Aegis OS：面向自主编码智能体的多租户事务化操作系统运行时

Authors:Hui Zhao (Heurion Research)

Abstract:Autonomous coding agents such as Google Antigravity (agy), Anthropic Claude Code (claude), and OpenAI Codex CLI (codex) execute multi-step software engineering workflows on workstations and cloud hosts. Existing agent environments face a Security-Autonomy Dilemma: operators must choose between per-action confirmation prompts, which interrupt workflows on 45%-57% of tool calls and induce authorization fatigue, or unconfined execution (--yolo / --dangerously-skip-permissions), which exposes host files, SSH/cloud credentials, and API tokens to prompt injection and hallucination risks. Furthermore, concurrent agents editing a shared working tree clobber one another's changes, while passing large artifacts inline through LLM context windows incurs high token overhead.
We present Aegis OS (aegis-os), a transactional, multi-tenant Agent Operating System Runtime in Rust exposed via the Model Context Protocol (MCP) and Google Agent2Agent (A2A) protocol. Aegis OS shifts the authorization boundary from individual tool calls to transactional workspace boundaries. Each agent runs inside a kernel-enforced OS sandbox (macOS Seatbelt and Linux Bubblewrap with default-deny --tmpfs $HOME isolation and a Unix-socket egress bridge) backed by a Copy-on-Write (CoW) shadow workspace (APFS clonefile; single-open Linux FICLONE reflinks), an identity-pinned HTTP Egress Proxy with L7 method/path-scoped secret injection and outbound DLP, and an A2A IPC bus with Content-Addressable Storage (CAS). Across 1,500 controlled calls and 28,087 real calls across 52 coding-agent sessions, Aegis OS reduces prompts by 94.19%-99.88% (controlled) and 90.7%-97.9% (real sessions, 1.12% IPR), lowers attack success rate across 80 attacks in eight categories from 100.0% to 0.0% on macOS and Linux, clones 1,000-file (78.1 MB) repos in 6.3 ms on APFS and 15.6 ms on btrfs, and catches 10/10 syntactic and semantic merge conflicts.

Comments:	19 pages, 3 TikZ figures, 13 tables. Open-source Rust implementation and reproducible benchmark suite available at this https URL
Subjects:	Operating Systems (cs.OS); Cryptography and Security (cs.CR); Multiagent Systems (cs.MA); Software Engineering (cs.SE)
ACM classes:	D.4.6; D.2.6; I.2.11; C.2.4
Cite as:	arXiv:2611.08516 [cs.OS]
	(or arXiv:2611.08516v1 [cs.OS] for this version)
	https://doi.org/10.48550/arXiv.2611.08516 arXiv-issued DOI via DataCite

Submission history

From: Hui Zhao [view email]
[v1] Thu, 22 Oct 2026 08:33:02 UTC (41 KB)