The Agent OS Wars: Why Every AI Platform Is Building the Same Five Primitives

Two weeks ago, OpenAI split its Agents SDK from its inference infrastructure. Cloudflare dropped three agent products in 48 hours. Hermes Agent crossed 2M downloads. On the surface, it looks like chaos — but look closer, and you'll see the industry is converging on exactly the same five primitives.

---

Last week was the clearest signal yet. OpenAI decoupled its agent harness from its compute layer and opened it to third-party sandboxes. Cloudflare shipped Project Think, Agent Lee, and a WebSocket voice pipeline — all in the same sprint. Hermes Agent's autonomous "Gemma 4 abliteration" story went viral: the agent diagnosed NaN instability in a production model, patched the library, retrained, benchmarked the result, and uploaded a model card to Hugging Face — without a single human in the loop.

These look like competing products. They're not. They're the same blueprint, implemented by different teams with different trade-offs. And once you see the five primitives they're all converging on, the entire agent infrastructure landscape becomes legible for the first time.

The Five Primitives

1. Sandbox — Isolated Execution Space

Every agent stack needs somewhere to run code that can't wreck the host. The early answer was "just run it in the cloud somewhere." The 2026 answer is sandboxed ephemeral compute: lightweight VMs or container-like environments that spin up on demand, execute agent-authored code, and are destroyed when done.

Cloudflare's entire agent platform is built on this. Their Workers runtime already provides isolate-based execution; their new Agent Lee runs entirely in sandboxed TypeScript, meaning an agent can issue infra tasks and get UI-backed results back without ever touching the host system. OpenAI's SDK now delegates execution to partner sandboxes — Modal, E2B, Daytona — rather than locking users into OpenAI infra. This isn't accidental. It's the industry collectively deciding that .