Jinhao Hu, Ashvin Goel, and I have a paper at AgenticOS 2026 (2nd Workshop on Operating Systems Design for AI Agents), and Bardia Mohammadi and I have a second one at the same workshop. Both are co-located with SOSP 2026 in Prague on September 29. Jinhao, Ashvin, and I also have a paper at PACMI 2026 (5th Workshop on Practical Adoption Challenges of ML for Systems), which runs the same day at the same venue. Three papers, one trip.
Externalization Barriers
Externalization Barriers: An OS Abstraction for Untrusted Agent Exploration
An agent that explores on its own has to write things down: scratch files, notes, intermediate state. Where should that state live when you do not trust the agent writing it? Externalization Barriers is an OS abstraction that lets an untrusted agent explore freely while the kernel controls what leaves the exploration sandbox, and when. The agent can work, and the system decides what gets externalized. This is joint work with Jinhao Hu and Bardia Mohammadi, advised by Ashvin Goel.
The Irreversibility Budget
Some agent actions can be undone and some cannot, and the second kind is where all the risk lives. This paper proposes treating irreversible actions the way an OS treats scarce resources: account for them at fleet level, budget them, and make admission control decisions before the agent acts, rather than after the damage is done. There is a pricing story here too, and Bardia Mohammadi led the work.
Don't Trust the Code, Check Its Effects
Don't Trust the Code, Check Its Effects
Generated code keeps failing in production for a boring reason: we judge it by what it looks like instead of what it does. This paper argues for checking the effects of ML-generated code at runtime, and reports on what that takes in practice, from the perspective of someone who actually tried to deploy it. Another joint effort with Jinhao Hu and Ashvin Goel, written for PACMI, a workshop about exactly this gap between ML-for-systems papers and systems that run.
Keynote at AgenticOS
I am also giving the keynote at AgenticOS, on operating system design for AI agents. The talk draws on what we have learned building agent runtimes over the past two years, and argues that the OS has a job to do here: agents need a substrate that constrains what they can do without slowing down what they should do. If you are at SOSP or either workshop, I would be happy to meet you there.