Active development: 50 commits across 6 contributors
Code ActivitySource linked
5 active day(s) in use-agent-os/agent-os.
AgentOS
$AgentOSDev Tools · Uncategorised
Verified BuilderToken-efficient, Microkernel Al agent with on-device model routing across CLI, Web Ul, and chat.
ShippingLast ship 4h ago
Latest ship
Builder activity
Build timeline
AgentOS 2026.9.10
Github ReleaseSource verified
A contributor-fix release. Twenty-six community PRs and one new CLI flag — most of this one is a single theme: operations that reported success while writing to the wrong place, or writing nothing at all. Writes that landed somewhere else The Microsoft Teams adapter's edit() and delete() resolved a conversation reference with next(iter(self.references.values())) — whichever conversation happened to be cached first — and ignored messageid entirely. With a single conversation cached the bug is invisible; with two, an edit or a delete lands on someone else's thread and reports succes
View evidenceActive development: 48 commits across 8 contributors
Code ActivitySource linked
5 active day(s) in use-agent-os/agent-os.
View evidenceAgentOS 2026.9.9
Github ReleaseSource verified
A contributor-fix release. Twenty-six community PRs, no new surface — this one splits cleanly into two themes: credentials the sandbox was not guarding, and work that was quietly lost while the tool reported success. Credentials the sandbox was not guarding The sensitive-path denylist matched on directories. ~/.ssh, ~/.aws, ~/.kube and the rest were all prefixes, so a credential file sitting anywhere else was invisible to it — ~/.git-credentials, ~/.pgpass, ~/.dockercfg, ~/.htpasswd and ~/_netrc reached the executor unguarded, past a block that is meant to survive user
View evidenceActive development: 55 commits across 5 contributors
Code ActivitySource linked
5 active day(s) in use-agent-os/agent-os.
View evidenceAgentOS 2026.9.7
Github ReleaseSource verified
A contributor-fix release. Sixteen community PRs, no new surface — this one is mostly about guards that could be walked around: a denylist that read the text the user typed rather than the command the shell would run, a code scanner that stopped at the first wrapper, and a hard block whose regex never matched the thing it names. Guards that could be walked around The sensitive-path denylist was reading a different string than the executor. Tool dispatch ends in a shell, so cat $HOME/.ssh/config reaches the syscall as ~/.ssh/config, while the scanner only ever saw the literal text — a di
View evidenceActive development: 48 commits across 6 contributors
Code ActivitySource linked
5 active day(s) in use-agent-os/agent-os.
View evidenceAgentOS 2026.9.6
Github ReleaseSource verified
A contributor-fix release. Thirteen community PRs, no new surface — this one is mostly about MCP: two transports that could not talk to a compliant server at all, a third that leaked its connection on every close, and a bridge that forwarded whatever a model handed it straight through to SQLite. MCP transports that never worked against a compliant server The stdio client was speaking the wrong protocol. MCPStdioClient wrote Content-Length: N\r\n\r\n to the server's stdin — LSP framing — and rejected any reply that did not carry the same header with `Missing Content-Length header
View evidenceAgentOS 2026.9.5
Github ReleaseSource verified
A contributor-fix release. Fourteen community PRs, one new pricing surface — this one is mostly about shared state: connections two coroutines write at once, caches that never evicted, and a task that cancelled itself. Direct providers stop being billed at the placeholder rate Point AgentOS at api.deepseek.com or generativelanguage.googleapis.com and every model on it was billed at DEFAULTPRICING — $3.00 in, $15.00 out per 1M tokens. Bare ids without a vendor prefix (deepseek-chat, deepseek-reasoner, gemini-2.0-flash) and date-stamped snapshots (claude-3-7-sonnet-20250219, `
View evidenceActive development: 44 commits across 10 contributors
Code ActivitySource linked
5 active day(s) in use-agent-os/agent-os.
