Large language model agents operate with full user control but lack protections
Ring-0 by Default: Agents as Operating Systems (AaOS)
Cryptography and SecurityOperating Systems
Summary
Large language model (LLM) agents can now do many tasks like running programs, reading files, and managing other agents, similar to how operating systems control a computer. The authors studied these agents and found that unlike traditional operating systems, they run with all the rights of the user and lack important security protections. Many security mechanisms found in normal operating systems are missing or weak in LLM agents, which means these agents can be risky to fully trust. The authors tested popular agents and identified key security gaps that need new solutions.
What this means in practice
- •For software security teams: Improve the security posture of AI-powered agents by addressing missing protections like privilege separation and auditing highlighted by this analysis.
- •For devops engineers: Design better monitoring and control systems for LLM agents given their current full-privilege operation and weak task control features.
A position paper. It proposes an approach and reports no results.
Authors
Xiang Li, Aichun Huang, Zuyao Xu, Fasheng Miao, Zheli Liu
Abstract
LLM agents now read and write files, start processes and subagents, fetch network content, load third-party extensions, and save and resume state, which are the responsibilities of an operating system. They gained these functions within about three years, but not the protections that operating systems built over five decades: whatever the model outputs, whether it follows the user, a tool result, or a downloaded skill, runs with the full authority of the host user, in effect at ring 0. Prior work builds an operating system for agents (OS4A); we argue that a deployed agent already is like an operating system (AaOS) and analyze it as one. Taking the mechanisms of standard OS textbooks as a checklist, we map 116 mechanisms in 19 subsystems to their agent counterparts, from product documentation, source code, and the literature, and label each as isomorphic, degraded (function present, protection dependent on the model), missing, mutated, or novel. Only 11 are isomorphic and 65 are missing, most of them protections: privilege separation, resource quotas, transactions, and tamper-proof audit. Existing defenses confine the whole agent or review its extensions and leave this interior unprotected, and by Anderson's reference-monitor criteria (non-bypassable, tamper-proof, verifiable), rules written in the prompt satisfy none. We test the map with thirteen experiments on Claude Code, Codex CLI, and Gemini CLI, covering 25 mechanisms whose enforcement documentation cannot settle: 16 match the analysis, 7 gain a more precise description, and 2 change verdict. Checks sit in single tools, so the shell bypasses them; all three CLIs load forged transcript records on resume; and task control, sub-agent permissions, and model-based monitors are weak. We identify five problems for which no OS defense transfers and derive a prioritized list of open problems from the gaps of the map.