deno/TypeScript JIT tools over a libOS syscall broker, filesystem/object bridge tools, an injectable Resource Provider Substrate, deterministic demos, real-model smoke scripts, and 123 regression tests at the time of writing. Rather than improving planner accuracy, Agent libOS demonstrates a runtime substrate in which long-running LLM agents can be scheduled, authorized, resumed, and audited without treating tool dispatch as the trust boundary.