Masters portal

Topic selectiontopic-selection/reports/agents-as-os-workload

Report — OS × AI agents, beyond sandboxing and rollback

Second pass, 26 August 2026. Verbatim, including its own verification caveats.

Areas checked: environment provisioning cost; deterministic record/replay for agents; OS-level information-flow control and provenance; multi-tenant sandbox density and admission control; the agent execution DAG as a scheduling problem; semantic and effect-aware caching of tool calls; anything else.

Explicitly excluded as already-checked: agent sandbox checkpoint/rollback mechanisms (DeltaBox, Crab, TClone, AgentRewind) and learning seccomp/Landlock policies from observed behaviour (Santa, sandprint, Kubernetes Security Profiles Operator, Sandlock).

Method note and confidence caveats — read this first

Two structural facts dominate everything below.

First: there is now a dedicated venue for exactly this lane, and it has run twice. AgenticOS, the Workshop on OS Design for AI Agents, ran co-located with ASPLOS 2026 (23 March 2026, Pittsburgh, program with full PDFs) and runs again with SOSP 2026 (29 Sept 2026, Prague, program). Between them they cover five of the six candidate areas by name. Neither has formal proceedings — both FAQs state that acceptance "does not preclude future publication at conferences or journals" — so these papers do not legally close a venue. They do something worse for a student: they tell you which well-resourced groups are working each problem right now. The recurring names are MPI-SWS (Bindschaedler), UC Santa Cruz + Virginia Tech (Zheng, Quinn, Dan Williams, the eunomia-bpf group), and SJTU IPADS / ISCAS (Haibo Chen, Mingyu Li).

Second: the SOSP 2026 workshop papers are titles only right now. The workshop is a month away; PDFs are not posted. What has been claimed is knowable; how well is not.

On citation hygiene: the two workshop programs and the arXiv abstract pages for 2608.15127, 2606.25189, 2607.29069 and 2602.09345 were verified by direct fetch. The arXiv API was blocked, so other preprint metadata comes from abstract pages and search results. Almost everything cited with a 26xx.xxxxx arXiv identifier is an unrefereed 2026 preprint with unconfirmed peer review. The refereed anchors here are few: Murakkab at OSDI '26, one EuroSys 2026 paper, and the older systems literature. Two sources are actively suspect: arXiv:2607.16200 (agrepl), a single-author preprint whose "proof of determinism" is not a proof, and clawxiv.org (the "Context Scheduler as a Kernel Primitive" item), not a preprint server that could be confirmed to exist — do not cite either.

Where the only evidence is absence of search hits, that is stated.

Area 1 — Environment provisioning as the dominant cost

Rating: crowded.

The empirical claim you would want to make — that provisioning dominates agent wall-clock — has been made, measured and published twice, with better instrumentation than a student would build.

  • AgentCgroup: Understanding and Controlling OS Resources of AI Agents. Zheng, Fan, Fu, Yang, Zhang, Quinn. AgenticOS @ ASPLOS 2026 (workshop, no proceedings); preprint arXiv 2602.09345. 144 SWE-rebench tasks, two model backends. OS-level execution (tool calls plus container/agent init) at 55–74% of end-to-end latency, with Podman user-namespace ID remapping of overlay layers as the dominant init cost, scaling with image size. Code at eunomia-bpf/agentcgroup.
  • SWE-MiniSandbox: Container-Free Reinforcement Learning for Building Software Engineering Agents. arXiv 2602.11210, unrefereed. Breaks env-prep into Init Deployment (35.3%, dominated by namespace/mount/chroot kernel bookkeeping), Repo Copy & Reset, and Venv Copy (together ~half). Gets prep from 88.86 s to 23.62 s by dropping containers for raw namespaces.
  • SpecBox: Speculative Sandbox Scheduling for Efficient LLM Agent Serving. arXiv 2607.23933, unrefereed (Beihang + Sydney). This is "predictive environment prewarming," already built: intent-aware prewarming speculating on streaming token output mid-generation, plus stochastic prefetching over a learned Sandbox Dependency Graph with a first-order Markov transition model (τ=0.6, λ=5 s, top-B=1), plus a semantic result cache. 2.9× P99 reduction, 45.9% lower peak memory.
  • AgentENV (AENV), GitHub, the production environment platform behind Moonshot's Kimi K3. On-demand OCI image loading via overlaybd, 1.5M images in production, sub-50 ms boot/resume, sub-100 ms pause, incremental memory and FS snapshotting, ublk I/O with shared host page cache, ballooning to a reported 9.6× memory overcommit. The industrial ceiling, and it is open source.
  • Aries (arXiv 2607.29069, unrefereed) quantifies the economics: tearing down tool sandboxes after each call cuts their cost 65%, but repeated checkpoint/restore raises total customer cost 4.9× versus persistent; an ideal system is 3× cheaper than either.
  • AgentSysBench (arXiv 2608.15127, HKUST + Alibaba + ByteDance, unrefereed) is the full characterization: 10 applications, 4,641 requests, 64,924 LLM calls, 178,799 production sessions.
  • Product side: Modal Directory Snapshots (snapshot a directory, mount into a generic prewarmed sandbox, prioritized against the lazy-loading FS), E2B pause/resume with memory state, and Daytona's Hidden Infrastructure Tax in Coding-Agent RL with per-trajectory worker-hour accounting.

