Rabbit's OS3 hands a cloud chat window direct control of five endpoints per account

One command is the whole installation ^[2]. After it runs, instructions arrive from a chat session hosted in Rabbit's cloud, and the agent operates desktop software, local files and web pages, or writes and runs code, to finish the task ^[3]. The permission model stays where it was: the host operating system prompts for system-level access locally, the user can revoke it at any time, and Rabbit says sensitive actions require confirmation ^[10]. Rabbit did not list which actions count as sensitive ^[11].

What leaves the endpoint comes in two parts. Rabbit says the local agent does not copy, store, use or sell a user's files, and that the files stay on the computer ^[7]. Conversations with OS3 and the memory it builds from them sit on Rabbit's servers, and the company says it keeps no copy of what it relays onward ^[8]. The relay is what a data policy has to account for: when a task runs, Rabbit's servers process the relevant content and prompts, then pass them to the model provider the user picked, which handles the data under its own terms ^[6]. Help Net Security's example is a contract summary, which puts the contract's text in front of two companies ^[9].

The employee picks the second custodian. Users supply API keys from frontier AI labs, cloud router platforms or locally hosted models, and can switch models without losing context, memory or skills ^[12]. An egress rule written around one provider's endpoint stops matching the traffic as soon as the key changes.

Skills extend what the agent can do, and they install from anywhere they are published, by Rabbit's account: paste the URL into the chat and OS3 sets it up, with no command line step and no extra configuration file ^[13]. Help Net Security noted that the convenience also skips the point where a user might read what they are adding to an agent that controls their computer ^[14].

Once onboarding is done, the same account answers from the web portal on desktop or mobile, Telegram, iMessage, RCS or SMS, or the r1 ^[15]. Four of those six are messaging transports ^[19].

Jesse Lyu, Rabbit's founder and CEO, said the company spent two and a half years building toward "a system you don't operate, but instead just tell it the outcome" ^[16]. OS3 is live at os3.rabbit.tech ^[15]. It follows twelve consecutive months of device updates, including rabbitOS 2, a terminal mode and bring-your-own-key support for DLAM, Rabbit's computer-control technology ^[18], and it will be the default operating system on the cyberdeck Rabbit plans to ship ^[17].

No flaw in OS3 is needed for any of this to land on a corporate machine. A user who installs the agent has given software that takes orders from a chat window direct control of the host, and the content each task needs passes through Rabbit's servers on its way to a model ^[5].