By Thorsten Meyer — May 2026
A vendor announced an AI agent last week. The press release said it would “transform how knowledge workers do their jobs.” The product was a chat box that summarizes meeting notes. List price: $30 per seat per month. Headcount target on the deck: 4,000 paid seats by year-end.
The same week, an enterprise CIO killed two of seven AI pilots running across her org. Both pilots had been pitched as “agent platforms.” Both were chat boxes wired to an existing SaaS via OAuth. Neither had a runtime, a state model, an audit trail, or a way to be governed by anything other than the vendor’s own dashboard.
This is the agent trap. The label has been stripped from its meaning. What enterprises are buying — under the word agent — is overwhelmingly a feature on top of someone else’s infrastructure. The vendor monetizes the label. The buyer inherits the dependency.
90% of “AI agent launches” in 2026 fall into this category. The remaining 10% are the actual platform plays. Telling them apart is now a procurement skill, not a technical one.
The agent trap.
Why 90% of AI “launches” are infrastructure liars.
A vendor announces an “AI agent.” The product is a chat box that summarises meeting notes — wired to a SaaS via OAuth, no runtime, no audit trail, no portable state. List price: $30 per seat per month. This is the agent trap. The label has been stripped from its meaning. What enterprises are buying — under the word agent — is overwhelmingly a feature on top of someone else’s infrastructure.
Most “agents” are features wearing infrastructure as a costume.
In 2026, the word agent has been stripped from its meaning. Vendors monetize the label. Buyers inherit the dependency. The asymmetry has a number — and the number does the work this story needs.
Building AI Agents: Platforms, Frameworks, and Real-World Implementations: How to Build AI Agents Using LangChain, LangGraph, CrewAI, LlamaIndex, Vertex AI, Google Opal, Copilot Studio, n8n, and More
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
A request that fails three or more is a feature.
Run the request against five questions before signing any “AI agent” PO. The 90% fail at least three. The 10% pass all five. Price the line item accordingly — because the vendor won’t.
Does it run when no human is logged in?
A real agent runs on a schedule, on a trigger, or as a daemon. If it only works when a user opens a tab, it’s a feature.
Can you swap the model without losing the work?
Real agents treat the model as substitutable. The runbook, tools, memory, and workflow survive a model change. Features are welded to one model.
Where does the state live?
Real agents persist state to a customer-controlled store with a schema you can query. Features persist to “your conversation history” inside the vendor’s database.
What does the audit trail look like to your SOC?
Real agents emit events into a SIEM or webhook stream the security team subscribes to. Features emit nothing — or vendor-side logs you can’t ingest.
What do you keep when the contract ends?
Real agents leave you with skills, prompts, runbooks, memory, integrations as exportable artifacts. Features leave you with the labor you sank into the vendor’s UI — and nothing else.
bloom daily planners 8.5" x 11" Double Sided Meeting Pad – Topics, Takeaways, Action Items & Follow-Ups – Undated Meeting Notes Agenda Organizer
DIMENSIONS: 8.5" wide x 11" tall — 60 double-sided tear off sheets per pad!
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Salesforce isn’t selling agents. It’s removing the seat.
The dominant 2026 enterprise pattern is “headless 360” — the same Customer 360 / Employee 360 data model the suite sold for two decades, except agents now read and write directly. SDR · CSM · support agent are increasingly configurations of an agent runtime, not job descriptions for human seats.
The 9% genuinely AI-driven layoffs cluster exactly where headless is shipping.
Tier-1 support, junior software engineering, structured-data work — paying customers of a UI. If agents become the operators, the seat license attached to the human disappears. The vendor still gets paid; they just get paid per agent action instead of per human login.
Before · Per-seat humans
After · Headless 360
Applied AI Governance: The Model Context Protocol as an Enterprise Control Plane for Autonomous Agents
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
A feature cannot be routed.
When you buy a feature agent from a SaaS vendor, you commit to whatever model the vendor chose, at whatever margin the vendor charges. Real infrastructure exposes the model layer. If the vendor can’t tell you what model is running underneath, that is the answer.
QUERY
AI for DevOps Engineers: Master AIOps, Kubernetes Automation, and Cloud Infrastructure Monitoring
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
The leverage moves to whoever owns the motherboard — not the chip.
Claude is increasingly the engine inside other people’s products. Legal-tech vendors, customer-success platforms, contract-review startups. This is the Intel Inside playbook. The implication for buyers is not “therefore buy Anthropic.” It is the reverse.
Built on a single closed model.
Brand sits on top of someone else’s chip. Looks like a platform. Priced like one.
- Cabinet vendor sells the platform pricing
- Chip vendor (Anthropic / OpenAI) sets margin
- If the chip vendor moves up the stack, cabinet gets squeezed
- Customer keeps nothing portable when leaving
Runtime that uses models.