Surviving gap — narrow. SpecBox assumes sandbox identity is predictable from a dependency graph learned over historical trajectories, and that assumption does not hold when the agent bootstraps an environment it has never seen — the SetupBench regime (arXiv 2507.09063, 93 bare-sandbox bootstrap tasks, OpenHands scoring 34.4–62.4%). Every incumbent optimizes selection from a catalog of known environments. Nobody has asked whether agent-issued install commands are content-addressable at all: agents type pip install X ad hoc rather than resolving a lockfile, so the cache key is unstable in a way Dockerfile-issued commands are not.

Smallest defensible result. A measurement paper: eBPF-instrument OpenHands or SWE-agent across SetupBench plus SWE-rebench, classify every install/build action by whether its inputs form a stable content-addressable key, and report the achievable ceiling of a cross-run, cross-repo CAS for agent-issued commands. One workstation; no GPU with an API model.

How it goes wrong. The reviewer says "this is Vesta with a new workload." Vocabulary: Vesta's persistent multi-level function-application cache with dynamic fine-grained dependencies (Heydon et al., SRC-RR-177), Riker (USENIX ATC '22 — syscall-traced, always-correct incremental builds, language-agnostic), Bazel/Skyframe change pruning, forward build systems (Memoize, Fabricate, Rattle), Nix content-addressed derivations, ccache/sccache; and on the image side Slacker (FAST '16), DADI/overlaybd lazy loading, Catalyzer (ASPLOS '20), REAP (ASPLOS '20), FaaSnap (EuroSys '22), SOCK (ATC '18). Second failure mode: AgentENV already ships the whole stack in production, so "we built it" is unavailable — only "we measured it."

Area 2 — Deterministic record/replay for LLM agents

Rating: active at the HTTP layer; thinly claimed at the OS layer. The closest thing to an opening — and less encouraging than it sounds.

Every agent-specific replay system found intercepts at the LLM/tool API boundary and treats the environment as re-executable.

  • agrepl (arXiv 2607.16200) — MITM proxy, HTTP transport layer, claims fidelity F=1.0. Flagged hard: single-author, unrefereed, and its "determinism invariant proof" is a restatement of the construction. Do not lean on it.
  • OSS, all HTTP/gateway level: t2ni/agentrr, avartan-labs/hetu (models five channels — network, filesystem, clock, randomness, IPC — but its determinism contract per channel is serve-recorded at the boundary, not enforced in the kernel), llm-rewind/rewind (adds bisect cause-inference and mutation testing), Chidori time-travel, LangGraph checkpoint time travel, vcr-langchain, Docker cagent.
  • On Randomness in Agentic Evals (arXiv 2602.07150, unrefereed) — 60,000 trajectories, 25.58B tokens, 1.88M tool calls, three models, two scaffolds. Finds pass@k versus pass^k gaps up to 24.9 points. Crucially, it attributes variance to model sampling and explicitly does not isolate environment-side nondeterminism.
  • Community evidence that the environment channel is real and unhandled: SWE-bench issue #602 and PR #607 — eval containers created without TZ=UTC, PYTHONHASHSEED=0, LANG=C.UTF-8, producing flaky results for identical patches at max_workers > 1.

