What Is an Agentic Operating System?

An unsettled term with a real architecture underneath

The most honest starting point is an academic survey. Wang et al.’s 2025 review of AI agentic programming finds the field “still in its early stages,” with systems that “vary in architecture, autonomy, tool integration, and reasoning capabilities,” and states the central fact flatly: “There is no standard taxonomy, benchmark suite, or evaluation methodology.”⁷ The same survey names a structural reason the ground stays soft. Today’s programming languages, compilers and debuggers are “fundamentally human-centric” and “not designed for automated, autonomous systems,” so the tooling layer any agent OS would sit on is itself immature.⁷ A phrase applied across academic kernels, single-repo config folders, enterprise platforms and consumer operating systems with no shared definition is what an immature field sounds like before its vocabulary settles.

The looseness has something real underneath it, and two academic papers show what. MemGPT (2023) proposed “virtual context management, a technique drawing inspiration from hierarchical memory systems in traditional operating systems which provide the illusion of an extended virtual memory via paging between physical memory and disk,” letting an LLM “read and write to external data sources, modify their own context, and choose when to return responses to the user.”⁶ AIOS (2024) went further and proposed “the architecture of AIOS (LLM-based AI Agent Operating System),” which isolates “resources and LLM-specific services from agent applications into an AIOS kernel” providing “scheduling, context management, memory management, storage management, access control.”⁵ The motivation is an operating system’s classic worry, that “unrestricted access to LLM or tool resources can lead to inefficient or even potentially harmful resource allocation,” and the payoff is measured, “up to 2.1× faster execution for serving agents.”⁵ Used this way, the term names an actual kernel with modules and a benchmark. This is the term at its most defensible, and the looseness enters when the same words are borrowed for marketing.

The coding-project, enterprise and consumer senses share the words and little else

The second sense moves from the research lab to the individual repository. Here the “OS” is a folder of agent-facing files configuring how a coding agent behaves in one project. AGENTS.md, “a simple, open format for guiding coding agents,” framed as “a README for agents: a dedicated, predictable place to provide the context and instructions,” is the most-adopted convention, “used by over 60k open-source projects” across Claude, Codex, Cursor and GitHub Copilot.¹ Anthropic’s account of the surrounding scaffolding, which spans CLAUDE.md, rules, skills, subagents, hooks and MCP, is the fullest first-party statement of this sense, and it never calls any of it an “agentic OS.”⁸

The third sense belongs to the enterprise vendors, who position a platform as the layer agents run on. Slack defines an agentic OS as “an operating layer for AI” that “coordinates autonomous agents, connects them to your data and apps, and keeps humans in control of outcomes.”⁴ Amdocs makes the same move for a vertical, branding aOS “a new operating system for telecom” that “operates on top of any BSS/OSS stack.”¹⁴ Two vendors, one label, no shared definition.

In the fourth sense the operating system itself is the host. Microsoft has positioned Windows 11 as an agentic OS in which “AI bots and large language models handle the user’s commands on files and computing tasks.” The mechanism is an “Agent Workspace” where each agent runs as “a separate agent user contained within its own Windows account,” with isolation “comparable” to a VM and scoped folder access.¹¹ The referent is distinct again; here the OS hosts and sandboxes the agents, where the other senses put the agents in a folder or on a platform.

One usage sits between the categories. MindStudio defines an agentic OS as “the infrastructure layer that enables AI agents to function reliably across complex, multi-step tasks,“³ a vendor capability stack pitched somewhere between the coding-project folder and the enterprise platform. The spectrum figure above plots it separately, which is why the figure carries more markers than the prose count of four: five senses once the capability stack is split out, plus two entries that are stances about the term rather than senses of it, the precise-alternative vocabulary of “harness” and “scaffold” and the skeptical agent-washing view.

The technical ecosystem writes “harness” while the creator ecosystem sells “agentic OS”

Who uses the word is evidence in its own right. Anthropic, whose tooling effectively defines the coding-project category, names the discipline “steering,” differentiating its components by “when it loads,” persistence “through compaction,” and “instructional authority,” and never reaches for the OS metaphor.⁸ The closest concrete product in the space, Brian Casel’s Builder Methods offering, calls itself “Agent OS,” deliberately dropping the “-ic,” and describes “a lightweight system for defining and managing your coding standards in AI-powered development” that works across “any AI coding assistant that can read files.”¹² So even the buzzword’s nearest packaged form keeps its distance from the buzzword.

