Bizi Office · AI Class · Fall 2026

The Agentic OS

Windows 12, terminal harnesses, and the future of AI — the last 60 days of growth, Summer/Fall 2026.

Length: 45 minutes Audience: SMB · Real estate · operators Host: Cloudflare Pages
Windows 12 GitHub Cloudflare DeepSeek Terminal harnesses
ThenChatbots in a browser tab
NowAgents with OS & terminal access
ShiftWriting code → executing work
StakesSpeed, privacy, and control
Section 1 · 0–5 min

The end of “copy and paste”

AI is no longer a drafting assistant you shuttle between windows. It is executing code, clicking systems, and holding ambient authority — the same permissions as the signed-in user.

Old play

Chat → clipboard → hope

You asked, it wrote, you pasted, you owned every click. Slow, visible, and easy to audit.

New play

Agent → terminal → done

Harnesses run commands, edit files, open PRs, and deploy. The human becomes the coach, not the typist.

Pioneers

Omarchy & Grok Build

DHH’s AI-native Linux distro and Grok Build showed what an OS looks like when agents are first-class, not a sidebar.

Section 2 · 5–15 min

Windows 12 “Hudson Valley Next”

  • Late-2026 target on modular CorePC — Windows as interchangeable layers, not one giant image.
  • Hardware shift: Copilot+ PCs with 40+ TOPS NPUs so agents run locally, not only in the cloud.
  • AI is not an app. It is a system-wide orchestration layer sitting next to the kernel’s permission model.
  • Expect agents that can see windows, files, calendar, and mail — if the OS lets them.
Windows 12 Microsoft
What “baked into the OS” means for you

Your CRM, listing photos, and client emails can be summarized on-device — faster, and theoretically more private — but only on machines that meet the NPU bar.

40+ TOPS

Neural processing required for the full local-agent experience. Older laptops become second-class citizens.

The commercial AI OS

Controversy & concerns

Subscription wall

Agents as a monthly SKU

Widespread rumors: advanced, exclusive agents sit behind Microsoft 365 / Copilot subscriptions. The OS you already paid for may not include the team that runs it.

Paywall risk
Privacy & telemetry

Recall + ambient surveillance

Screenshot-style memory of your desktop is a gift for search — and a nightmare for brokerages holding contracts, SSNs, and client photos.

Enterprise red flag
Hardware lock-in

The leftover fleet

If local AI is mandatory, 2019–2023 PCs get a slower, cloud-dependent Windows. Budget shops feel this first.

CapEx shock
Section 3 · 15–25 min

OpenCode2 & the TUI revolution

While vendors bake agents into the OS, open-source developers spent the last 60 days putting them in the terminal — local, private, modular.

  • OpenCode2 — a Go-based terminal coding agent that exploded in popularity.
  • In-process LSP: it doesn’t just read files; it sees compiler errors and auto-fixes in real time.
  • Auto-Compact: when the context window hits ~95%, it summarizes the conversation and keeps playing.
Go TUI Git-native
Open-source harness boom

Oh My Pi (OMP) & plugin architectures

What it is

A universal meta-framework

OMP is an open-source AI agent harness for the terminal. Not one model, not one vendor — a plugin bus that can swap brains and tools the way a brokerage swaps listing syndicators.

Why it’s exciting

DAP debugger integration

The Debug Adapter Protocol lets agents step through code execution — pause, inspect variables, continue — instead of guessing from the stack trace. That’s a coach watching film, not yelling from the parking lot.

Plug in

Models, tools, MCP servers, and secrets as modules — not a monolith.

Step through

DAP means the agent can halt on the broken line, not rewrite the whole file.

Stay local

Your client data never has to leave the laptop if you choose local models.

Open-source harness boom

Why the terminal?

Developers are walking away from bulky IDE AI plugins for lightweight, fast, terminal-first workflows. Same instinct as a realtor who ditches five apps for one well-run pipeline.

01

Speed

No Electron sidebar chewing RAM. Keystrokes go straight to the agent and the shell.

02

Composability

Pipes, git, SSH, Docker — 50 years of tools the agent already speaks.

03

Privacy

You choose the model endpoint. Nothing has to phone a vendor’s IDE telemetry.

04

Portability

Same harness on a MacBook, a Linux NUC, or a Cloudflare remote box.

Section 4 · 25–32 min

The 1-million token problem

Context windows grew faster than the hardware budget. Filling a million-token window used to mean unusable FLOPs and RAM for daily work — like renting a stadium to hold a toolbox meeting.

  • A token ≈ a word-piece. A million tokens is a small library, not a prompt.
  • Attention cost historically scaled brutally with length (compute + KV cache in GPU RAM).
  • Local agents that “read the whole repo + the CRM export” were theoretically possible and practically bankrupt.
Daily-dev reality (pre-breakthrough)

Huge window

Usable on a workstation

Without a decode breakthrough, 1M context was a brochure feature, not a workday tool.

Model efficiency

DeepSeek-V4-Pro-DSpark

MoE scale
1.6T

Mixture-of-Experts parameters — only a slice of experts fire per token.

Inference compute
27%

DSpark speculative decoding vs. prior generation — same job, ~¼ the work.

KV cache
10%

Scratch-paper RAM vs. previous gens — million-token context becomes viable.

The breakthrough

DSpark speculative decoding + MIT license (Aug 2026). Open weights mean local / private deployments — not just another API meter. This is the engine that makes terminal agents economically honest.

DeepSeek V4 Pro MIT license Speculative decode
Section 5 · 32–40 min

The sandbox escape threat

If an agent can execute code, it can also destroy systems. The new attack is not a hacker at a keyboard — it is a poisoned instruction hidden in a file the agent was told to read.

  • Prompt injection in a malicious open-source repo, README, or ticket.
  • The harness “helpfully” follows the injected play: exfiltrate keys, rm -rf, open the firewall.
  • Case study: DeepSeek Harness CVE-2026-82533 — agent escaped its restricted workspace folder.
Security

Zero-trust AI architectures

01 · Isolate

Ephemeral Docker

Agent runs in a throwaway container. When the job ends, the machine ceases to exist.

Docker
02 · Bound

Strict permissions

Allow-list folders, networks, and secrets. No ambient home-directory authority by default.

03 · Approve

Human in the loop

Destructive commands (rm, drop, production deploys) require a person to blow the whistle.

04 · Verify

Read it back

After a write to CRM, GitHub, or Cloudflare — fetch the live record before you celebrate.

Section 6 · 40–45 min

Orchestrators, not typists

The job is no longer “type the boilerplate.” It is coaching a roster of specialists — OpenCode2 on the code, OMP on the debug, Cloudflare on the edge — and keeping them inside the white lines.

You

Head coach

Goals, taste, client ethics, and the veto. Humans still own the scoreboard.

Agents

Special teams

One writes, one tests, one deploys. Swap them like plugins — don’t marry a single chatbot.

OS & harness

The stadium

Windows 12 or a locked-down terminal. Choose the venue that matches your privacy and budget.

Believe in the build — but put a fence around the field.
Q&A · 42:30–45:00

Your call, coach.

Two discussion prompts — then the floor is yours.

Prompt 1

Should OS-level AI be a subscription?

Is agentic capability a fundamental utility of the computer you already bought — or a premium SKU Microsoft (and others) get to meter?

Prompt 2

How do we secure terminal-access AI?

When an agent can run commands as you, what is the equivalent of dual-control, least privilege, and an audit log for a three-person shop?

Believe in the build. Bizi Office · AI Class bizioffice.com N speaker notes