The OS-level machinery exists but nobody has pointed it at agents: Hermit (Meta, facebookexperimental/hermit) is a deterministic Linux container over the Reverie ptrace/seccomp backend, virtualizing thread scheduling, time, randomness, CPUID and selected file metadata, with experimental record/replay and a --verify desync check. It is in maintenance mode. Plus rr, CRIU, and twenty years of research.

Surviving gap — a genuine composition gap, stated two ways. Every agent replay system (agrepl, hetu, agentrr, rewind) assumes the LLM API boundary is the only nondeterminism worth capturing and that the environment re-executes faithfully; that assumption fails exactly where SWE-bench flakiness lives — concurrent test runners, clock dependence, hash-order dependence, filesystem ordering. Symmetrically: Hermit and rr assume a closed process tree with external inputs recordable as a small tail; that assumption fails for agents, whose defining channel is the network. Nobody has published the composition.

Smallest defensible result. Compose a recording LLM proxy with deterministic scheduling of the sandbox process tree (Hermit, or a ptrace scheduler-serialization layer if Hermit fights you), run known-flaky SWE-bench Verified instances, and answer one question with a number: after pinning the model channel, what fraction of residual outcome variance is environment-side, and does deterministic scheduling collapse it? One x86-64 Linux box, no GPU. Genuinely masters-scale and genuinely unclaimed.

How it goes wrong — the strongest caution in this report. Two independent failure modes.

Engineering risk. Hermit breaks on complex syscalls, and agent sandboxes are the definition of complex — threads, network, sometimes Docker-in-Docker. Its own docs warn that nested containers commonly block namespaces, ptrace, seccomp and perf_event_open. The realistic failure is spending the entire MSc on compatibility and producing a null result.

Novelty risk. The prior art is deep, old, and lives under names an OS reviewer knows cold: ReVirt (OSDI '02), ODR and PRES (both SOSP '09), DMP (ASPLOS '09), dOS (OSDI '10), Determinator (OSDI '10), DTHREADS (SOSP '11), Scribe, R2, and above all eidetic systems / Arnold (OSDI '14), which recorded and replayed entire long-running Linux systems. A reviewer will say: "record/replay applied to a new workload is not a new mechanism." Your defence must be that the attribution result is the contribution, not the mechanism. Make that the thesis claim, not the tool.

Area 3 — OS-level IFC, taint and provenance for agent actions

Rating: crowded. This closed during 2026. Do not go here.

The proposal you would write has been written, implemented, benchmarked and open-sourced.

  • ActPlane: Programmable OS-Level Policy Enforcement for Agent Harnesses. Zheng, Wu, Fu, Yu, Mao, Wang, Williams, Quinn. arXiv 2606.25189, unrefereed preprint; code at eunomia-bpf/actplane. eBPF hooks on fork/exec/exit/open/unlink/rename/connect, per-node label sets over processes, files and endpoints, multi-label information-flow propagation across channels, a policy DSL compiled to BPF, cross-event ordering conditions, and semantic feedback to the agent rather than silent blocking. It also ships a benchmark built specifically to test whether enforcement survives subprocess and shell-out evasion — pre-empting the exact critique you would have levelled at framework-level defences.
  • AgentSight (arXiv 2508.02736) — eBPF TLS interception correlated with syscall events, <3% overhead, zero instrumentation.
  • Grimlock: Guarding High-Agency Systems with eBPF and Attested Channels — AgenticOS @ ASPLOS 2026.
  • Execute-Only Agents: Architectural Defense Against Prompt Injection for AI Agents. Tiwari & Williams, AgenticOS @ ASPLOS 2026.
  • Securing Agentic AI with OS-Level Intent-Driven Capabilities. Lourenço, Neugschwandtner (Oracle Labs), Santos, Bruno (INESC-ID/IST Lisbon) — AgenticOS @ SOSP 2026, title only.
  • LLM Agent Capabilities Should Follow Task Intent and Context Source. Zheng, Zhang, Mao — AgenticOS @ SOSP 2026, title only.
  • Framework layer, all 2025 and all cited by the above: CaMeL (DeepMind, arXiv 2503.18813), FIDES (Microsoft Research), Progent, AgentSpec. Plus nevinshine/telos-runtime doing eBPF/LSM taint elevation with irreversible network revocation.