View evidenceAgentOS 2026.9.4
Github ReleaseSource verified
A contributor-fix release. Seventeen community PRs, no new surface — this one is about the places AgentOS was quietly wrong rather than anything new it can do. agentos config set stops lying Two separate failures met in the same command. skills.config. . — a documented, published example — could never be written: setkey only overwrote keys already present in totomldict(), and an empty skills.config is omitted there for rollback compatibility, so the map the command needed to write into did not exist to be found. Missing intermediates are now created under `skills.co
View evidenceActive development: 48 commits across 13 contributors
Code ActivitySource linked
4 active day(s) in use-agent-os/agent-os.
View evidenceActive development: 50 commits across 14 contributors
Code ActivitySource linked
2 active day(s) in use-agent-os/agent-os.
View evidenceAgentOS 2026.9.3
Github ReleaseSource verified
A release about output that never reached the screen, and addresses that were never checked against the chain. The render was the model's decision, so it did not happen Skills could already publish an artifact — a chart, and as of this release a card grid — and the model was supposed to call publish_artifact when one was written. Live-testing the card renderer produced the same outcome seven times across two models: the script ran, the payload was written to the workspace, and the answer came back as a hand-written markdown table. ~/.agentos/media/artifacts/ stayed empty. A render that
View evidenceAgentOS 2026.9.2
Github ReleaseSource verified
A release about numbers that were already there and nobody read — the price a marketplace of sellers is quoting right now, the dollars the router saved on every turn since it shipped — and about four gates that were checking something adjacent to the thing they were supposed to guard. A provider where sellers compete on price Surplus Intelligence (surplus) joins as a runtime provider. It is a two-sided marketplace: each request is routed to the cheapest healthy seller. Configuration is ordinary — an OpenAI-compatible provider with a buyer API key (SURPLUSAPIKEY, inf_…) against `
View evidenceAgentOS 2026.9.1
Github ReleaseSource verified
A release about the blast radius of a shared surface. Projects turned out to be one — shared knowledge text, editable by any member session, injected into every member's system prompt — and three of the fixes below are about drawing that boundary properly. Alongside it, the gateway learns to say what it is doing while it runs. Projects: one prompt injection should not reach every session A project's knowledge text is injected into the system prompt of every member session, every turn. That makes it the highest-value write target in the product, and the projects_* agent tools handed it
View evidenceAgentOS 2026.8.29
Github ReleaseSource verified
A release about reaching the agent by email, and about the places where output left the process without being counted — bytes into memory, secrets into the transcript. Email is a channel A mailbox is now a first-class channel (type = "email"). Inbound over IMAP polling, outbound over SMTP with In-Reply-To/References so a reply stays in the mail thread it answers. There is no platform app to register — IMAP/SMTP credentials are the whole setup. One mail thread is one session. Quoted history is stripped before the text reaches the model, HTML-only mail is flattened to text, and inbound
View evidenceAgentOS 2026.8.28
Github ReleaseSource verified
A release about giving sessions a place to live. Chat sessions can now be grouped into projects that carry shared knowledge into every member session's prompt, and the cron parser stops arguing with operators about what a perfectly ordinary expression means. Projects Sessions can now be grouped into projects — and a project sits above agents, not inside one. Sessions of any agent can join the same project; the project's agent field is only the default for "New chat in project". The part that does the work is knowledge: each project carries a free-form text that is injected into the
View evidenceAgentOS 2026.8.27
Github ReleaseSource verified
A release about ceilings and about what a file hands back. Money gets a hard stop that survives a restart, a skill zip stops being a way to take the gateway down, a credential read out of a config file stops landing in the transcript, and three subsystems that shipped in the wheel while doing nothing are gone. A budget you can actually hit A new [budgets] config section sets money ceilings — per session, per UTC day, per agent, per channel: [budgets] sessionlimitusd = 5.00 sessionwarnusd = 4.00 dailylimitusd = 50.00 dailywarnusd = 40.00 A turn that starts at or above a
