AI-Native Operating Systems: When Agents Become Part of the OS

An AI-native operating system is one designed with AI agents as a core layer, able to understand requests and act across apps, rather than bolting a chatbot onto a traditional OS. In 2026 no mainstream platform is fully AI-native yet: Windows, Android and Apple are adding agent layers inside existing systems instead.

This guide explains what an AI-native OS would do, what Microsoft, Google, Apple and Chinese phone makers actually shipped by September 2026, how well agents can really operate computers, how permissions and security work, why app makers are pushing back — and what it means for businesses and the UAE.

Key takeaways

• The agent layer is arriving inside today's operating systems. Windows has MCP-based agent connectors and an Agent Workspace in preview; Android calls itself an "intelligence system"; Siri AI takes actions across apps through App Intents.
• The label is contested. Microsoft's Windows chief stopped calling Windows an "agentic OS" after a customer backlash in November 2025.
• Agents beat people on short tasks, not long ones. The best verified agents score above 80% on OSWorld's short computer tasks, against about 72% for humans; on long workflows the best completes 20.6%.
• Security is the brake. Microsoft warns that prompt injection could lead to data theft or malware, and the UK's NCSC says prompt injection may never be fully mitigated.
• App makers are resisting. Chinese apps blocked ByteDance's Doubao phone, Google Play bans autonomous accessibility agents, and the EU is forcing Android to open AI features to rival assistants.

What is an AI-native operating system?

An AI-native operating system is an OS in which AI agents are a built-in layer — understanding intent, planning steps and acting across apps and files under the user's permissions — rather than an app running on top.

Definition

AI-native operating system — an operating system designed with AI as its core rather than as an add-on, in which agents can understand a goal, plan the steps and carry them out across apps and data, within permissions the user or organisation sets. No standards body defines it; vendors use "agentic OS" or "intelligence system" for similar ideas.

A traditional operating system is, in NIST's words, the "master control application" that runs the computer: it manages hardware, files and apps, and people drive everything through windows and taps. The AI-native idea moves the steering wheel: you state an outcome, and an agent layer works out which apps and data to use. The idea has several names:

Term	Who uses it	What it means
LLM OS	Andrej Karpathy (2023 talk)	A metaphor: the language model as the kernel that coordinates tools, memory and apps
AIOS	Academic research (2024)	An agent operating system that schedules and isolates many LLM agents
Agentic OS	Microsoft (2025), Rabbit	An operating system where agents act for users, alongside apps
Intelligence system	Google (2026)	Android shifting "from an operating system to an intelligence system"
AI-native OS	Vendors and trade press	Everything from business software to planned device systems

In practice the phrase is used loosely. It's applied to accounting platforms and enterprise agent platforms as often as to anything that boots a computer — so check what's being claimed before you believe a "first AI-native OS" headline.

How would an AI-native operating system work?

It would turn a request into actions through a stack of layers: understand the intent, plan, call app functions directly where possible, control the screen where not, and keep every step inside permissions and logs.

The agent layer in an operating system

1. 01Intent
   • Voice
   • Text
   • On-screen context

   The user states an outcome, not a sequence of clicks

2. 02Plan
   • Model
   • Memory
   • Personal context

   The agent breaks the goal into steps across apps

3. 03App functions
   • App Intents
   • AppFunctions
   • MCP

   Apps expose actions the agent can call directly

4. 04Screen control
   • Virtual display
   • Taps and clicks
   • Fallback

   Used when an app offers no structured interface

5. 05Permissions
   • Agent accounts
   • Containers
   • Consent

   What the agent may touch, enforced by the OS

6. 06Audit
   • Logs
   • Hand-back
   • Undo

   Sensitive steps return to the user; everything is recorded

The key design choice is how the agent reaches inside apps:

Method	How it works	Examples	Strength	Weakness
Structured functions	Apps declare actions the agent can call	Apple App Intents; Android AppFunctions ("Android MCP"); MCP servers on Windows	Fast, reliable, app stays in control	Only works where the developer built it
Screen control	The agent reads the screen and simulates input	Android Computer Control; Copilot Actions on Windows; Doubao phone	Works with any app	Slower, fragile, easier to hijack; often restricted

The browser is the other front line, where agents act on websites rather than apps — see AI browsers.

What have Windows, Android and Apple actually shipped?

By September 2026, all three had shipped agent building blocks, mostly in preview or beta, with permission models that keep agents off by default or confined.