Surviving gap — only in evaluation, and on ActPlane's turf. ActPlane concedes that object-granularity labels trade precision for coverage. So: ActPlane assumes object-granularity labels remain informative across a session, and that assumption fails under label creep — once a coding agent reads one untrusted file, every subsequent build artifact inherits the label and the policy becomes either vacuous or total. Measuring the taint-saturation curve over long agent sessions and proposing declassification points anchored at agent turn boundaries is a real contribution. It is also an increment on ActPlane, in ActPlane's vocabulary, competing with a group that ships code weekly.

How it goes wrong. The reviewer names the ancestors and it collapses into a footnote: Asbestos (SOSP '05), HiStar (OSDI '06), Flume (SOSP '07), PASS (ATC '06), Hi-Fi, LPM (USENIX Sec '15), CamFlow (SoCC '17) and especially CamQuery (SOSP '18), which already propagates labels in-kernel and denies matching operations — ActPlane's own related work identifies it as the closest prior system. Dynamic side: TaintDroid (OSDI '10), libdft, Panorama, Clause et al. And the deflating one-liner: Perl's taint mode did "tainted data cannot reach system()" thirty years ago.

Area 4 — Multi-tenant sandbox density and admission control

Rating: crowded. Every specific sub-question posed has a published numeric answer, including the KSM/ballooning/freeze axis.

"What is the binding resource?" — answered. AgentCgroup (arXiv 2602.09345): memory, not CPU, is the concurrency bottleneck; a stable ~185 MB framework baseline plus tool-call-driven bursts with a 15.4× peak-to-average ratio; demand varying 20× across tasks and 1.8× across runs of the same task.

"How many fit on a host?" — answered publicly, with a runtime matrix. High-Density Agent Sandbox on GKE with Local SSD Swap, the Kubernetes SIG agent-sandbox project: runc 200 pods/node with swap, gVisor 160, kata-clh 50, kata-qemu 20; collapse thresholds characterized (baseline collapses at 200 pods with 25% loss, swap holds 100%); vm.swappiness=100 and vm.watermark_scale_factor=500 published as the tuning. Google Cloud's GKE Agent Sandbox writeup walks 61 → 88 → 133 → 274 OpenClaw agents per node via gVisor plus warm pools plus snapshot suspend/resume: 3.5× density, 75% cost reduction.

"Overcommit, ballooning, freeze-idle?" — all shipped. AgentENV reports 9.6× memory overcommit via ballooning in production. CubeSandbox PR #553 adds host.quota.paused_resource_release_ratio, a tunable fraction of a paused sandbox's quota released back to the scheduler with best-effort resume and local admission re-check — overcommit admission control for frozen sandboxes, merged. OpenSandbox #1223 added independent requests/limits for Burstable-QoS overcommit, merged. kubernetes-sigs/agent-sandbox PR #1296 implements auto-suspension plus traffic-triggered resume via Envoy ext_proc (KEP-0968).

"Admission control research?" — MARS (arXiv 2604.26963) decouples admission from execution under coupled GPU-CPU pressure; MORI (arXiv 2606.00866) enforces admission control at each memory tier; Murakkab (OSDI '26 — Chaudhry, Choukse, Qiu, Goiri, Fonseca, Belay, Bianchini, pp. 567–587, refereed) does cross-layer agentic workflow orchestration. And The Irreversibility Budget: Fleet-Level Risk Accounting and Admission Control for Agent Operating Systems, Mohammadi & Bindschaedler, MPI-SWS, AgenticOS @ SOSP 2026 — which takes the one genuinely novel reframing here, admission control priced on irreversible-action risk rather than on resources.

