AOHP: An Open-Source OS-Level Agent Harness for Personalized, Efficient and Secure Interaction

The paper introduces AOHP, an open-source OS-level agent harness built on Android that treats agents as first-class system actors to enable personalized, efficient, and secure interactions, demonstrating significant improvements in task completion rates, token costs, and security compliance compared to conventional systems.

The Gist

The Big Idea: Changing the "Operating System" for AI

Imagine your smartphone is a busy office building. Right now, the building is designed for people. The doors, elevators, and desks are arranged so a human can walk in, find a specific room (an app), and do a task.

But now, we have AI Agents (smart digital assistants) that want to do tasks for us. The problem is that these AI agents are trying to navigate a building designed for humans. They have to "look" at screens, "click" buttons, and "read" menus just like a human would. This is slow, confusing for the AI, and risky because the AI might accidentally see your private passwords or credit card numbers while trying to figure out how to click a button.

AOHP (Android Open Harness Project) is a new way of building the "office building" (the operating system) specifically for these AI agents. Instead of forcing the AI to act like a human, AOHP redesigns the building so the AI can walk straight to the task, skip the confusing hallways, and keep your secrets safe.

---

The Three Superpowers of AOHP

The paper introduces three main ways AOHP changes the game:

1. Personalized Service Composition: The "Custom Butler"

The Old Way: If you want to buy shoes, you have to open App A, search, then open App B to compare prices, then open App C to check shipping. You are the one connecting the dots.
The AOHP Way: Imagine a super-butler who knows exactly what you want. You just say, "Buy me the best shoes under $50." The OS (the building manager) instantly builds a custom interface just for that moment. It pulls the search results, prices, and shipping info from all those different apps and puts them on one single screen for you.

• The Analogy: Instead of you running to three different grocery stores to buy ingredients for a meal, the OS sends a chef to all three stores, gathers the ingredients, and brings them to your kitchen in one basket. The AI handles the "shopping," and you just see the final result.

2. Efficient Agent Interfaces: The "Backstage Pass"

The Old Way: AI agents usually have to "watch" the screen like a human does. They take a picture of the screen, figure out where the button is, and click it. If the screen changes, they get confused. This is slow and wastes a lot of computer power (and money for the AI).
The AOHP Way: AOHP gives the AI a backstage pass. Instead of looking at the screen, the AI can talk directly to the apps' internal code.

• Parallel Processing: The AI can do multiple things at once in the background without blocking your screen.
• Structured Data: Instead of guessing what a button says by looking at a picture, the AI gets a clean text description: "This is a 'Buy' button."
• The Analogy: Imagine trying to fix a car. The old way is looking through the windshield and guessing where the engine parts are. The AOHP way is opening the hood and talking directly to the engine. It's faster, more accurate, and doesn't require squinting at the dashboard.

3. Secure Information Flow: The "Secure Vault"

The Old Way: When an AI agent tries to do something with your private data (like your home address or credit card), it often sees the data in plain text. If the AI gets hacked or makes a mistake, your secrets are exposed.
The AOHP Way: AOHP treats your private data like gold bars in a vault.

• The Mask: When the AI asks for your address, it doesn't see "123 Main St." It sees a code like <address:ID-999>.
• The Trusted Guard: If the AI needs to actually use that address (e.g., to fill out a shipping form), it asks a "Trusted Vault" (a secure part of the OS). The Vault checks if it's okay, fills in the real address for the app, and then immediately hides it again. The AI never actually sees the real number.
• The Analogy: Think of a magician's assistant. The assistant (the AI) can ask for a "red card," but they never see the actual card. The magician (the OS) holds the real card, does the trick, and only shows the result. The assistant never knows the secret.

---

What Did They Test? (The Results)

The researchers tested this new system using a smart AI agent called "OpenClaw" on a set of 30 difficult mobile tasks (like buying things, checking notifications, and managing files). They compared it to a normal Android phone.

• Success Rate: The AI succeeded 21% more often on the new system. It could finish tasks that it failed on the normal phone because it didn't get stuck trying to "see" buttons or navigate confusing menus.
• Speed & Cost: The AI finished tasks 44% faster and used 51% less computer power (tokens). Because it didn't have to "look" at screens or guess what to do, it wasted less time and money.
• Security: In tests involving a fake payment app, the system successfully blocked the AI from seeing real credit card numbers or addresses, only showing them the "masked" codes. It proved that the AI could still do the job (buy the item) without ever knowing the secret.

Summary

AOHP is a prototype for a new kind of phone operating system. It stops treating AI agents like clumsy humans trying to use a phone and starts treating them like powerful system tools. By building a "custom interface" for every task, giving the AI direct access to data, and locking away private secrets in a vault, AOHP makes AI agents faster, smarter, and much safer to use.

Technical Summary

Technical Summary: AOHP – An Open-Source OS-Level Agent Harness

1. Problem Statement

Current personal operating systems (OS) are fundamentally designed around an application-centric workflow. In this paradigm, interfaces are fixed by developers, GUIs are rendered for human visual operation, and permission mechanisms enforce protections only at application boundaries. This design creates a significant mismatch when deploying AI agents, which require the ability to observe services, invoke capabilities across app boundaries, manage long-lived context, and execute tasks in parallel.

