AOHP: An Open-Source OS-Level Agent Harness for Personalized, Efficient and Secure Interaction¶

🕒 Published (v1): 2026-06-22 15:02 UTC · Source: Arxiv · link

Why this paper was selected

OS-level agent harness; open-source; covers tool-call, memory, cross-app orchestration

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

TL;DR¶

AOHP is an open-source OS-level harness built on AOSP that redesigns Android to treat AI agents as first-class OS actors rather than app-layer guests. It introduces three mechanisms—personalized service composition, efficient agent interfaces, and secure information-flow tracking—that together raise task completion by 21.12 pp, cut LLM token consumption by 51.55%, and enforce fine-grained privacy policies across cross-app agent workflows.

Problem¶

Conventional operating systems are app-centric: GUIs are fixed by developers, execution is foreground-serialized, and permission models enforce app-boundary isolation but cannot track sensitive data across an agent's multi-step, multi-app tool calls. This mismatch causes high execution overhead (pixel-heavy observations, brittle GUI navigation), reduced task success, and security gaps when LLM agents run on stock Android.

Method¶

AOHP modifies AOSP at the framework and system-service layer to expose three new primitives:

Personalized Service Composition — The OS agent discovers capabilities (API, CLI, Structured UI, Rendered GUI) from installed apps, represents each capability with input/output schemas and policy labels, and synthesizes generated service entrances around user intent (e.g., a unified shopping entrance aggregating multiple marketplaces). A system memory layer stores preferences and task state across app boundaries.
Efficient Agent Interfaces — Five sub-mechanisms reduce observation cost and serial bottlenecks: (a) Parallel Background Interaction via lightweight virtual displays decoupled from the physical screen; (b) Agent-aware UI Enhancement that exports structured, low-redundancy UI trees instead of raw screenshots; (c) Native Sandbox Runtime for local code/data processing isolated from app interfaces; (d) Unified File Shortcut that reflects GUI-produced storage changes as structured file observations and provides a unified cross-app data plane; (e) Event Stream Abstraction with a notification buffer and sensor streaming so transient events (Toasts, pop-ups) are not missed.
Secure Information Flow — Sensitive plaintext is replaced with typed vault references (e.g., <payment-card:uuid>) before reaching the agent context. A trusted vault executor mediates all plaintext operations under policy, and taint metadata propagates through copies, transformations, and transfers, providing an auditable source-to-sink chain. Policy is evaluated at runtime over (source, purpose, destination, action sensitivity, approval state) tuples rather than static app permissions.

Key Contributions¶

Agent-native OS architecture that treats agents as first-class OS actors rather than app-layer callers.
Three concrete OS-level mechanisms implemented on AOSP: personalized service composition, efficient agent interfaces, and secure information-flow enforcement.
An open-source implementation (AOHP) and a 30-task mobile benchmark spanning GUI operation, non-GUI operation, event capture, multi-source retrieval, memory management, and hybrid cross-capability workflows.
Empirical demonstration that OS-level abstractions yield significant gains in completion rate, efficiency, and privacy compliance without replacing the agent policy itself.

Results¶

All numbers compare OpenClaw agent on AOHP vs. OpenClaw on stock Android (30-task benchmark):

Completion rate: 75.56% vs. 54.44% (+21.12 pp); 20 tasks fully solved vs. 13.
Tool calls (on 11 mutually solved tasks): 129 vs. 233 (−44.64%).
Task duration (same subset): 18.93 min vs. 33.94 min (−44.21%).
Token consumption: 3.44M vs. 7.10M (−51.55%); input tokens −51.50%, output tokens −57.48%.
LLM requests: 143 vs. 273 (−47.62%).
Security: All 5 annotated payment-app checks pass (sensitive display redaction, ordinary-action pass-through, sensitive-action consent, fail-closed on unsupported access, event-stream taint propagation).

Limitations¶

Evaluated on a self-crafted 30-task benchmark with a single agent (OpenClaw); no evaluation on established benchmarks (AndroidWorld, OSWorld) or other agent architectures.
Security evaluation uses a single developer-annotated payment app; generalization to unannotated apps relies on conservative heuristics whose false-positive/false-negative rates are unreported.
Capability discovery and policy annotation require developer participation or heuristic inference; coverage of arbitrary third-party apps is uncharacterized.
Performance gains on the efficiency analysis are measured only over the 11 tasks both settings solve, which may not represent the harder tasks where AOHP's advantage is largest.
No ablation quantifying the individual contribution of each of the five efficient-interface sub-mechanisms.

Relevance to Harnesses / Meta-Harnesses¶

AOHP is directly relevant as a production-grade harness design case study: rather than scaffolding agents at the application layer, it demonstrates that moving agent orchestration into the OS yields measurable efficiency gains (51% fewer tokens) and stronger security guarantees through information-flow tracking—two properties that application-layer meta-harnesses cannot achieve without OS cooperation. The personalized service composition mechanism is particularly instructive for harness designers, showing how pre-composing tool/service graphs per user context reduces the LLM's planning burden at runtime. For someone building agent harnesses, the key takeaway is architectural: the interface boundary between the harness and the execution environment (OS vs. app layer) is a first-order design decision with large downstream consequences for latency, token cost, and privilege containment—not an implementation detail.