The news. In June 2026, researchers released AOHP, an open-source OS-level agent harness built on the Android Open Source Project that treats AI agents as first-class operating-system actors. Instead of bolting an agent onto individual apps, agents run at the OS layer to invoke tools and read information across applications, governed by three capabilities: personalized service composition, agent-optimized interfaces, and secure information flow. AOHP reports it raises task-completion rate by 21.12% while cutting token consumption by 51.55%. Read the paper →
Picture a large building. Most of today's agents are visitors: to get anything done they walk to each department, squint at the public signs on every door, and fill out forms by hand — and they have to repeat that dance for every single room. That "reading the signs" is exactly what an app-bound agent does when it scrapes a human screen to figure out what to tap. It works, but it is slow, brittle, and it burns enormous amounts of attention on parsing interfaces built for people, not machines.
AOHP makes the agent staff instead of a visitor. It runs the agent inside the operating system — on the Android Open Source Project — as a first-class OS actor with a master key and a service hallway. Concretely, that hallway is an agent-optimized interface: rather than scraping the human UI, the agent talks to a clean, machine-friendly surface each app exposes. The article's read is that much of the −52% token figure comes from here: the agent no longer spends as much of its budget describing and re-reading cluttered screens, and a leaner input that does more is plausibly also a faster, more reliable one (+21% task completion).
But a staff member with a master key is a security question, not just a convenience. The whole point of the lethal trifecta is that an agent with broad access, exposure to untrusted content, and a way to send data out can be turned into an exfiltration tool. So AOHP's third capability is secure information flow — explicit, OS-enforced rules about which data the agent may carry from one app to another. The agent gets the building's master key, but the building keeps the rules about which staff may enter which rooms; the access and the governance are designed together, not bolted on after.
Sit with the two numbers, because they pull in opposite directions and that is the point. A task-completion rate up 21.12% and token consumption down 51.55% means the agent did meaningfully more work while reading meaningfully less — which looks like the hallmark of fixing the interface, not just adding compute. (Both figures are AOHP's own reported results.) Stop making the agent decode screens meant for human eyes, and you plausibly remove a tax it was paying on every action.
| Where the agent lives | How it acts on an app | Cost & reach |
|---|---|---|
| Bolted onto each app | scrapes the human UI, app by app | Brittle, token-hungry, re-built per app |
| First-class OS actor (AOHP) | agent-optimized interfaces across apps, governed by secure information flow [paper] | +21% tasks · −52% tokens · one policy-governed harness |
Goes deeper in: AI Agents → Security & the Lethal Trifecta → Secure Information Flow
Related explainers
- Harness-1 — externalized agent state — the harness layer AOHP moves down into the OS; both are about where an agent's scaffolding really belongs.
- Copilot/Cowork image-URL exfiltration — a concrete version of the leak AOHP's secure information flow is designed to prevent.
- SpatialClaw — code as action — another case of giving an agent a clean, machine-native way to act instead of imitating a human interface.