Surviving gap — one measurable thing, weakly. GKE and agent-sandbox treat sandbox memory as opaque anonymous pages and make swap-to-local-SSD the density lever; that framing ignores that agent sandboxes are near-clones at t=0 — identical base image, toolchain, node_modules — and diverge monotonically as the agent installs things. Same-page merging plus divergence-aware eviction should therefore behave very differently from swappiness tuning, and no published KSM pages_sharing numbers exist for agent sandboxes specifically. A one-host study: a 128 GB workstation, N containers, track KSM sharing over a SWE-bench run, compare density under KSM versus swap versus neither.

How it goes wrong. It is a 2009 mechanism on a 2026 workload, and one Google blog post from being scooped — they have already published the swap version. Reviewer vocabulary: KSM (Linux 2.6.32), ballooning (Waldspurger, OSDI '02), Difference Engine (OSDI '08), Satori, working-set estimation, VM consolidation and overbooking, and the serverless keep-alive literature. Someone will also point out that AgentENV reports 9.6× overcommit in production, a bar you cannot clear on one box.

Area 5 — The agent execution DAG as a scheduling problem, and the inference idle window

Rating: crowded. The single most heavily mined observation in 2026 agent systems. Treat it as dead.

"Use the idle window during LLM inference to do OS work" is not an opening; it is the shared premise of at least six systems.

  • Crab: A Semantics-Aware Checkpoint/Restore Runtime for Agent Sandboxes (arXiv 2604.28138) — eBPF inspector classifies each turn's OS-visible effects, coordinator aligns checkpoints to turn boundaries and explicitly overlaps C/R with LLM wait time. 87% of turns need no checkpoint; p95 exposed delay 0.44% of task time at 64 co-located sandboxes.
  • DeltaBox (arXiv 2605.22781) — hides both the CRIU dump and template-creating fork inside the LLM I/O window; ~10.83 ms checkpoint work fully masked, 1.86 ms template-fork restore.
  • MORI (arXiv 2606.00866) — reframes idleness as a continuous relative spectrum rather than a binary label, ranks programs by idleness, shifts the GPU-HBM/CPU-DRAM partition boundary dynamically. 20–71% throughput, 18–43% lower TTFT, evaluated on real Claude Code traces.
  • MARS (arXiv 2604.26963) — GPU-CPU co-scheduling, external control plane, retains KV state only when warm resumption pays. 5.94× latency reduction, integrated as an OpenHands backend.
  • AgentSysBench (arXiv 2608.15127) — proposes quiescent-point snapshotting during inter-step idle intervals and a first-class third "waiting" lifecycle state, then evaluates state offloading for 4.6× memory reduction. If your idea was "the OS needs a waiting state distinct from running and finished," it is taken.
  • SpecBox — overlaps sandbox bootstrap with token generation.
  • Patient Bytes: A Reliability-Budgeted Scheduler for Agentic LLM Workflows. Pasandi, Arabzadeh, Pan (UC Berkeley), Xu (Berkeley/UIUC), Darabi (USI), Hosseini, Haddadi (Imperial/Brave). AgenticOS @ SOSP 2026, title only.
  • Refereed anchor: Murakkab, OSDI '26. Plus DynaRL and RollArt at OSDI '26 on the RL-rollout side.

Surviving gap: none at masters scale. Every framing constructible — slack-aware, critical-path aware, reclaim-during-inference, mixed remote-latency/local-CPU — is occupied.

How it goes wrong. Before reaching the 2026 papers, a reviewer will name gang scheduling, DAG/list scheduling on the critical path, slack-aware scheduling, latency-critical/batch co-location (Heracles ISCA '15, PARTIES ASPLOS '19, Borg and Autopilot), harvest VMs and Protean, and idle-cycle harvesting going back to Condor in 1988. "You have rediscovered work-conserving scheduling" is the sentence to expect.

Area 6 — Semantic and effect-aware caching of tool calls and syscalls

Rating: crowded, boxed in from both directions — by 2026 agent systems above and by a 2022 ATC paper below.