Routing, governance, audit, skills layer. The chip is replaceable. The motherboard captures value.
- Multiple models, swappable per-request
- Customer-controlled governance plane
- Skills + integrations are exportable artifacts
- Survives the chip vendor moving up the stack
Skills are the portable infrastructure.
A skill written for Claude Code can be loaded into Codex, into Cursor, into any agent runtime that understands the format. The skill is the IP the customer wrote. The model is the chip. A buyer with 40 skills against an internal runtime can swap the model layer in an afternoon.
declarative · versioned · portable
If the vendor cannot or will not tell you what model is running underneath, that is the answer. You’re not buying an agent platform. You’re buying a wrapper.
Five questions any executive can ask in any vendor pitch.
- Does it run when no human is logged in?
- Can I swap the model without breaking the workflow?
- Where does the state live, and can I query it directly?
- Does it emit events my SOC can ingest?
- When the contract ends, what do I keep?
Four assignments. By role.
Run the five-point filter against every agent line item.
Reclassify each as feature or infrastructure. Re-price accordingly. The exercise will recover budget — usually significant budget.
Inventory the OAuth scopes granted to feature agents.
After Vercel, the agent supply chain is your perimeter. Tokens granted to chat-box agents holding Workspace, GitHub, and CRM scopes are the largest unmanaged risk in the stack.
Per-seat agent SaaS is the most expensive way to buy LLM compute.
Per-action and per-token routing typically costs 60–85% less for the same throughput. Demand the comparison. Vendors that refuse to provide it have answered the question.
Add “AI infrastructure vs feature” to the quarterly risk review.
If management cannot draw the line, the line has not been drawn — and someone else is drawing it for you, on a price tag.
Executive Summary
| Property | The 90% (Feature, not infrastructure) | The 10% (Actual infrastructure) |
|---|---|---|
| Where it runs | Vendor’s cloud, single-tenant on their model | Customer’s choice of model + region |
| State persistence | Conversation context only | Durable, auditable, exportable |
| Governance | Vendor dashboard | Customer’s IAM, SIEM, DLP, audit |
| Failure mode | Silent retry, model swap, prompt injection | Surfaced, logged, recoverable |
| Pricing model | Per-seat SaaS, escalating | Per-action / per-token + flat platform fee |
| Lock-in vector | Workflow + UX + data residency | Skills, integrations, runtime — portable |
| What you keep when you leave | Nothing | The runbooks, the workflows, the data |
The asymmetry is the buy decision. Everything else is marketing.
1. What the Word “Agent” Used to Mean
Before 2024, “agent” in software had a stable definition. An agent was a process that:
- ran continuously in the background,
- observed an environment through structured inputs,
- took actions through structured outputs (tool calls, API writes, file changes),
- maintained state across cycles,
- was governable from outside its own runtime.
This is the definition that holds up in production today. It is also the definition that the vast majority of 2026 “agent launches” do not satisfy.
A chat interface that calls one tool and returns text is not an agent. It is a chat interface that calls one tool. The fact that the tool call sometimes invokes an LLM does not promote it to agent status, any more than calling a database promotes a CRUD app to a database.
Vendors know this. The label has been chosen for what it does to the price tag, not for what it describes.
2. The Five-Point Filter
Before signing any “AI agent” purchase order in 2026, run the request against five questions. The 90% of launches that are features dressed as infrastructure fail at least three of them. The 10% that are real infrastructure pass all five.
Filter 1: Does it run when no human is logged in? A real agent operates on a schedule, on a trigger, or as a daemon. A feature operates only when a user opens a tab. If the answer is “you have to be in the app for it to work,” it is a feature.
Filter 2: Can you swap the model underneath without losing the work? A real agent treats the model as a substitutable component. The runbook, the tools, the memory, the workflow — all survive a model change. A feature is welded to the vendor’s chosen model. If GPT-5 is replaced by GPT-6 tomorrow, every workflow you built breaks or quietly behaves differently. The 18-month half-life on every closed frontier capability — established in the April 2026 open-weight inflection — makes model substitutability a survival requirement, not a nice-to-have.
Filter 3: Where does the state live? Real agents persist state to a customer-controlled store with an explicit schema. Features persist state to “your conversation history” inside the vendor’s database, where it is queryable only by the vendor’s own UI, exportable only as a JSON dump, and deletable by the vendor’s retention policy. If you cannot point to the table, you do not own the state.
Filter 4: What does the audit trail look like to your SOC? Real agents emit events into a SIEM, an audit log, or at minimum a webhook stream that your security team can subscribe to. Features emit nothing — or emit a vendor-side log that your SOC cannot ingest. After the April 2026 Vercel breach, the OAuth token a “feature agent” holds is now part of your security perimeter, whether or not your security team has been told.
