EnvOS improves testing and auditing of AI agents in changing software environments
EnvOS: Auditing Computer-Use Agents When the World Moves On : Phenomenon-Based Task Construction, Certification, and Evidence-Based Evaluation
Artificial IntelligenceHuman-Computer Interaction
Summary
Computer programs called agents that use language models sometimes struggle to handle changes in software or data while they work. The authors created EnvOS, a system that carefully checks if changes happen correctly during tests and whether the agent’s actions are judged fairly. This helps figure out if problems come from the agent or from updates it didn’t notice. EnvOS was tested on tasks like booking clinics and approving insurance claims, showing it can help agents better deal with updated information and ensuring reliable evaluation.
What this means in practice
- •For software testing teams: Test AI agents reliably in software systems that change during their tasks by certifying environment updates and grading correctness automatically.
- •For healthcare it teams: Evaluate and improve AI assistants for dynamic booking systems by checking how they handle updated appointment and policy information.
Authors
Ankush Kadu, Athira Gopal, Niharika Singh, Arpit Jain, Aswanth Krishnan
Abstract
Computer-use agents built on large language models (LLMs) work in software that can change while they act: an appointment moves, a policy is revised, a record is updated. Testing agents under such changes is harder than it looks. When an agent fails, the cause may be the agent, but it may also be a change that did not fire as intended, an update the agent never received, or a grader that scored the episode wrongly. We introduce EnvOS, a framework for building and certifying environments that change mid-task. Before any agent runs, EnvOS checks that each change fires correctly, that the task remains solvable, and that the grader separates correct from incorrect behavior; after each run, separate code re-checks the verdict from archived evidence. We apply it to stale information, where a value the agent has already seen changes before the agent acts on it. In clinic booking, Claude Opus 5 succeeds on 0/16 tasks when nothing extra is shown, 2/16 when reminded to re-check the source, and 15/16 when the updated value is shown; the gain over the reminder holds after correcting for all tests (p = 0.00293). In insurance-claim approval, Opus 5 re-checks on its own and succeeds on 10/10, whereas Claude Sonnet 5 rises from 1/10 to 9/10 when the current policy is shown again, a gain significant in its pre-registered test but not after correcting for all tests. Whether an agent caught a change thus varied with the model and the interface. We also stress-test the grading itself: on corrupted episodes designed blind from the rules, the EnvOS pipeline accepted none of 26 as clean, and on an externally generated set it caught 25 of 39, against 4 for simple log checks. Because every EnvOS environment is generated from a seed and graded by an audited automatic verifier, the same environments are natural candidates for training agents with reinforcement learning from verifiable rewards.