Rabbit turns its AI agent into an operating system you run from a text message -- and hands it the keys to your laptop with no published list of what it won't touch

Rabbit, the startup behind the pocket-sized R1 gadget that drew mixed reviews in 2024, released OS3 on Sept. 22 -- a shift from selling a device to selling the agent itself. OS3 runs in the cloud and connects to up to five of a user's own devices -- Windows, Mac, Linux, cloud VMs, or the original R1 -- through a downloadable local agent, letting someone type or speak a goal in one running chat and have the system decide which machine actually does the work. Founder Jesse Lyu pitched the shift plainly: "OS3 allows users to stop worrying about whether a task is technically possible, and start collaborating on whatever is on their mind."

The pitch is direct machine control: install the local agent with one command, and OS3 can operate desktop software, edit local files, and write and run code autonomously, on top of anything it can already do on the web. Sensitive actions -- the ones Rabbit says will pause for user confirmation -- are, by the company's own account, not fully specified: security researchers reviewing the launch noted that Rabbit has not published a list of which actions actually count as sensitive, leaving unclear what triggers a check versus what an agent can simply do. The same review flagged that OS3 lets users install third-party 'skills' by pasting in a URL, with no code-review step before the skill gains access to a device it can already control.

None of that is unique to Rabbit -- most agentic tools on the market in 2026 make some version of the same trade, convenience for a wider blast radius if something goes wrong. What's new is how far OS3 pushes the model: a text message from a phone, with no app in between, now has standing to reach into a laptop's files. Whether that reads as the operating-system layer AI agents have been missing, or as exactly the kind of ungoverned agent access that platforms like Nvidia's new Open Agent Safety Platform were built this same week to contain, is a live question OS3's own early reviewers are already split on.