Filter 5: What happens to the work when the contract ends? Real agents run on infrastructure you can replicate or replace. The skills, prompts, runbooks, memory, and integrations are exportable artifacts. Features run on infrastructure you can only rent. When you leave, you take nothing — not the workflows you built, not the institutional knowledge that accumulated, not even the prompts you spent six months tuning. The lock-in is not the model. The lock-in is the labor you sank into the vendor’s UI.
A request that fails three or more is a feature. Price it as a feature. Renew it as a feature. Do not architect around it as if it were infrastructure.
3. Headless 360: Why the Browser Is the Tell
Salesforce, ServiceNow, SAP, Workday, and Microsoft are racing to position their products as the “agent platform” for the enterprise. Watch what they are actually shipping.
The dominant pattern in Q2 2026 is “headless 360” — the same Customer 360 / Employee 360 data model the suite sold for two decades, except now agents read and write to it directly without a human ever opening the browser. Salesforce’s April release framed this explicitly: the SDR, the CSM, the support agent are increasingly configurations of an agent runtime, not job descriptions for human seats.
The strategic implication is uncomfortable but legible. The historic on-ramp roles in enterprise SaaS — the people whose job was to operate the CRM, the ticketing system, the HRIS — were paying customers of a UI. If the agents become the operators, the seat license attached to the human disappears. The vendor still gets paid; they just get paid per agent action instead of per human login.
This is the second-order story behind the AI layoff numbers. The 9% of layoffs that are genuinely AI-driven cluster precisely in the categories where “headless” is shipping: tier-1 support, junior software engineering, structured-data work. The 47.9% AI-attribution overshoot — established in the April 2026 AI-Washed analysis — is the narrative cover. But the 9% is real, and it is exactly the share where headless agents are quietly going live.
For the worker, the question is no longer “will my job be automated?” It is “is my job currently a UI for a system of record?” If yes, the headless transition is your transition.
For the executive, the question is the same one inverted: “are we paying per-seat for humans whose only job is to operate a system that an agent could now operate?” The answer is the basis of the next 12 months of org redesign — whether or not the AI narrative is honest about it.
4. The Routing Strategy: How to Stop Paying for Lock-In
The April 2026 open-weight releases — DeepSeek V4, Llama 4, Qwen 3.6, Gemma 4 — closed the benchmark gap to single digits. The crossover math established in Single Digits is now a procurement reality: spend €10K to host an open model and pay €0 per token forever, or pay €30K per month to a frontier lab in perpetuity.
Almost no large enterprise should run on a single lab anymore. The defensible architecture is a router in front of the model layer:
- Closed APIs (Anthropic, OpenAI, Google) for the hardest 5% of queries — long-context legal review, the most adversarial customer escalations, the genuinely novel reasoning problems.
- Self-hosted open weights (Llama 4, DeepSeek V4) for the 70% of queries the open models now handle as well as closed ones did six months ago.
- Specialist or distilled models for the remaining 25% — domain-specific, vertical, or latency-critical workflows.
The router decides per-request which lane to use. The cost of the system trends toward the marginal cost of the cheapest path that still satisfies the quality bar. The savings on a single mid-sized enterprise routinely run into seven figures per year.
The relevant point for the agent question is this: a feature cannot be routed. When you buy a “feature agent” from a SaaS vendor, you are committing to whatever model the vendor chose, at whatever margin the vendor charges. Real infrastructure exposes the model layer. Features hide it.
If the vendor cannot or will not tell you what model is running underneath, that is the answer. You are not buying an agent platform. You are buying a wrapper.
5. Anthropic Is the New Intel — But the Implication Is the Opposite of What That Sounds Like
When the 27% Problem analysis dropped in April, the headline number was Anthropic’s enterprise share — 40%, up from below 5% in 2023. The accompanying story was Google’s $750M defensive check.
Six weeks later, the under-told story is the embedding pattern. Anthropic is increasingly not the destination — it is the engine inside other people’s products. Claude is the model inside the legal-tech vendor’s “AI agent.” Claude is the model inside the customer-success platform’s “agentic copilot.” Claude is the model inside the document-review startup, the contract platform, the call-center SaaS.
The historical analogue is correct: this is the Intel Inside playbook. The processor disappears into the cabinet, the cabinet becomes the brand, the user does not know or care which CPU is running. Margin accumulates at the chip layer because every cabinet vendor is buying from a tiny number of suppliers.
The implication for buyers is not “therefore buy Anthropic.” The implication is the reverse. If the model layer is becoming a commodity supplied by a small oligopoly, then the leverage in the value chain is moving back to two places that the oligopoly cannot capture:
- The router and platform layer — the routing logic, the agent runtime, the governance plane, the audit trail. The “motherboard” in the Intel analogy.
