Ring-0 by Default: Agents as Operating Systems

An arXiv paper argues that deployed coding agents already act as operating systems without the matching protections. The authors map 116 textbook OS mechanisms to agents: 11 carry over intact and 65 are missing, mostly protections such as privilege separation, quotas and tamper-proof audit. Thirteen experiments on Claude Code, Codex CLI and Gemini CLI found that a write refused by the file tool can succeed through the shell, forged transcript records load on resume, and sub-agents inherit parent permissions. The experiments test whether boundaries hold, not how often attacks succeed.