"Agent OS" Is Six Different Things Wearing One Name
"Agent OS" is having a moment, and the moment is confusing: the same two words name a metaphor in one paper, a research kernel in the next, a product platform in a press release, and a Windows feature in a keynote. The label has outrun any shared definition — so the useful question is not what an Agent OS is, but which of its meanings a given claim intends. This article maps the six and gives one test to tell them apart.
TL;DR
- "Agent OS" can mean an LLM-as-kernel metaphor, an academic kernel, memory virtualization, a commercial platform, an incumbent-OS feature, or an agent that operates a computer.
- The meanings overlap, but they assign the operating-system role to different components.
- The useful test is: name the resource this OS schedules, virtualizes, or isolates.
- AIOS names scheduling, context, storage, and access control. MemGPT names context paging. Windows names agent identity and isolation. Commercial uses often name a platform, not a resource.
An Agent OS is an overloaded label for six different ideas that assign operating-system responsibilities to the model, the memory layer, the agent runtime, a product platform, the incumbent OS, or the agent itself.The discriminating test is to name the resource the claimed OS schedules, virtualizes, or isolates.
That test separates a systems design from a loose analogy. It does not decide whether a product is useful — it identifies what work the word "OS" is doing.
What is an Agent OS? One term, six referents
1. LLM OS: the model as kernel
The first meaning is a metaphor about the model.
On September 28, 2023, Andrej Karpathy described large language models "not as a chatbot, but the kernel process of a new Operating System."[^1] The thread mapped the model to code execution, internet access, multimodal input, and an "embeddings database for files."
A November 11 follow-up made the mapping explicit:[^2]
"LLM OS. Bear with me I'm still cooking."
"- LLM: OpenAI GPT-4 Turbo 256 core (batch size) processor @ 20Hz (tok/s)
- RAM: 128Ktok
- Filesystem: Ada002"
Here context becomes RAM, and OpenAI's text-embedding-ada-002 becomes the filesystem. The September thread referenced roughly 10 tokens per second; the November post used 20. The LLM is the kernel rather than a process managed by one.
Nothing here has to be built as an operating system. In a June 2025 talk, Karpathy kept the frame, calling this a "1960s-ish era" of expensive, time-shared compute.[^3] The metaphor has staying power, but it schedules nothing.
2. Academic agent-OS kernels: the kernel around the LLM
The second meaning builds a services layer around agents and the LLM. Here the LLM is a resource to be scheduled, not the kernel itself.
A December 2023 vision paper drew the mapping in full: "LLM is likened to OS kernel, context window to memory, external storage to file system, hardware tools to peripheral devices, software tools to programming libraries, and user prompts to user commands."[^4]
AIOS: LLM Agent Operating System, first posted in March 2024 and published as a full paper at COLM 2025, moved from analogy toward implementation. Its kernel provides five named services: "scheduling, context management, memory management, storage management, access control."[^5]
This reverses the founding metaphor. In Karpathy's framing, the LLM is the kernel. In AIOS, the kernel manages agent requests and the scarce LLM resources beneath them.
The June 2026 Agent Operating Systems (AOS) paper pushes the argument further, contrasting traditional abstractions that "assume bounded behavior and predictable interaction patterns" with agents that are "long-lived, goal-directed entities that reason probabilistically."[^6] It names schedulers, capability registries, policy enforcement, and audit, mapped onto Linux and Windows primitives.
3. Memory-as-OS: context as virtual memory
The third meaning narrows the analogy to a single resource: memory.
MemGPT, posted on October 12, 2023, introduced virtual context management "drawing inspiration from hierarchical memory systems in traditional operating systems that provide the appearance of large memory resources through data movement between fast and slow memory."[^7]
The chronology is worth stating plainly. Karpathy's kernel tweet appeared on September 28; MemGPT reached arXiv two weeks later, on October 12; the explicit LLM-OS spec followed on November 11. The memory-as-OS sense was not derived from that spec — MemGPT predated it by a month. The two ideas co-emerged in autumn 2023.
The paging mechanics — a bounded main context, a larger external context, and self-editing under a memory-pressure signal — belong to our guide on agent-memory consolidation.[^8] For this map, the point is narrower: MemGPT gives the OS analogy a specific resource and mechanism. In September 2024 the pattern and framework were named apart: MemGPT for the self-editing design, Letta for the framework and company.[^9]
MemOS, posted in July 2025, extends the memory-centered reading. It "treats memory as a manageable system resource." Its MemCube abstraction "encapsulates both memory content and metadata such as provenance and versioning," and MemCubes can be composed, migrated, and fused over time.[^10]
4. Commercial Agent OS platforms
The fourth meaning uses "OS" for the platform an organization standardizes on.
