Paper treats LLM agents as ring-0 systems missing OS protections
Original title: Ring-0 by Default: Agents as Operating Systems (AaOS)
Of 116 OS mechanisms, 65 are missing and only 11 isomorphic; three coding CLIs load forged resume records and let the shell bypass checks.
The authors argue deployed LLM agents already act like operating systems but run model output with the host user's full authority. Mapping 116 textbook mechanisms across 19 subsystems, they find only 11 isomorphic and 65 missing, mostly protections such as privilege separation, quotas, transactions, and tamper-proof audit. Thirteen experiments on Claude Code, Codex CLI, and Gemini CLI cover 25 mechanisms: checks sit in single tools so the shell bypasses them, and all three CLIs load forged transcript records on resume.
- Prompt-written rules meet none of Anderson's reference-monitor criteria.
- Sixteen experiment results match the map, seven refine it, and two change the verdict.
- Task control, sub-agent permissions, and model-based monitors are weak.
- Five identified problems have no transferable operating-system defense.
- Products
- Claude CodeCodex CLIGemini CLI
From the original article
1 min read at arxiv.orgLLM agents now read and write files, start processes and subagents, fetch network content, load third-party extensions, and save and resume state, which are the responsibilities of an operating system.
By Xiang Li · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.