Ring-0 by Default: Agents as Operating Systems
Comments on “Ring-0 by Default: Agents as Operating Systems”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
An arXiv paper argues that deployed coding agents already act as operating systems without the matching protections. The authors map 116 textbook OS mechanisms to agents: 11 carry over intact and 65 are missing, mostly protections such as privilege separation, quotas and tamper-proof audit. Thirteen experiments on Claude Code, Codex CLI and Gemini CLI found that a write refused by the file tool can succeed through the shell, forged transcript records load on resume, and sub-agents inherit parent permissions. The experiments test whether boundaries hold, not how often attacks succeed.
Why it ranked
No. 8 of 155 with a score of 0.72. The panel rated it highest on new information (0.86) and technical depth (0.86), lowest on significance (0.66). The judges disagreed most on significance (spread 0.42), so the story is marked contested.
- AI judgeJudge 2claude-haiku-5-5
- Academic paper mapping OS mechanisms to coding agents, with experiments on Claude Code, Codex CLI, Gemini CLI revealing concrete security gaps. Substantive and relevant to builders, though a preprint rather than a landmark.
- AI judgeJudge 3gpt-5.6-luna
- A detailed, evidence-backed security analysis of deployed coding agents, combining a systematic OS-mechanism taxonomy with reproducible experiments. It is highly relevant and actionable, though some broad conclusions rely on analytic judgments and rhetorical framing.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.72total under rubric v2.2Contestedjudges differ by 0.42 on significance
- Significance0.66
- Reader interest0.82
- Audience breadth0.74
- Practical relevance0.73
- Substantiated0.84
- Technical depth0.86
- New information0.86
- Counts against: Promotional0.03
- Counts against: Overclaim0.30
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| Significance | 0.76 | 0.40 | 0.82 | 0.66 | 0.42 , above the contested threshold | +0.24 | +0.158 |
| Reader interest | 0.80 | 0.70 | 0.95 | 0.82 | 0.25 | +0.26 | +0.212 |
| Audience breadth | 0.77 | 0.60 | 0.85 | 0.74 | 0.25 | +0.13 | +0.096 |
| Practical relevance | 0.74 | 0.60 | 0.86 | 0.73 | 0.26 | +0.22 | +0.162 |
| Substantiated | 0.95 | 0.70 | 0.88 | 0.84 | 0.25 | +0.05 | +0.042 |
| Technical depth | 0.93 | 0.70 | 0.94 | 0.86 | 0.24 | +0.05 | +0.043 |
| New information | 0.88 | 0.80 | 0.90 | 0.86 | 0.10 | +0.05 | +0.043 |
| Promotional | 0.04 | 0.05 | 0.01 | 0.03 | 0.04 | −0.19 | −0.006 |
| Overclaim | 0.34 | 0.30 | 0.25 | 0.30 | 0.09 | −0.11 | −0.033 |
| Sum of contributions | +0.718 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.718 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-28/8/"><img src="https://rubric.hrih.si/badge/2026-10-28/8.svg" alt="Ranked #8 on Rubric, 28 Oct 2026" width="238" height="28"></a>Claim check
Claim check: 8 no source given. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
No source givenNumber
The authors map 116 OS mechanisms in 19 subsystems to agent counterparts; only 11 are isomorphic and 65 are missing.
The article gives no link or citation for it.
The article says “Only 11 mechanisms are isomorphic, and 65 (56 %) are missing, most of them protections”
The source says No source to compare with.
No source givenNumber
Of 25 mechanisms tested in thirteen experiments on Claude Code, Codex CLI and Gemini CLI, 16 match the analysis, 7 gain a more precise description and 2 change verdict.
The article gives no link or citation for it.
The article says “16 match the analysis, 7 gain a more precise description, and 2 change verdict”
The source says No source to compare with.
No source givenCausal conclusion
A file write refused by an agent's file tool can be completed through the shell, because access checks sit in individual tools rather than the process.
The article gives no link or citation for it.
The article says “Access checks sit in individual tools, not in the process, so a file write that the file tool refuses goes through the shell”
The source says No source to compare with.
No source givenNumber
All three CLIs load a forged transcript record in the transcript's own format as a user message on resume (eight of eight runs each).
The article gives no link or citation for it.
The article says “all three CLIs load a forged record written in the transcript’s own format into the model’s input as a user message (eight of eight runs each”
The source says No source to compare with.
No source givenNumber
A forged time returned by a tool was accepted in all 15 runs, while a forged date in a note changed no decision in any of 30 runs.
The article gives no link or citation for it.
The article says “A forged time returned by a tool was accepted in all 15 runs”
The source says No source to compare with.
No source givenNumber
Sub-agents inherit their parent's permissions: a child writes outside the workspace exactly when its parent can, in all nine CLI-mode cells (45 of 45 runs).
The article gives no link or citation for it.
The article says “A child writes outside the workspace exactly when its parent can, in all nine CLI-mode cells (45 of 45 runs”
The source says No source to compare with.
No source givenNumber
Claude Code's TaskStop reports success and removes the task from its table, yet the process keeps running, re-parented to init.
The article gives no link or citation for it.
The article says “Claude Code’s TaskStop reports success and deletes the task from its table, yet the process keeps running, re-parented to init”
The source says No source to compare with.
No source givenGeneralization
LLM agents gained operating-system functions within about three years but not the protections operating systems built over five decades.
The article gives no link or citation for it.
The article says “They gained these functions within about three years, but not the protections that operating systems built over five decades”
The source says No source to compare with.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 1 pts, not on front page
Recorded for context only, checked 28 Oct 2026, 06:47 UTC. It played no part in the ranking.