  • TVCache: A Stateful Tool-Value Cache for Post-Training LLM Agents (arXiv 2602.10986, unrefereed). This is area 6, built. Cache organized as a tool-call graph; lookup is longest-prefix match in log|V| time; correctness argued as "the returned result is identical to executing in a sandbox mutated by the same sequence of tools"; sandbox snapshots at TCG nodes so partial-prefix hits replay only the unmatched suffix; stateless tools annotated for extra hits. Integrated with veRL and Tinker. Explicitly targets caching across branches of a search tree.
  • SpecBox ships a semantic result cache at cosine ≥ 0.8.
  • AgentSysBench §8.4 measured the opportunity in production: of 373,678 search queries, 27% of unique queries recur and account for 67.3% of all calls; tool-result caching removes 35.2% of redundant search calls and 19.3% of aggregate search latency.
  • Fork, Explore, Commit: OS Primitives for Agentic Exploration. Cong Wang (Multikernel) & Yusheng Zheng (UCSC). AgenticOS @ ASPLOS 2026; preprint arXiv 2602.08199; code multikernel/branchfs. Introduces the branch context — CoW filesystem view plus process group, fork/explore/commit lifecycle, first-commit-wins sibling invalidation, nesting, sub-350 µs creation, sub-1 ms commit, unprivileged FUSE, plus a proposed branch() syscall. If your framing was "the search tree needs an OS abstraction," it is claimed.
  • Effect taxonomies for the write side: Atomix (arXiv 2602.14849) with epochs and per-resource frontiers; xudong963/effect-log with the ReadOnly / IdempotentWrite / Compensatable / IrreversibleWrite / ReadThenWrite classification.

Surviving gap — one, technically real. TVCache assumes correctness requires an identical prefix of tool calls, and that assumption is unnecessarily conservative when two branches issue different command sequences that read the same inputs — the common case in agent search trees, where branches differ in exploration order but converge on the same build. Keying on the observed read-set rather than the command text would hit where prefix matching misses.

Smallest defensible result. Trace read-sets with eBPF across real agent branch trees (SWE-bench MCTS-style rollouts), and report the hit-rate delta of read-set keying over prefix keying, plus the false-hit rate. One machine.

How it goes wrong — close to fatal. The reviewer says one word: Riker (Curtsinger et al., USENIX ATC '22) — always-correct, language-agnostic incremental builds that capture fine-grained dependencies by tracing system calls, precisely the "key on the observed read-set" insight. Behind it: Vesta's dynamic fine-grained dependency analysis, Bazel/Skyframe change pruning, Memoize/Fabricate/Rattle, CDE (ATC '11), self-adjusting computation, and Speculator (SOSP '05). The honest framing is "we port Riker's keying discipline to agent tool calls and measure the delta," an empirical increment rather than a mechanism. That may be enough for an MSc; it will not be enough for a systems venue.

Area 7 — What else, including the finding you most need

The bad news: the carve-out is claimed

The exception to the checkpoint/rollback exclusion — effects that escape the sandbox — is now taken:

Externalization Barriers: An OS Abstraction for Untrusted Agent Exploration. Jinhao Hu, Bardia Mohammadi (MPI-SWS), Ashvin Goel (University of Toronto), Laurent Bindschaedler (MPI-SWS). AgenticOS @ SOSP 2026, 29 September 2026.

Title only — the PDF is not public until the workshop runs. But the title states the claim precisely: an OS abstraction for the barrier between reversible in-sandbox exploration and irreversible external effect. The same group is simultaneously presenting The Irreversibility Budget, and the PI (Bindschaedler) is giving the keynote. Note also that the Fork, Explore, Commit slides list "external side effects (network, IPC) not rolled back" as their explicit limitation — two groups independently identified this boundary as the next thing.

Practical implication: whatever you build in this direction, you will be writing against a paper you cannot read for another month, from a group with more resources.

