Agentic OS Explained: What It Is and Who's Building One

Agentic OS turns up in two very different places right now. One is a pair of 2026 arXiv papers arguing about how to extend Linux and Windows for autonomous AI agents. The other is a handful of GitHub repositories that already call themselves an operating system for agents, complete with working code, stars, and commit histories. Both are responding to the same problem: operating systems were built for programs that run a fixed set of instructions and stop, and agents don't behave that way.

Agentic OS is a systems architecture that gives AI agents the same services a regular operating system gives programs: scheduling, memory management, a registry of tools an agent may call, policy enforcement, and audit logs, adapted for software that reasons probabilistically instead of following fixed instructions. Two 2026 arXiv papers define the concept; open-source projects already build pieces of it.

How an agentic OS works

Classical operating systems are built around processes, threads, system calls, files, and permissions. Those abstractions assume a program's behavior is bounded and predictable: code runs, does what it says, and exits. Agents break that assumption. They run for long stretches, pursue a goal rather than a fixed instruction set, reason probabilistically, and decide which tools to call as they go. That combination stresses regular OS boundaries in five places: scheduling, memory and state management, security, observability, and governance. This is the starting argument of "Agent Operating Systems (AOS)," a paper by Ankur Sharma and Deep Shah submitted to arXiv on 1 June 2026.

The paper defines an AOS as a systems architecture that integrates an agentic control plane into an existing operating system, or, in some models, gradually takes over selected OS responsibilities over time. It splits AOS responsibilities into five areas: schedulers, context and memory management, tool and capability registries, policy and trust enforcement, and observability and audit. The authors map these onto real Linux and Windows primitives, propose agent-specific threat models, and set evaluation criteria around deterministic enforcement, auditability, and operator comprehensibility, meaning a person should be able to follow what an agent did and why. Their stated non-goal is explicit: this isn't meant to replace operating systems outright.

A second paper, "Towards an Agent Operating System - Lessons from Classical and Cloud OS" by Gosia Steinder and Hubertus Franke, submitted 27 July 2026, argues much the same problem from a different direction. It compares the current moment in agentic AI to two earlier platform transitions: POSIX standardizing classical operating systems, and Kubernetes standardizing the cloud. Both of those went through a period of competing frameworks before the field settled on a small set of stable abstractions everyone could build against. Steinder and Franke say agentic AI is still in that earlier, messier phase: dozens of frameworks and protocols exist, but no community consensus on core agent abstractions has formed. Without that consensus, agentic applications can't be written portably, and different platforms can't compose reliably. Their proposed fix is to extend classical and cloud OS primitives to stochastic, natural-language-mediated execution and specify the semantics precisely enough for the field to consolidate around them, the way it did with POSIX and Kubernetes.

Examples

Three open-source projects show what pieces of an agentic OS look like once someone actually builds them, at very different scales.

AIOS, from the research group agiresearch, is the most developed of the three. It embeds an LLM into the operating-system layer and manages scheduling, context switching, memory, storage, tool management, and Agent SDK management for LLM-based agents. Its documentation describes the AIOS kernel as an abstraction layer over the operating system kernel, handling the resources agents need: the LLM itself, memory, storage, and tools. The project splits into two repositories, the AIOS Kernel and an SDK called Cerebrum, and ships both a web UI and a terminal UI. Its foundational paper, "AIOS: LLM Agent Operating System," was accepted at COLM 2025, following an earlier perspective paper called "LLM as OS, Agents as Apps." For computer-use tasks, AIOS redesigns its Tool Manager around a VM Controller and an MCP Server, creating a sandboxed environment where agents interact with a computer through a consistent semantic mapping, described in its LiteCUA paper. AIOS also defines four deployment roles: the agent hub machine that hosts a marketplace for publishing and sharing agents, the agent UI machine end users interact with, the agent development machine where agents get built and tested, and the agent running machine that executes them. The AIOS kernel repository has 6.3k GitHub stars and 898 forks, with its latest commit on 20 July 2026.

itseffi/agentic-os takes a much lighter approach: no kernel code, just markdown files and a git repository. It automates workflows across several coding-agent runtimes, including Claude Code, Codex, Pi, OpenClaw, and Cursor. Its memory stack layers instructions in AGENTS.md, priorities in GOALS.md, current work in Tasks/**/*.md, reference material in a Knowledge folder, and reusable capabilities in .agents/skills, which follow the Agent Skills open standard from agentskills.io and load progressively, so the agent reads full instructions only once a skill is actually selected. It's built privacy-first: personal data stays local and gitignored, while only the structural files are version-controlled. The project ships its own evals for structural, behavioral, routing, and memory-impact correctness. itseffi/agentic-os has 105 stars, and its latest commit landed 14 April 2026. Both Claude Code and Cursor are listed on AI Agents Listing, alongside other coding agents this kind of setup can wrap.

