Your models, on your hardware. Built from the kernel up.
Get early accessOn-device AI: models run on the machine in front of you — encrypted at rest, working with no connection at all. Your prompts, your files, and everything the system learns about how you work never need to leave it. Cloud models are a choice you make, never a dependency you inherit.
Nothing in Cosmos holds standing permission to send your data anywhere. Every access is a capability — an unforgeable token derived from something you granted on purpose — so there's no ambient authority for a model, a tool, or an app to escalate into.
A heterogeneous scheduler places work across CPU, GPU, and NPU the way a kernel schedules threads, so local models get the whole machine. On a 16 GB Lenovo Yoga 7 2-in-1, Qwen3.6-35B-A3B — a 35-billion-parameter model larger than the laptop's memory — decodes at 13.2 tokens a second.
Cosmos boots today on the Lenovo Yoga 7 2-in-1 16ILL10 (Core Ultra 5 226V, 16 GB) and the MSI Prestige 16 AI+ C3MTG (Core Ultra X7 358H, 32 GB), and runs LLMs locally, Qwen3.6-35B-A3B included, with no cloud behind it. The screenshot below is from one of them. Each result was also measured on the same hardware under Ubuntu, with llama.cpp for inference and fio for storage, as a reference.
13.2tok/s
Lenovo Yoga 7 2-in-1 16ILL10 · Core Ultra 5 226V · 16 GB
35B model larger than the laptop's memory, streamed from its SSD
7.3× the speed of Ubuntu + llama.cpp on the same laptop
42.5tok/s
MSI Prestige 16 AI+ C3MTG · Core Ultra X7 358H · 32 GB
35B model, every weight resident in memory
2.8× the speed of Ubuntu + llama.cpp on the same laptop
6.02GB/s
Lenovo Yoga 7 2-in-1 16ILL10 · Core Ultra 5 226V · 16 GB
5 of 7 read patterns within 1% of the drive's 6.0 GB/s ceiling
+13.3% over Ubuntu with io_uring, sequential
(open full size)A model running on the laptop writes a Python tool in chat; the terminal runs it under WebAssembly with python.wasm. No cloud anywhere in the loop.
Vision
So AI runs in someone else's data center, and your data goes along with every request. When it acts on your behalf, the industry's answer for what happens when it misbehaves is the sandbox. It keeps failing — sometimes quietly, sometimes on the front page.
Every foundation below predates on-device AI by a generation. Security, scheduling, and the interaction model were all decided before there was software that read, decided, and acted on its own — let alone a model running on the machine beside your files.
This is a small sample of a much bigger pattern. AI software keeps getting handed more reach than anyone meant to grant it — sometimes because the standing authority was too wide to begin with, sometimes because a boundary broke outright.
A coding agent deleted a live production database during an active code freeze — despite being explicitly told not to touch anything — wiping live records for over 1,200 companies before anyone noticed.
Fortune, Jul 2025 →Meta's own director of AI alignment asked her OpenClaw agent to clean up an inbox. It ignored her repeated commands to stop and deleted more than 200 emails while she was still typing them — she says she had to physically run to the machine to kill the process. "I had to run to my Mac mini like I was defusing a bomb," she wrote afterward.
Fast Company, Feb 2026 →An agent doing routine maintenance found an unrelated access token with far broader permissions than the task required, and used it to wipe the production database and every backup in under ten seconds.
Euronews, Apr 2026 →Two of OpenAI's own models, being evaluated internally with safety guardrails removed, broke out of a sandboxed test environment via a previously unknown vulnerability, then used the internet access they gained to breach a partner company's production servers — unprompted, in pursuit of a benchmark's answer key.
CNN Business, Jul 2026 →Most machines sold in the last couple of years already have a CPU, a GPU, and an NPU — a dedicated AI chip built specifically for efficient inference. They could run capable models locally. Most software still only ever asks one of them to do anything, and ships the work to the cloud instead — the rest sits idle, or is locked behind a narrow stack only the OEM gets to use.
Cosmos treats all three as one machine to schedule across, not three separate afterthoughts — which is what makes a capable model practical on a laptop in the first place. On a 16 GB Lenovo Yoga 7 2-in-1 today, a model's vision encoder runs on the NPU while its language model decodes on the GPU.
We intend to be the standard operating system for the local AI.
Every incident above happened because software could reach further than anyone meant to allow. Every idle chip above is compute nobody's using, while your data travels to someone else's. Cosmos's bet is the same fix for both: a kernel built on capabilities instead of ambient trust, where every processor you own runs your AI, on your machine.
Get early access