PwC agent OS, launched on March 27, 2025, presents an enterprise command center for connecting agents and workflows across several technology providers.[^11]
Agno AgentOS, introduced with Agno 2.0 on September 9, 2025, is a pre-built FastAPI runtime with a control-plane interface. It exposes agents over REST and MCP, supports multiple agent frameworks, runs in the user's own infrastructure, and applies role-based access control.[^12]
Fiserv agentOS was announced on May 14, 2026 for banking workflows. As of July 19, 2026 it is in beta with two institutions; Fiserv states that "agentOS is expected to be widely available by August 2026," so it should not yet be described as generally available.[^13]
Warmwind entered closed beta in July 2025. Its reported design combined a Linux distribution, browser streaming, and an AI that operated graphical software by clicking, typing, and navigating.[^14] As of its last public reporting, it straddled two senses: commercial OS branding over what is technically an agent that operates a graphical environment.
These products name runtimes, orchestration, and governance, not a resource the "OS" schedules or virtualizes. Here, "OS" usually means the platform an organization builds on.
5. Agentic OS: agents inside Windows or another incumbent OS
The fifth meaning keeps the conventional operating system and places agents inside it.
Microsoft announced native MCP support in Windows at Build 2025. At Ignite on November 18, 2025, it unveiled Agent Workspace and MCP-powered agent connectors in preview. Microsoft describes the workspace as "a contained, policy-controlled and auditable environment where agents can interact with software with their own identity."[^15]
This is a literal security design. The agent receives an identity; the workspace supplies an isolation boundary.
Agents are moving into the incumbent OS at Apple too — agentic Siri reached developer beta as of mid-2026 — though Apple does not use the "Agent OS" label.[^16]
6. OS agents: agents that operate the OS
The sixth meaning reverses the dependency. An OS agent does not provide an operating system for other agents; it uses a computer or mobile operating system as its environment.
The OS Agents survey, posted in August 2025 and listed as an ACL 2025 Oral, defines these systems as agents "using computing devices … by operating within the environments and interfaces (e.g., Graphical User Interface (GUI)) provided by operating systems."[^17]
Computer-use and GUI agents fit here. Warmwind belongs here too, despite wearing the commercial branding of the fourth sense.
The Agent OS test: what resource does it manage?
The six meanings separate cleanly once each answers the same question.
| Sense | Resource named | Verdict |
|---|---|---|
| 1 — LLM-as-kernel metaphor | none | Metaphor, not mechanism. |
| 2 — Academic kernels (AIOS, AOS) | agent-request scheduling, LLM bandwidth, context, access control | Load-bearing engineering. |
| 3 — Memory-as-OS (MemGPT, MemOS) | context tokens (paging), MemCube migration | Load-bearing (one resource). |
| 4 — Commercial branding | often none | "OS" = platform standardization; governance, not scheduling. |
| 5 — Agentic OS (Windows) | agent identity → isolation boundary | Most literally load-bearing. |
| 6 — OS agents (inversion) | n/a — the OS is the environment | The agent consumes OS services; the test does not apply. |
The test is a lens, not a verdict on anyone's worth. A platform can fail it and still provide useful deployment or governance functions. The result only tells you whether "OS" is doing systems work or standing in for "the platform you standardize on."
The operating-system analogy map
The analogy is strongest when both sides name a concrete interface or a constrained resource.
| OS concept | Agent-world mapping | Load-bearing or marketing? |
|---|---|---|
| Scheduler | agent-request scheduling in AIOS; memory scheduling in MemOS | Load-bearing in AIOS and MemOS; rarely specified in commercial "Agent OS" — marketing when unspecified. |
| Syscalls ↔ tools | tool calls / MCP invocations | Load-bearing — the tool call is the syscall analogue. Real across senses. |
| IPC ↔ A2A / MCP | agent↔agent messaging (A2A); agent↔tool calls (MCP) | Load-bearing, but A2A and MCP move information; neither defines persistent shared memory.[^18] |
| Memory hierarchy ↔ context / memory tiers | main context (RAM) vs external context (disk); MemGPT paging | The single most defensible borrow — virtual memory → context paging. |
| Shared memory ↔ multi-agent stores | common vector store / blackboard / knowledge graph | Load-bearing where it exists, but unstandardized — teams improvise a shared backend as the de-facto protocol.[^18] |
| Users / permissions | AIOS access control; AOS policy enforcement; Windows agent-as-identity | Load-bearing in AIOS/AOS/Windows; a pitch line in most commercial branding until a boundary is named. |
| Filesystem | embeddings (Ada002 metaphor); AIOS storage service; real FS + agent access (Windows) | Mixed: metaphor in sense 1, real service in 2/3/5. |
The IPC and shared-memory corners are where the map is thinnest. Both protocols move information but stop short of persistent shared state: neither specifies how agents share it with clear identity, schema, provenance, consistency, and permissions. That gap is a live engineering problem, covered in the agent-memory interoperability gap.
What the Agent OS label is likely to become
The term may not settle on one definition. Its meanings attach to different resources and different buyers.
Academic kernels can grow more precise by naming scheduling policy, context boundaries, and access-control mechanisms. Memory operating systems can be judged by what they page, retain, migrate, and verify. Incumbent operating systems can expose concrete identities, permissions, and isolation boundaries for agents.