Other 2026 claims, so you do not walk into them

From AgenticOS @ SOSP 2026, all title-only: Isolation in the Age of Agents (Anjali & Michael Swift, Wisconsin); AgentProf: Semantic Profiling for AI Agents (Zheng, Chang, Wu, Mao, Cheng, Ma, Quinn, Wang — UCSC/HKUST/Alibaba); Preserving GPU Profiling Accuracy under Concurrent GPU-Coding Agent Workloads (Hao, Wei, Chen, Chen — SJTU IPADS; single-GPU-reachable, and taken); When Agent Context Goes Stale: Incoherence in Volatile Agent Context (HKU — cache-coherence framing applied to agent context versus the filesystem it describes, the most elegant OS framing on either program and it is gone); Agent libOS; Agate: Capability Microkernels as a Natural Substrate for AI Agents (Huawei); TypeGo (Yale, embodied); The Abstractions Are Slipping: Four OS Mismatches in the Agent Era (Alibaba Cloud); An AgentOS Needs a Formal Representation of Agents (Nanjing).

From AgenticOS @ ASPLOS 2026, PDFs public: Rethinking OS Interfaces for LLM Agents (Wang, Li, Chen); Skills are the new Apps — Now It's Time for Skill OS (IPADS); pMVX; It is Time to Virtualize Foundation Models; Fuyun; Towards Agentic Performance Management (Chen, Huang, Levy — Princeton).

Refereed 2026: Murakkab (OSDI '26); From Imperative to Declarative: Towards LLM-friendly OS Interfaces for Boosted Computer-Use Agents (Wang, Li, Chen — EuroSys 2026). NSDI 2026 has Agentix per secondary sources, unverified.

Architecture-vision preprints, all unrefereed, all low-signal, all likely to be cited at you regardless: Agent Operating Systems (AOS) (arXiv 2606.01508), The Agent Operating System (AOS): A Reference Operating Architecture (arXiv 2608.03214), AgenticOS: An Intent-Oriented Secure OS Architecture (arXiv 2606.21129), Isolation as a First-Class Principle for LLM-Agent System Safety (arXiv 2607.12406).

Things not found, with honest confidence labels

Three candidates where the only evidence is absence of search hits, which is weak.

  1. Page-cache and I/O interference among near-identical co-located agent sandboxes. Crab reports that every-turn full checkpointing costs 3.78× on Terminal-Bench at 96-sandbox density "due to host I/O contention," but nobody isolates the pathology: N sandboxes each running pytest over near-identical trees, competing for readahead and page cache. Single host, no GPU. Caveat: container I/O interference is an old topic, and both AgentCgroup and Crab have grazed it.
  2. Non-stationarity of agent-generated behaviour. No paper found measuring drift in the syscall or file-access distribution of agent-generated code across model versions or scaffolds. Measurable on one machine and the right kind of small. But genuinely hard to search for, so confidence it is unclaimed is low — and AgentCgroup's finding (demands varying 20× across tasks, 1.8× across runs) is the same observation arriving from the resource-management side.
  3. Credential and secret lifetime as an OS-managed resource for agents — short-lived credential vending scoped to syscall-observed intent rather than to a process or session. The MCP ecosystem has OAuth scoping; nothing found at the OS layer. Weakest evidence of the three, and adjacent enough to the intent-capability papers that it may already be inside their scope.

Bottom line

The prior experience — every area more crowded than guessed — holds again, and the mechanism is now visible: a dedicated workshop series has run twice in six months and has drawn three well-resourced groups systematically enumerating exactly the abstraction gaps you would enumerate. Areas 3, 4 and 5 are dead. Areas 1 and 6 are crowded with one narrow crack each, and in both cases the crack has a named ancestor (Vesta; Riker) a reviewer will produce immediately.

Area 2 is the only one worth continuing to look at, and only in one shape: not "build a replay system," which is a solved mechanism, but "attribute agent irreproducibility between the model channel and the environment channel, and show that OS-level determinism closes the environment share." That question is unasked, it fits one machine with no GPU, and the strongest existing paper on agent nondeterminism (On Randomness in Agentic Evals) explicitly leaves it open. Budget heavily for the possibility that Hermit will not cooperate, and design the thesis so the measurement stands even if the deterministic-scheduling half fails.