When Xaver Emmerling describes his vision for Tilo, the AI-native operating system he's building with one other engineer, he skips past the technical architecture and lands somewhere unexpected: "I want to build a desktop my 90-year-old grandma could use without help."
It's a modest frame for what amounts to a fairly radical reimagining of how computers work. Tilo treats artificial intelligence agents as equal citizens to human users, giving them direct access to system functions through typed APIs instead of forcing them to pretend they're clicking buttons on a screen. The result, according to the company's Y Combinator profile from 2026, is computer use that runs up to 15 times cheaper than on a conventional operating system. That claim is stated without a published methodology, but if even partially true, it hints at why the entire industry is suddenly rewriting operating systems around agents.
Emmerling and his co-founder Quinten Wolff are hardly alone in this pursuit. Red Hat unveiled Fedora Hummingbird Linux in May 2026, an image-based distribution that Gunnar Hellekson, the company's VP and GM of RHEL, said "will define the platform for the agents that build the future of enterprise software." Microsoft shipped Execution Containers for Windows a month later, transforming the OS into an agent-native runtime with policy-driven containment. Sidero Labs released Talos Linux for AI and Talos Cupar on October 1, with Yardi CEO Rob Teel noting that Virtuoso Enterprise runs on Cupar and serves hundreds of Yardi clients today.
The spending figures suggest more than hype. AI infrastructure investment hit $89.7 billion in the first quarter of 2026 alone, according to IDC, which raised its full-year forecast to $497 billion by July. Gartner projects agent platform spending will grow at compound annual rates between 45% and 63% through 2030, based on forecasts the firm published earlier in the year.
From Screen Scraping to Direct Action
What's driving this wave isn't just enthusiasm for agents themselves. It's economics. Existing agent frameworks force AI to interact with computers the way humans do, scraping pixels from screens or injecting mouse clicks and keystrokes. It's slow, brittle, and burns through tokens at an alarming rate.
Rivet's agentOS, a WebAssembly runtime benchmarked in March 2026, demonstrated 254 times lower cost per second versus VM-based sandboxes and 92 times faster cold starts. Research on Linux schedulers designed for LLM agents, published in 2025, reported a 13-fold cost reduction compared to naive implementations. The numbers vary, but the pattern holds: giving agents native access instead of making them pretend to be human users changes the cost structure entirely.
Local-first deployment is reshaping the conversation in other ways. Perplexity launched its Portable Computer on August 25, 2026, a local-first agent platform running on Linux and Nvidia hardware that escalates to cloud resources only with explicit permission. Industry observers in September framed the trend as "unmetered intelligence," a model where companies run models locally and call out to the cloud selectively, shifting both cost and privacy calculations.
Interoperability standards coalesced quickly over the past two years, perhaps more quickly than anyone expected. The Model Context Protocol standardized how agents access tools and data. The Agent-to-Agent protocol moved to the Agentic AI Foundation as a Growth Stage project in August 2026, with support from Google Cloud, AWS Bedrock AgentCore Runtime, and Azure AI Foundry. Mike Krieger, chief product officer at Anthropic, said in December 2025 that MCP had "become the industry standard for connecting AI systems to data and tools" just a year after launch.
The Linux Foundation launched the Agentic AI Foundation on December 9, 2025, with founding contributions from Anthropic's Model Context Protocol, Block's goose framework, and OpenAI's AGENTS.md specification. Platinum members include AWS, Anthropic, Block, Bloomberg, Cloudflare, Google, Microsoft, and OpenAI. The foundation reported more than 10,000 MCP servers published as of December 2025, with adoption across Claude, Cursor, Microsoft Copilot, Gemini, VS Code, and ChatGPT.
Regulatory timelines are tightening, too. The EU AI Act's transparency provisions went into effect on August 2, 2026. High-risk AI rules apply December 2, 2027, for standalone systems and August 2, 2028, for embedded ones. US Executive Order 14110, issued in October 2023, continues implementation through 2026, referencing NIST's AI Risk Management Framework to guide practices around critical infrastructure and cybersecurity.
Collaboration as an Operating System Primitive
Tilo's particular bet centers on treating collaboration between humans and agents as a core system function rather than an application-layer afterthought. The system uses conflict-free replicated data types for all UI state, giving agents and humans the same attributed history with one-click revert functionality everywhere, according to the company's public code repository. A versioned, collaborative filesystem is exposed at /var/workspace. Every app exposes a typed resource and action tree. Agents invoke actions directly without screen scraping.
The team illustrated the size advantage with Tilo Notes, which weighs in at 0.64 megabytes versus Electron-based Trilium at 365 megabytes.
Wolff, who serves as CTO, previously led AI workflow automation at BDPE, a Munich patent litigation firm, from 2025 to 2026. The two founders are based in San Francisco and graduated from Y Combinator's Fall 2026 batch. LinkedIn lists the company size at 2 to 10 employees, though the company declined to disclose funding beyond its YC batch.