Platform	What's shipped	Status	How permissions work
Windows 11	MCP on Windows with an on-device registry of agent connectors; Agent Workspace; Copilot Actions; Microsoft Execution Containers for isolating agents	Previews; experimental features off by default	Admin-only toggle; each agent runs under its own account; containment and audit principles
Android	AppFunctions; Gemini automating tasks in 40+ apps; Computer Control for preloaded assistants; Googlebook laptops built on Android	AppFunctions experimental; automation in beta in the US and Korea; Googlebook in stores 4 October	System-privileged permissions; transactions handed back to the user
Apple	Siri AI with personal context, onscreen awareness and systemwide app actions; developers connect through App Intents	Beta since 14 September, English only; delayed in the EU	App-defined actions; admins can restrict Siri AI through device management

Microsoft. At Ignite in November 2025, Microsoft put the Windows On-Device Registry — a catalogue of "agent connectors, which are just MCP servers" — into public preview and Agent Workspace into private preview. Its support page is candid: the experimental agentic features setting is off by default, can only be switched on by an administrator, and then applies to every user on the device; each agent gets its own account. In June 2026 Microsoft introduced Execution Containers to declare and enforce what an agent may access — though the project's own code repository says its profiles shouldn't yet be treated as security boundaries.

Google. In February 2026 Google introduced AppFunctions so apps can expose data and actions to agents, and began letting Gemini complete multi-step tasks in a curated set of food-delivery, grocery and ride-hailing apps; by July that reached more than 40 apps. Its Computer Control framework lets only phone-maker-preloaded assistants operate apps on a hidden virtual display, with transactions handed back to the user. Googlebook laptops, built on Android with ChromeOS desktop foundations, start at $899.

Apple. Siri AI, unveiled at WWDC in June 2026 and in beta since 14 September, offers "systemwide app actions"; Apple's updated App Intents framework lets developers connect apps to Siri AI's personal context, app actions and onscreen awareness.

Common misconception

"Windows 11 is now an agentic OS." The agent features are opt-in previews, off by default and administrator-controlled. After a "quick and biting" backlash to his November 2025 post, Windows chief Pavan Davuluri stopped using the phrase, according to GeekWire, and Microsoft pledged in March 2026 to reduce unnecessary Copilot entry points in apps such as Notepad and Photos.

What about China and AI-first devices?

China has moved fastest on phones. Huawei built an agent framework into HarmonyOS, Honor shipped its YOYO agent, and ByteDance's Doubao assistant — embedded in a ZTE Nubia phone in December 2025 — could operate other apps for users until Alipay, Taobao, Pinduoduo and Ele.me restricted it and users reported WeChat blocking their logins, as the South China Morning Post reported.

The first AI-first gadgets are cautionary tales. The Verge found "basically no evidence" of Rabbit's large action model at work in its 2024 R1 review, and only about 5,000 of roughly 100,000 buyers were using the device at any one time. HP bought Humane's CosmOS platform, staff and patents for $116 million in February 2025, and Humane's AI Pins stopped working. OpenAI's first device won't ship before the end of February 2027 — see personal AI agents across devices. The form factors that have found buyers — glasses, earbuds and watches — are covered in AI wearables.

How well can AI agents operate a computer?

On short, well-defined tasks the best agents now match or beat people; on long, realistic workflows they still fail most of the time.

What the data shows

• Baseline (April 2024): on OSWorld's 369 real computer tasks, humans completed 72.36%; the best AI model managed 12.24%. — OSWorld (arXiv)
• Short tasks (verified results, data to August 2026): 16 entries on the OSWorld-Verified leaderboard scored above the human baseline; the top agent scored 90.19%. — XLANG Lab
• Long tasks (June 2026): on OSWorld 2.0's 108 long workflows, which take people a median of about 1.6 hours, the best agent completed only 20.6%. — OSWorld 2.0 (arXiv)
• Hijacking (January 2025): in NIST testing, a new attack raised the success rate of agent hijacking from 11% to 81%. — NIST

What this means

The gap between short and long tasks is the whole story. An agent that books one appointment reliably is useful now; an agent that runs a half-day workflow across ten apps unsupervised is not. Design agent use around short, checkable steps with a person in the loop.

What are the security risks of an AI-native OS?

The biggest risk is that an agent with system-level access can be tricked by content it reads — a web page, email or document — into acting against its user.

• Cross-prompt injection. Microsoft warns that malicious content in documents or interface elements can override agent instructions, "leading to unintended actions like data exfiltration or malware installation".
• Not fully fixable. The UK's National Cyber Security Centre says prompt injection may never be totally mitigated the way SQL injection can be, and OpenAI has said the same.
• Optional security in the plumbing. The Model Context Protocol's July 2026 specification makes authorisation optional for implementations, so each connector's security depends on who built it.
• Blast radius. An agent operating at OS level can reach files, accounts and other apps — which is why Windows gives agents separate accounts and why Android restricts computer control to privileged assistants.