Running agents on conventional systems leads to three primary issues:

1. Execution Overhead: Agents must navigate rigid, human-optimized GUIs, leading to inefficient visual processing and brittle cross-app handoffs.
2. Security Gaps: Traditional permission models fail to track sensitive data as it flows across an agent's context, tool calls, and multiple applications.
3. Lack of Native Support: There is no open testbed to explore architectural primitives for "agent-mediated" interaction, limiting the adoption of adaptive, personalized user experiences.

2. Methodology: AOHP Architecture

The authors present AOHP (Android Open Harness Project), an open-source OS-level agent harness built on the Android Open Source Project (AOSP). AOHP reimagines the OS not just as a host for applications, but as a platform where agents are first-class actors.

The system is organized into four vertical layers and two horizontal mechanisms:

Vertical Layers

1. Android Ecosystem (Bottom): Preserves existing apps, hardware resources, and platform APIs to ensure compatibility.
2. Unified Interaction Interface: Normalizes traditional Android interfaces and emerging agent interfaces into four invocation modes: API, CLI, Structured UI, and Rendered GUI. This allows agents to select compact symbolic paths or fall back to visual operations as needed.
3. AOHP Capabilities Layer: Reorganizes services into:
   • System Memory: Stores preferences, task states, and policies outside single apps.
   • Skills: Packages reusable service capabilities and execution routines.
   • UI Utilities: Supports the construction of generated entrances.
4. Personalized Service Composition (Top): Assembles capabilities into dynamic, task-specific user interfaces driven by user intent rather than static app definitions.

Horizontal Mechanisms

1. Efficient Agent Interfaces: Optimizes resource access through:
   • Parallel Background Interaction: Decouples execution from the physical display using lightweight virtual displays.
   • Agent-aware UI Enhancement: Abstracts GUIs into structured representations to reduce redundancy.
   • Native Sandbox Runtime: Provides an OS-managed execution substrate for code and data transformation independent of app interfaces.
   • Unified File Shortcut: Treats files as first-class task objects, reflecting GUI storage changes as structured observations.
   • Event Stream Abstraction: Allows agents to subscribe to transient system events (e.g., Toasts, notifications) and hardware sensor data without repeated polling.
2. Secure Information Flow: Enforces a stricter protection model where sensitive data is isolated by default.
   • Sanitization: Replaces private plaintext with typed placeholders (e.g., <payment-card:uuid>) before they reach the agent.
   • Trusted Vault: A secure executor mediates operations on sensitive data, obtaining user approval and performing actions (formatting, validation) within a trusted environment.
   • Taint Tracking: Propagates metadata to track the provenance of sensitive data across copying, transformation, and transfer, ensuring auditability.

3. Key Contributions

The paper identifies three core contributions:

1. Agent-Native OS Architecture: A design shift where services are interface-neutral capabilities, and the OS manages cross-app personalization and sensitive state, addressing the architectural mismatch between app-centric OSes and agent workflows.
2. System Implementation: The realization of AOHP on AOSP, introducing three mechanisms:
   • Personalized Service Composition: Synthesizing task-level entrances (e.g., a unified shopping interface aggregating multiple providers).
   • Efficient Agent Interfaces: Supporting parallel execution, structured UI, and event streams.
   • Secure Information Flow: Sandboxing sensitive values via information flow tracking.
3. Empirical Evaluation: A comprehensive benchmark using OpenClaw agents on 30 real-world mobile tasks involving complex cross-app interactions.

4. Experimental Results

The authors evaluated AOHP against a stock Android baseline using the OpenClaw agent.

• Task Completion: AOHP increased the average completion rate from 54.44% (stock Android) to 75.56% (+21.12 percentage points). It fully solved 7 more tasks than the baseline, particularly those involving transient notifications, fine-grained GUI manipulation, and multi-step workflows.
• Execution Efficiency: On the subset of tasks solved by both settings, AOHP demonstrated significant cost reductions:
  • Tool Calls: Reduced by 44.64% (233 vs. 129).
  • Duration: Reduced by 44.21% (33.94 min vs. 18.93 min).
  • Token Consumption: Reduced by 51.55% (7.10M vs. 3.44M tokens).
  • LLM Requests: Reduced by 47.62% (273 vs. 143).
• Security Compliance: In a case study using an annotated payment application, AOHP successfully enforced all five security checks, including redacting sensitive fields in the agent-visible UI, requiring user consent for sensitive actions, and failing closed on unsupported access requests.

5. Significance and Claims

The paper claims that AOHP represents a necessary evolution in operating system design to support the emerging paradigm of AI-mediated interaction. Its significance lies in:

• Shifting the OS Role: Moving the OS from a passive host of apps to an active, adaptive layer that generates personalized service interfaces based on user intent.
• Bridging the Gap: Providing the first open testbed to explore architectural primitives for agent-native systems, demonstrating that OS-level abstractions can significantly improve agent efficiency, task success, and security.
• Preserving Ecosystem: Achieving these gains without sacrificing the mature Android hardware and software ecosystem, proving that agent-native features can be integrated into existing platforms.

The authors conclude that while AOHP shows clear advantages, future work is required to expand compatibility with custom-rendered apps, improve automatic capability discovery for legacy apps, refine resource scheduling for background execution, and enhance the usability of fine-grained security policies for end-users.