Commercial platforms face a different choice. They can keep using "OS" as shorthand for a standard orchestration layer, or they can specify the resource boundary beneath the label. Buyers can put the same test question to any platform.
That distinction gives engineers a practical review method. Ignore the name first. Ask what is scarce, who controls it, and what boundary the system enforces.
Common questions
What is an Agent OS?
An Agent OS is an overloaded label for six ideas: an LLM-as-kernel metaphor, an academic agent kernel, a memory manager, a commercial platform, an agentic feature inside an existing OS, and an agent that operates an OS.
What is the difference between an Agent OS and an LLM OS?
LLM OS usually treats the language model as the kernel. Agent OS more often refers to services built around agents — scheduling, context management, storage, access control, orchestration, or isolation.
Is MemGPT an operating system?
MemGPT is not a general-purpose operating system. It applies the virtual-memory analogy to context management, moving information between a bounded main context and larger external storage.
What is AIOS?
AIOS is a research kernel that provides scheduling, context management, memory management, storage management, and access control for agents. It treats the LLM as a resource to schedule rather than the kernel itself.
What is an agentic OS?
An agentic OS places agents inside an existing operating system with controlled access to applications and resources. Windows Agent Workspace, in preview, illustrates it through agent identity and isolation.
How do you evaluate an Agent OS claim?
Ask which resource the system schedules, virtualizes, or isolates. A precise answer makes the OS analogy load-bearing; no answer usually means "OS" is being used as a platform label.
Related
- Ontology, schema, and topology dialects — the genre twin: one word, many dialects, one test
- The agent-memory interoperability gap — the IPC and shared-memory corner: what no protocol specifies
- Memory, from DRAM to agents — the map's twin: one word, twelve layers, and where "OS memory" sits
- AI agent memory — the cluster hub on persistent agent memory
- Agent-memory consolidation — MemGPT paging and offline consolidation
- A2A vs. MCP — how MCP and A2A differ and compose
— Edward Izgorodin · Last updated 2026-07-19
[^1]: Karpathy, A. (2023-09-28). Tweet. https://x.com/karpathy/status/1707437820045062561 [^2]: Karpathy, A. (2023-11-11). Tweet. https://x.com/karpathy/status/1723140519554105733 [^3]: Karpathy, A. (2025-06-17). YC AI Startup School talk "Software Is Changing (Again)." [^4]: Ge, Y., Ren, Y., Hua, W., Xu, S., Tan, J., & Zhang, Y. (2023). LLM as OS, Agents as Apps: Envisioning AIOS, Agents and the AIOS-Agent Ecosystem. arXiv:2312.03815. [^5]: Mei, K., Zhu, Z., Xu, Z., et al. (2024). AIOS: LLM Agent Operating System. arXiv:2403.16971. COLM 2025. [^6]: Sharma, A., & Shah, D. (2026). Agent Operating Systems (AOS): Integrating Agentic Control Planes into, and Beyond, Traditional Operating Systems. arXiv:2606.01508. [^7]: Packer, C., Wooders, S., Lin, K., Fang, V., Patil, S. G., Stoica, I., & Gonzalez, J. E. (2023). MemGPT: Towards LLMs as Operating Systems. arXiv:2310.08560. [^8]: Mnemoverse Library. Agent Memory Consolidation — Offline Writing to Long-Term Stores. /library/agent-memory-consolidation [^9]: Letta. (2024-09-23). MemGPT Is Now Part of Letta. https://www.letta.com/blog/memgpt-and-letta/ [^10]: MemTensor et al. (2025). MemOS: A Memory OS for AI System. arXiv:2507.03724. [^11]: PwC. (2025-03-27). Agent OS. https://www.pwc.com/us/en/services/ai/agent-os.html [^12]: Agno. (2025-09-09). Introducing Agno 2.0. https://www.agno.com/agentos [^13]: Fiserv. (2026-05-14). Fiserv Launches agentOS, Operating System for Agentic AI in Banking. https://investors.fiserv.com/news-releases/news-release-details/fiserv-launches-agentos-operating-system-agentic-ai-banking [^14]: Warmwind / eva AG. (2025-07-03). Closed beta announcement. https://www.bgr.com/tech/the-worlds-first-ai-operating-system-wants-to-automate-your-workflow/ [^15]: Microsoft Windows Experience Blog. (2025-11-18). Ignite 2025: Windows at the frontier of work. https://blogs.windows.com/windowsexperience/2025/11/18/ignite-2025-windows-at-the-frontier-of-work/ [^16]: Koetsier, J. (2026-06-09). Apple Siri AI Agent Features. Forbes. https://www.forbes.com/sites/johnkoetsier/2026/06/09/apple-siri-ai-agent-features/ [^17]: OS Agents survey authors. (2025). OS Agents: A Survey on MLLM-based Agents for General Computing Devices Use. arXiv:2508.04482. ACL 2025 Oral. [^18]: Mnemoverse Library. The Agent Memory Interoperability Gap. /library/agent-memory-interop-gap