For organisations, treat OS-level agents as a new class of identity: inventory them, give them least privilege, log what they do and decide centrally whether experimental agent features are allowed. The AI governance guide sets out the controls.

Why are app makers pushing back?

Because whoever controls the agent layer controls the customer relationship: if an assistant can order the food, book the ride and pay the bill, the app becomes a back-end supplier.

• Chinese super-apps blocked Doubao within days; ByteDance then disabled its control of WeChat and its use in banking and payment apps and competitive games.
• Google restricts autonomous agents on its own platform. Play policy prohibits any use of the Accessibility API that lets an app "autonomously initiate, plan, and execute actions or decisions", while allowing rule-based automation.
• Regulators are forcing access. In July 2026 the European Commission specified that Google must give rival AI assistants access to 11 Android features, including screen automation currently reserved for Google's own services; Google argues this threatens device security.
• Apple is holding back in Europe. Apple says the EU's interpretation of the DMA would force it to give any assistant direct access to private data and control of other apps, and has delayed Siri AI in the EU.

Expert takeaway

If you publish an app, decide how agents should reach it. Exposing clean, permissioned actions through App Intents, AppFunctions or MCP keeps you in control of what agents can do — and makes you the easy choice when an assistant is picking where to book or buy. Leaving agents to scrape your screens invites errors and gives you no say.

What does this mean for businesses?

For most businesses the practical questions are about devices you manage, apps you publish and data agents can reach — not about switching operating systems.

1. Set a policy for OS agent features. Decide whether experimental agent features may be enabled on company devices, and manage them through device management (Intune on Windows, MDM restrictions on Apple).
2. Inventory agents as identities. Personal agents and developer tools increasingly run on employee machines; treat them like software with credentials.
3. Expose actions, not screens. If you run an app or portal, publish structured actions so assistants use them correctly.
4. Keep humans on irreversible steps. Payments, deletions and external messages should hand back to a person — the model Android and most agents already follow.
5. Measure on long tasks. Pilot agents on real multi-step workflows before trusting benchmark scores built on short tasks.

What does this mean for the UAE?

The UAE's government is betting on agents faster than most, while device-level AI still has gaps in Arabic.

• Government agents at scale. The UAE Cabinet's April 2026 framework targets agentic AI across 50% of government sectors and operations within two years — so residents will meet agents in public services whatever device they use.
• Arabic gaps at OS level. Apple Intelligence doesn't yet support Arabic, and Siri AI launched in English only; Google's Gemini and Microsoft's Copilot do accept Arabic.
• Regional OS ambitions. Saudi Arabia's HUMAIN has announced an "AI-native" Linux operating system with commercial availability planned for 2027 — a vendor plan, not a shipping product.
• Compliance. Agents on company devices process personal data, so the UAE's data-protection rules and free-zone regimes apply to what they read and send.

How will AI-native operating systems affect real estate?

In property, the "OS" idea is being applied to the business workflow itself: platforms are positioning agent layers that run the transaction from search to paperwork.

Germany's Scout24 presented an "Agentic OS for Real Estate" in May 2026, combining an intelligence layer with an "Agent Factory" of specialised agents across the transaction lifecycle — a vendor strategy, not an operating system you install. In Dubai, the Land Department's AI-assisted registration service reads IDs, passports and contracts and approves compliant standard transactions on submission. For brokerages, the practical version is an agentic CRM that orchestrates WhatsApp, calls, viewings and documents — see the agentic real estate CRM guide and the Dubai proptech guide.

What is likely to happen next?

Expect agent layers to spread through mainstream operating systems in stages, with regulation and security deciding the pace.

• Consumer devices. Googlebook ships in October; Apple expands Siri AI's languages; Microsoft keeps its agent features in preview until containment matures.
• Regulated openness. Google's EU deadlines for opening Android AI features to rivals run to Android 18 and August 2027.
• Standards for agent security. China's standards body TC260 published a draft agent-security guide in September 2026; expect similar guidance elsewhere.
• New entrants. OpenAI's device (no earlier than 2027) and planned regional systems will test whether a genuinely AI-native OS can win users.

The broader agent picture is in agentic AI explained.

Final takeaway

The AI-native operating system is arriving as a layer, not a replacement: Windows, Android and Apple are building agents into the systems people already use, with previews, permission prompts and hand-backs rather than full autonomy. Agents now match people on short computer tasks but fail most long ones, prompt injection remains unsolved, and app makers are fighting for control of the customer. Businesses should manage agent features like any powerful new identity, expose clean actions in their own apps, and keep a person on every step that can't be undone.