There is a mechanism behind who declines the word, and it shows when the sources are sorted by medium. The research behind this paper included two structured passes over this question, one across written sources and one across video sources, and the vocabulary split along that line. The written, technical ecosystem mostly avoids the phrase and calls the same artifact “agent rules,” “agent context files,” or steering. The video and creator ecosystem is where the hyped “agentic OS” label gets driven. The two sides use different vocabulary for substantially the same thing, which is why the category’s defining vendor can decline the word while the label spreads anyway. Like the four-ingredient definition this paper builds later, the split is the paper’s own analysis; the video sources were not captured into the citable corpus.

The serious analytic vocabulary the written ecosystem prefers is “harness.” Böckeler’s harness-engineering framing states that “the term harness has emerged as a shorthand to mean everything in an AI agent except the model itself — Agent = Model + Harness.”⁹ Anthropic uses the same word first-party when it explains that hooks “are code that the harness runs rather than instructions to Claude.”⁸ Between the tool vendor and the independent analyst, “harness” is the shared term of art. Even the replacement vocabulary is contested, though. A Hugging Face glossary splits “harness,” the execution layer that “calls the model, handles its tool calls, decides when to stop,” from “scaffold,” the behaviour-defining layer of system prompt, tool descriptions and context management,¹⁵ which contradicts Böckeler’s broader harness-is-everything-but-the-model. Two careful 2026 sources define “harness” incompatibly.

Agent washing is the market-level version of the same looseness

The looseness has a market-level analog, and Gartner has given it a name. Gartner predicts “over 40 percent of agentic artificial intelligence (AI) projects will be cancelled by the end of 2027” owing to “escalating costs, unclear business value, or inadequate risk controls.”¹⁰ The same release defines agent washing as “the rebranding of existing products such as AI assistants, RPA and chatbots without substantial agentic capabilities,” and estimates that “only about 130 of the thousands of agentic AI vendors are real.”¹⁰ Analyst Anushree Verma adds that “most agentic AI projects right now are early stage experiments or proof of concepts that are mostly driven by hype and are often misapplied,” and that “many use cases positioned as agentic today don’t require agentic implementations.”¹⁰

Gartner’s adjacent forecasts are bullish on adoption even while the release is bearish on current projects. They have 15% of day-to-day work decisions made autonomously via agentic AI by 2028, and agentic AI included in 33% of enterprise software applications.¹⁰ The two positions fit together once the layers are separated, and the separation is also the read this paper takes of the vendor “agentic OS” framings: mostly aspirational hand-waving with a thin structural skeleton underneath. The skeleton is real; the aspirational layer is mostly marketing.

Standards bodies are hardening the parts and defining no whole

The skeleton shows first in what is actually being standardised. If “agentic OS” were converging on a settled meaning, a standards body would by now be defining it, and the opposite is happening. The Linux Foundation’s Agentic AI Foundation (AAIF), formed 9 December 2025 as “a neutral, open foundation,” anchors three separate projects — Model Context Protocol for tool and data connection, goose as an agent framework and runtime, and AGENTS.md as an agent-instruction file format — backed by AWS, Anthropic, Block, Bloomberg, Cloudflare, Google, Microsoft and OpenAI.² These are the layers people informally bundle into “agentic OS,” and each is being hardened separately. No single “agentic operating system” standard exists or is being proposed.

The vendor decompositions carry the same skeleton with the same fragmentation on top. Laid side by side in the table below, the four stacks converge on similar primitives (context, memory, tools, orchestration, governance) while disagreeing on how many parts there are and what to call them. MindStudio itself counts nine components in one post and four layers in another.³¹³ One vendor cannot hold a consistent count across its own posts.