View evidenceAgentOS 2026.8.24
Github ReleaseSource verified
A release about who is allowed to say yes, and what a turn actually cost. Channel approvals become a button that checks who pressed it, cost stops being a number you only see at the end of the month, Aeon joins the Partner Skills shelf, and four ways into the gateway close behind us. An approval is a button now — and it checks who pressed it Telegram inline keyboards, Slack Block Kit actions, and Discord message components render an Approve/Deny pair for a gated tool call, instead of asking the operator to type a reply into a channel and hope the parser agreed with them. The button is the e
View evidenceAgentOS 2026.8.23
Github ReleaseSource verified
A release about reaching past the model's own text: the agent can drive a real browser, failover stops paying for a dead provider once per turn, a skill's dependencies install whatever kind they declare, and a chart downloads as the chart you were looking at. The agent can drive a real browser A browser built-in, backed by the agent-browser CLI (Vercel Labs, Apache-2.0): navigate, read a page as an accessibility snapshot with element refs, click, type, fill, wait, run JavaScript, answer native dialogs, and screenshot. Managed and headless by default; attach mode drives the operator's own
View evidenceAgentOS 2026.8.21
Github ReleaseSource verified
A release about the ways in came in unequal: a voice note now says what it says, a scheduled turn can finish what it starts, a fetched page is finally untrusted in the way the prompt already claimed, and a custom skill starts from something that passes the gate. A voice note is a message now Inbound Telegram voice messages, audio files, and round video notes are transcribed before the turn is built, and the transcript becomes the message text. Before this, a voice note reached the agent as the placeholder [voice] with the audio stripped — the message arrived, admitted and delivered, carry
View evidenceAgentOS 2026.8.19
Github ReleaseSource verified
A release about what actually reaches the model: a skill can pin the rule it needs read, a tool result survives into the next turn intact, a cron job can name its own directory, and the system prompt stopped teaching a gateway things it cannot do. A cron job can name its own directory A script path passed to cron may now contain {jobid}, which the scheduler replaces with the created job's own id before the job is persisted. The add result reports the resolved path back as scriptpath. A job that keeps its files in a directory named after itself could not name that directory at cr
View evidenceAgentOS 2026.8.17
Github ReleaseSource verified
A scheduling-and-sessions release: cron jobs can be edited instead of rebuilt, they can name where they announce, and sessions can be renamed from every surface. Cron jobs are editable The in-agent cron tool can finally change a job in place. Previously the only strategy available to an agent in chat was to add a replacement and remove the original — which deleted the job the user wanted to keep and reset every setting the re-create did not name: an agent_turn fell back to reminder, a job pinned to Asia/Bangkok moved to UTC, its tool policy was dropped, and its output started la
View evidenceAgentOS 2026.8.15
Github ReleaseSource verified
A search-and-Web-UI release. websearch gains Tavily as a built-in runtime provider, the Web UI finally tells you when a new release is out — the CLI has done that for several versions — and every sidebar view becomes reachable from the keyboard through Gmail-style g chords. Added - **A built-in Tavily provider for websearch.** Tavily was previously reachable only through the multi-search-engine skill, which shells out to a script. It is now a runtime provider registered next to brave and duckduckgo, so selecting tavily and setting TAVILYAPIKEY is the whole setup — no sk
View evidence
Research notes
Written by Dawnscan researchers and reviewed before publishing. Commentary with sources — not the project's own claims, and not evidence of shipping.
No published notes on AgentOS yet.
Know something about AgentOS? Sign in with wallet to submit a research note. Notes are reviewed before they appear here.
Sources
- https://useagentos.dev/Unverified
- https://useagentos.dev/docsOfficial
- https://useagentos.dev/docs/installationOfficial
- https://github.com/use-agent-os/agent-osOfficial
- https://x.com/useagentos?s=21Unverified
The declared site does not mention this token, so the repository above is shown as context and is not counted as this project’s building.