Agent S, from simular-ai, covers the piece an agentic OS needs for controlling a computer directly: an open-source framework for autonomous interaction with a computer through what it calls an Agent-Computer Interface. Agent S3 became the first system to surpass human performance on the OSWorld benchmark, reaching a score of 72.60% against a human baseline of about 72%, using a technique called Behavior Best-of-N (Agent S3 alone scores 66% in a 100-step setting). It also generalized to other benchmarks in zero-shot testing: accuracy on WindowsAgentArena rose from 50.2% to 56.6%, and on AndroidWorld from 68.1% to 71.6%. Agent S3 was released on 2 October 2025 with a 69.9% OSWorld score. It reached the human-surpassing 72.60% figure by 15 December 2025, and its paper, "Scaling Agents for Computer Use," was accepted to TMLR 2026 on 30 July 2026. It installs with one command:

pip install gui-agents

When to use an agentic OS (and when not)

Agentic-OS thinking is useful once an agent needs to run for a long time, keep memory across sessions, call tools through something more controlled than a bare API key, and leave an audit trail a person can actually review. That is the exact set of problems the AOS paper's five-part breakdown, schedulers, memory management, tool registries, policy enforcement, and observability, targets directly. If the job is specifically about controlling a GUI or a full computer, Agent S's Agent-Computer Interface and AIOS's VM Controller plus MCP Server sandboxing are the more relevant pieces to look at. If the goal is smaller, personal workflow automation across coding agents already installed on a laptop, itseffi/agentic-os's markdown-and-git approach needs far less setup than running a kernel-level project.

Don't expect a standardized target to build against yet. Both arXiv papers agree the field hasn't reached the consensus that POSIX gave classical operating systems or that Kubernetes gave the cloud: there's no agreed set of core agent abstractions, so agentic applications aren't portable between these systems, and different platforms don't compose reliably. The AOS paper is explicit that its goal isn't to replace operating systems altogether. Choosing one of these projects today means picking an implementation, not a standard.

What's new (as of 27 August 2026)

• "Towards an Agent Operating System - Lessons from Classical and Cloud OS" (arXiv:2607.25076), by Gosia Steinder and Hubertus Franke, went up on 27 July 2026, making the case that agentic AI needs its own POSIX or Kubernetes moment.
• "Agent Operating Systems (AOS)" (arXiv:2606.01508), by Ankur Sharma and Deep Shah, went up on 1 June 2026, laying out a more detailed technical decomposition and threat model.
• AIOS's kernel repository last saw a commit on 20 July 2026 and now stands at 6.3k stars and 898 forks.
• itseffi/agentic-os last saw a commit on 14 April 2026, at 105 stars.
• Agent S3's paper, "Scaling Agents for Computer Use," was accepted to TMLR 2026 on 30 July 2026. Agent S3 itself first surpassed human performance on OSWorld on 15 December 2025.

Key takeaways

• Agentic OS names a systems architecture, not a specific product: two 2026 arXiv papers propose formal definitions, and projects such as AIOS, Agent S, and itseffi/agentic-os already implement pieces of it.
• Both arXiv papers compare this moment to the pre-POSIX and pre-Kubernetes eras: many frameworks exist, but no community consensus on core agent abstractions has formed yet.
• AIOS is the most developed open-source attempt, split into a Kernel repository and an SDK called Cerebrum, with its foundational paper accepted at COLM 2025 and 6.3k GitHub stars as of 20 July 2026.
• Agent S3 shows what the computer-use slice of an agentic OS can already do: it scored 72.60% on OSWorld, ahead of the roughly 72% human baseline, as of 15 December 2025.
• Not every agentic OS needs kernel code: itseffi/agentic-os builds one from markdown files, git, and a defined memory stack, wrapping coding agents like Claude Code and Cursor instead of the operating system itself.

FAQ

What is an agentic OS?

An agentic OS is a systems architecture that gives AI agents operating-system-level services, such as scheduling, memory management, tool registries, policy enforcement, and audit logging, built for software that decides what to do step by step instead of executing a fixed script. The term comes from two 2026 arXiv papers that formalize the concept, and it's also used more loosely by open-source projects like AIOS and itseffi/agentic-os to describe their own designs.

How is an agentic OS different from a regular operating system?

A regular operating system relies on processes, threads, system calls, files, and permissions, all of which assume that a program behaves predictably within fixed limits. The AOS paper by Ankur Sharma and Deep Shah argues that AI agents don't fit that mold: they run for long periods, chase a goal instead of executing fixed instructions, reason probabilistically, and pick which tools to call as they go. That mismatch is what strains classical OS boundaries in scheduling, memory and state management, security, observability, and governance.

Is AIOS an operating system you install in place of Linux or Windows?

No. AIOS sits on top of whatever operating system is already on the machine: its kernel acts as a management layer for the resources an agent needs, the LLM, memory, storage, and tools, rather than replacing Linux or Windows underneath. Developers work through the AIOS SDK, called Cerebrum, while the AIOS Kernel handles scheduling and resource management.

Does an agentic OS actually work today, or is this still just research?

Parts of it work today. Agent S3 surpassed human performance on the OSWorld computer-use benchmark, scoring 72.60% against a roughly 72% human baseline, and AIOS has a working kernel and SDK with a paper accepted at COLM 2025. What's missing, according to both 2026 arXiv papers, is agreement on a common set of core abstractions, so these projects aren't interchangeable or portable with each other the way POSIX-compliant systems are.

Can I use an agentic OS with Claude Code or Cursor today?

Yes, at the lightweight end. itseffi/agentic-os is built specifically to wrap coding-agent runtimes including Claude Code, Codex, Pi, OpenClaw, and Cursor, using markdown files and git rather than any kernel-level integration.

AI Agents Listing's Developer Tools category tracks the coding agents and infrastructure that plug into stacks like these.