Large language model agents have outgrown chat. They invoke tools, rewrite local files, hold persistent memory, and reach out to external services — the same capabilities that make them useful are the ones that make them risky the Agentao paper lays out this tension on arXiv. A submission to arXiv’s cs.AI track presents Agentao, a governed local-first runtime that keeps those agents inspectable and under the host’s control rather than the model’s.
What Agentao actually separates
Agentao’s defining move is to split model-generated action proposals from host-authorized execution the arXiv abstract describes the layered design. Its architecture stacks host-facing surfaces, a host contract, a runtime core, and a permission-mediated tool system, with separate subsystems for memory, replay, plugins, skills, sub-agents, and protocol integration. The embedding program — the host — decides what the agent may touch; the model can suggest an action, but the host must authorize it before anything runs.
The risks it is built to contain
The authors organize the threat model around over-privileged actions, weak auditability, prompt injection, tool poisoning, and uncontrolled side effects the same paper frames these as the core agent risks. By turning permissions, state, protocol boundaries, and execution traces into explicit runtime objects, Agentao gives operators a concrete record of what an agent did and why. The paper is candid that it provides no formal safety guarantees — it demonstrates an architecture, not a proof.
What you can run today
The implementation is public on GitHub under the jin-bo/agentao repository and ships as a Python package you can embed or run as a command-line tool the project README documents the install and the embedding API. A host builds an Agentao instance with an explicit working directory, an LLM client, and a transport, so there is no hidden environment discovery or implicit network access — every input belongs to the host. The README presents it as a local-first, private-first, embeddable harness with a developer guide and a copy-paste playbook for coding agents.
Why the boundary matters
The paper’s contribution is less a new feature than a discipline: it pushes permissions, replay, and audit into first-class runtime constructs so a host can govern a tool-using agent instead of trusting it the published version is indexed at DOI 10.48550/arXiv.2608.13574. For teams already wrestling with this boundary, zBrandco previously showed one pattern for bridging cloud agents to local tools related walkthrough. For teams pointing agents at local data or external services, that separation is the difference between an assistant and an autonomous process holding your credentials.