A defensible definition needs four ingredients and a detection threshold

The academic kernel is where the term is most defensible, and the definitional work in this paper still goes to the coding-project sense. The reason is scope. The kernel is a research architecture, built and benchmarked by one team; the project-level artifact is the thing a practitioner can open, audit and grade today, and it is the level where the looseness does its daily damage, because at repository level anything with a README can be called an OS. The same discipline sets the boundary on the other side. The consumer OS that hosts agents, the enterprise runtime, and the personal “life OS” or chief-of-staff layer one level up from any single project all stay out of scope. Most public usage lacks that discipline, which is why the same phrase ends up describing a Rutgers kernel and a Slack marketing page in the same week.

Scoped that way, the corpus supports a definition narrower and more defensible than any single vendor’s checklist. Strip the divergent labels from the four stacks in the table above and the same four-part skeleton appears underneath. A project-level agentic OS is a setup combining four structural ingredients: context files, memory, skills and orchestration.¹⁶⁸ The matrix below carries what each ingredient holds and where its canonical forms come from; the pattern is transferable and belongs to no one firm’s product.

The definition pairs with a graded detection rule rather than a binary, because the failure mode in this space is calling anything with a README an “OS.” An agentic OS is detected only when the context-files ingredient is present plus at least one other. Maturity is then reported as a count, fully formed at 4/4, developed at 3/4, partial at 2/4, and everything below the threshold as no OS detected. The hardest judgment the rule has to make is the line between a project that merely uses an LLM at runtime and a project set up for agent collaboration; the test is the presence of agent-collaboration artifacts, with runtime LLM calls counting for nothing.

One pass through the rule shows what it certifies and what it refuses. A repository carrying a CLAUDE.md and a directory of skills holds context files plus one other ingredient, so it clears the threshold and grades 2/4, partial.⁸ Add memory files that persist decisions across sessions and it grades 3/4, developed. Add hooks and settings that fire on session events and it is 4/4, fully formed. A repository with only a README, however detailed, is no OS detected, because the required ingredient is an agent-facing context file at the root and a README alone is not one.

Prose configuration leaks, so the maturity ladder climbs toward enforcement

A caution about the ingredients falls out of Anthropic’s own guidance, and it changes how the ladder should be read. Hard constraints do not belong in prose. A “Never do this” rule placed in CLAUDE.md will be followed “most of the time, but when under pressure… the model can fail to follow a prompted rule”; such constraints belong in hooks or permissions, because “the model choosing to run a formatter is different from the formatter running automatically.”⁸

Böckeler’s machinery explains why the two behave differently. Her decomposition sorts harness controls into feedforward “guides,” which “anticipate the agent’s behaviour and aim to steer it before it acts,” and feedback “sensors,” which “observe after the agent acts and help it self-correct,” and marks each control as either computational, “deterministic and fast, run by the CPU,” or inferential, running through the model itself as semantic analysis, AI code review, or “LLM as judge.”⁹ A prose rule is an inferential guide, and it holds only as reliably as the model’s adherence under load. A hook is a computational control, and it runs whether or not the model complies. Within the four-ingredient model, that gives orchestration a weight the other three ingredients cannot carry. Hooks, permissions and settings are the only layer that enforces. Configuration is partial protection, and an agentic OS made only of prose will leak.

The enforcement point disciplines the maturity ladder. A 2/4 setup of context files plus memory is real but unenforced; it shapes behaviour without constraining it. The climb toward 4/4 is in part a climb from suggestion toward enforcement, with standing facts in the always-loaded context file (Anthropic recommends keeping CLAUDE.md “under 200 lines”⁸), procedures in on-demand skills, and the genuinely non-negotiable rules in deterministic hooks. That load-order discipline is what the loose “agentic OS” framings skip, and it is what separates a developed setup from a partial one.

Read together, the detection rule and the enforcement point are the repository-level answer to agent washing. The rule requires context files plus at least one other ingredient, so it refuses to certify a bare README as an operating system. The enforcement point adds the harder caveat, that a setup can clear the threshold and still be all suggestion; nothing in it binds until the orchestration ingredient arrives. Gartner’s critique at the vendor level and this discipline at the repository level guard against the same failure, a label applied to something lacking the underlying substance.

References