AI should not sit on top of the operating system pretending to be a user. It should be able to propose, test, install, replace and repair software beneath the interface—while a smaller trusted layer keeps identity, scope and rollback intact.
Three 2026 systems papers make the practical pieces unusually concrete: source-level agent mutation, intent-bound execution, and replayable proof of what actually happened. Older work on live update, recovery and transactional operating systems shows that the replacement mechanics themselves have a long history. The new move is joining those mechanics to conversational reasoning.
A model that can write software and inspect execution should not always have to manipulate a finished interface as though its hands were tied behind its back.
Recent self-improving agent work has already crossed an important boundary: the thing being changed can be executable code, not only a prompt or memory file. MOSS pushes that argument directly into a production harness and checks candidate rewrites inside temporary trial workers before swapping the running container.
The Autogenic Operating System takes the same move toward the personal computer. A conversation becomes an engineering control surface. The model produces a candidate capability; the machine tests it under bounded conditions; a resident process promotes or rejects it; successful software becomes part of the environment that the next turn can use.
The first useful AOS does not rewrite its kernel. It keeps a tiny resident governor fixed and lets the software around it mutate.
That split follows a practical pattern seen repeatedly elsewhere: preserve the component that owns recovery authority while replacing the component that is supposed to evolve. MOSS places its host daemon outside the container it may replace. Crash-only and microreboot work similarly make restart boundaries cheap. Kitsune makes version-to-version state transformation explicit.
MOSS argues that structural failures live in code: routing, hooks, dispatch and state invariants are outside the reach of prompt-only evolution. It rewrites source, replays failure evidence in ephemeral workers, then swaps the container only after a health check.
OpenKedge turns a requested state change into a declarative intent, derives current context, evaluates policy, and compiles an approved proposal into a bounded execution contract with short-lived authority.
Proof of Execution binds a contract, an execution-event stream and replay context. It separates planning, enforcement, effect and recording, then validates whether the recorded trajectory satisfies its runtime invariants.
It owns the authority that evolving code must not silently inherit.
That is where the system earns the word “autogenic.”
The browser is the first mutation surface because failure is cheap and restart is bounded.
This is where MOSS is directly informative. Candidate images can be tested against held-out failures in disposable workers before a resident swaps the service.
Here AOS stops being mainly an agent problem and meets decades of dynamic-update and transactional-update engineering.
Protected extensions challenged the assumption that an operating-system kernel had to be functionally frozen.
IBM’s programme framed self-configuration, self-healing, self-optimization and self-protection as explicit system goals.
The system boundary changes when restart becomes cheap, local and expected rather than exceptional.
K42, Ksplice and Kitsune explore live code replacement, persistent state and version transitions.
A/B system slots, OSTree, RAUC and Guix make “old or new, never half-updated” an achievable update property.
MicroVMs and stronger container sandboxes create disposable execution surfaces for untrusted candidates.
Self-improving coding agents, open-ended agent evolution, harness search and MOSS turn source code itself into the adaptation medium.
A self-extending computer should not stop thinking the instant the keyboard goes quiet.
While the user is away, the resident can spend bounded idle cycles on non-destructive work: reproduce failures in clones, fuzz candidate code, pre-build likely variants, fetch documentation already requested, or compress the day’s execution evidence into a better next prompt.
The governance lesson from current agent-safety work is not “ask for confirmation every minute.” It is to bind authority to the actual effect. Read-only and disposable experiments can run under a standing low-risk capability; durable mutations cross a harder gate and leave evidence.
resident.spawn_child
↓
extension.self_modify(session_worker.js)
↓
MV3 candidate compile
↓
bounded probe: PASS
↓
resident backup + atomic replace
↓
generation 1 → 2
↓
chrome.runtime.reload()
↓
new worker heartbeat
↓
durable plan resumes
↓
{"echo":"after-reload","generation":2}
This run exercised the production method using a deterministic surrogate image because the ChatGPT Image 2.0 generation tool was not exposed to this session. The downstream path is real: one raster board, pure-magenta structural rails, coordinate detection, ImageMagick crops, six separate PNG elements, then Chromium layout verification.
INTERNAL VM
Debian 13
Chromium 144
ImageMagick 7.1.2
BOARD
1800 × 1200
2 × 3 cells
8 px #FF00FF rails
PIPELINE
source board
→ rail detection
→ crop geometry
→ ImageMagick slicing
→ six PNG plates
→ semantic HTML/CSS
→ Chromium desktop + mobile
→ fit assertions
RESULT WRITTEN BY VERIFY SCRIPTSelect a reference to highlight the story passages that currently depend on it. This makes citation coverage visible as a relation, not a decoration at the bottom of the page.