Tilo is in early alpha. The OS page warns users to "please don't install on machines without a good backup" as of October 19, 2026. The company offers a full OS image based on Fedora bootc and a desktop session installable on existing Ubuntu, Debian, Fedora, Arch, and NixOS distributions. A cloud workspace at tilo.coffee lets users open a browser-based session. Cross-device continuity runs over Iroh, a peer-to-peer protocol, with direct window handoff and remote rendering.
The security model addresses identity chains, TPM roles, boot and disk protection, confinement via Landlock and Wayland, collaboration checks, and attestation limits, according to documentation updated within the last week. Permissions include subjects, file and action scopes, grant lifetimes, and review and revocation semantics. The company has not disclosed external audits or certifications such as SOC 2 or ISO 27001.
Tilo's public Forgejo repository shows active commits through October 19, 2026. The stack is 87% Rust, with a Wayland compositor, CRDT UI, FUSE integration, Automerge for state management, Iroh for content addressing, and BLAKE3 hashing. The license is AGPL-3.0.
The Broader Field
Microsoft's approach layers agent containment atop Windows rather than rebuilding from scratch. Execution Containers, shipped in June 2026, provide policy-driven, OS-enforced agent identity and containment. An October Windows Experience Blog post described MXC as "key steps in making [Windows] a hybrid-intelligence platform," enabling local agents with policy-driven containment. Agent 365 integrates on-device models for what the company calls hybrid intelligence.
Canonical outlined a public roadmap for agentic workflows on Ubuntu in April 2026, emphasizing opt-in AI features. Ubuntu 26.10, released in October, added RISC-V desktop support and devpacks. Nvidia previewed OpenShell at Computex in June, an open-source agent runtime for sandboxed execution developed in collaboration with Ubuntu.
Smaller vendors are targeting niche deployment models with varying degrees of transparency. Alibaba Cloud Linux 4 LTS "Agentic Edition," with FAQs last updated September 10, 2026, offers agent-specific observability tools as an ECS image on x86. Suruf OS, updated around September, is a container-native distribution based on Fedora Atomic bootc with a system-level agent. NullBox ships a minimal stack for sandboxed agents targeting $6 to $20 per month VPS deployments. HeartBeatAgents emphasizes per-folder access controls for self-hosted agents.
What Comes Next
Three questions will shape the next phase: cost transparency, interoperability maturity, and compliance readiness.
Tilo's 15-times cost claim remains unsubstantiated in any public detail. The company has not disclosed the workload definition, baseline OS, models tested, or cost components, whether compute, storage, bandwidth, or human-in-the-loop overhead. Rivet's benchmark and academic research suggest the leverage is real, but third-party validation is missing across the field. McKinsey framed an enterprise "AI operating system" on October 13, 2026, emphasizing governance, cost control, and interoperability as adoption scales.
The Model Context Protocol and Agent-to-Agent protocol are moving from proof-of-concept to production infrastructure. A2A's acceptance as a Growth Stage project within the Agentic AI Foundation in August, with support from major cloud providers, signals maturing tooling. Jim Zemlin, executive director of the Linux Foundation, said in December 2025 that "we are seeing AI enter a new phase, as conversational systems shift to autonomous agents that can work together." Vendors that ship proprietary action surfaces will face integration friction as the stack standardizes.
Compliance timelines compress over the next 14 to 26 months. EU AI Act high-risk rules take effect December 2, 2027, for standalone systems and August 2, 2028, for embedded ones. Agent OS vendors with European deployments face transparency obligations now and high-risk requirements soon. None of the surveyed projects disclose SOC 2, ISO 27001, or AI Act readiness on their public pages. NIST's AI Risk Management Framework 1.0, published in January 2023, provides a living framework for governance controls. Vendors treating agents as subjects with identity, permissions, audit, and risk controls may have a compliance advantage as scrutiny intensifies.
Cisco's May 2026 network outlook anticipates "agentic shoppers" and significant retail orchestration shifts by 2030, with implications for traffic and WAN architecture. Research published in 2026 argues for OS-level identity, input mediation, memory governance, and execution control for agents crossing trust boundaries, sketching a path toward AI-native kernels where a model arbitrates core policies.
A Research Bet on Architectural Leverage
Tilo's CRDT-native collaboration, typed action APIs, and local-first sync position it as a research-heavy bet on architectural leverage rather than incremental improvement. The team has published the stack, security model, and developer APIs in full. The next milestones will be customer deployments, a transparent cost methodology, and enough headcount to close the gap between a working alpha and production-grade infrastructure.
StatCounter showed Linux at 8.88% worldwide desktop share in August 2026. If local-first economics and agent workloads shift deployment patterns in the ways advocates believe they will, the operating system layer becomes strategic infrastructure again. Whether a two-person startup from Y Combinator's Fall 2026 batch can capitalize on that shift against Microsoft, Red Hat, and Canonical remains an open question. But Emmerling's grandmother test might be the right frame after all. If agents and humans are going to share desktops, someone has to make it feel natural. That's harder than it sounds.