- The integration and trust surface with the customer — the workflows, the org-specific skills, the institutional knowledge accumulated inside the runtime.
Companies that build on a single closed model — even Anthropic — are building cabinets that the chip vendor can replace. Companies that build a runtime that uses multiple models, governed by their own platform, are building motherboards. The first kind gets squeezed when the chip vendor moves up the stack. The second kind keeps the value.
The trap in the agent trap is that “feature agents” are cabinets pretending to be motherboards. They have no router, no runtime worth the name, no governance plane, and no portability. The vendor sells them as platforms because the price tag of a platform is what the vendor needs to fund their model bill.
6. The Quiet Counter-Move: Skills as Portable Infrastructure
The most interesting structural development in 2026 is not the model layer. It is the skill layer.
Skills — versioned, declarative bundles of instructions, tools, and behavior — are emerging as the unit of portable agent capability. A skill written for Claude Code can be loaded into Codex, into Cursor, into any agent runtime that understands the format. The skill specifies what the agent should do, in what order, with what data, against what kill criteria. It does not specify which model has to run it.
This matters because the skill is the artifact the customer actually wrote. The model is the chip; the skill is the IP. A buyer who has written 40 skills against an internal runtime can swap the model layer in an afternoon. A buyer who has spent 18 months tuning prompts inside a vendor’s chat UI cannot.
The procurement implication is direct. Ask the vendor whether their agents are programmable as skills, exportable, and portable across runtimes. If the answer is “we have proprietary skills inside our platform” or “you can configure agents in our builder,” the answer is no. The vendor is building moat. The customer is building dependency.
The 10% of agent launches that are real infrastructure all share this property. The customer can leave with the work.
7. The Audit, Compressed
The full version of this audit lives in the procurement template; the compressed version is five questions any executive can ask in any vendor pitch:
- Does it run when no human is logged in?
- Can I swap the model without breaking the workflow?
- Where does the state live, and can I query it directly?
- Does it emit events my SOC can ingest?
- When the contract ends, what do I keep?
Five yeses: this is infrastructure. Price accordingly, integrate carefully, plan for a multi-year relationship.
Three or more nos: this is a feature. Price it as a feature, renew it month-to-month if at all, and do not let it become load-bearing in any workflow you cannot rebuild on a different stack.
Most vendors will resist the framing. The resistance is the answer.
What Leaders Should Do This Quarter
1. CIOs: Run the five-point filter against every “agent” line item in the AI budget. Reclassify each as feature or infrastructure. Re-price accordingly. The exercise will recover budget.
2. CISOs: Inventory the OAuth scopes granted to “feature agents.” After Vercel, the agent supply chain is your perimeter. Tokens granted to chat-box agents that hold Workspace, GitHub, and CRM scopes are the largest unmanaged risk in the stack.
3. CFOs: The per-seat agent SaaS pricing model is the most expensive way to buy LLM compute. Per-action and per-token routing usually costs 60–85% less for the same throughput. Demand the comparison.
4. Boards: Add an “AI infrastructure vs feature” line to the quarterly risk review. If management cannot draw the line, the line has not been drawn.
The Strategic Read
The agent trap is the result of a simple incentive misalignment. Vendors need platform-tier pricing to fund their model spend. Buyers want the productivity story to justify capex they have already announced. The word agent arrived as a label that lets both sides pretend.
The pretense will compress in 2026 H2 and 2027 H1, for the same reason every prior tech-cycle pretense compressed: revenue per employee will not move enough to justify the budgets. When that quarterly number lands, the question every CFO will ask is which of the AI line items survives. The answer will be the line items that pass the five-point filter.
By 2028, the “agent platform” market will look like the early-2010s “big data platform” market did: a few real platforms with portable runtimes, a long tail of features that quietly got renamed into existing products, and a graveyard of vendors that confused the price tag of infrastructure with the responsibilities of building it.
Buyers who run the filter now will skip the graveyard. Buyers who don’t will fund it.
Most “agent launches” are features wearing infrastructure as a costume. The five-point filter is the costume check.
About the Author
Thorsten Meyer is a Munich-based futurist, post-labor economist, and recipient of OpenAI’s 10 Billion Token Award. He spent two decades managing €1B+ portfolios in enterprise ICT before deciding that writing about the transition was more useful than managing quarterly slides through it. More at ThorstenMeyerAI.com.
Related Dispatches
- Your AI Vendor’s AI Vendor — agent supply chain compromise (Vercel × Context AI)
- Single Digits — the April 2026 open-weight inflection
- AI-Washed — the 47.9% / 9% layoff narrative gap
- The 27% Problem —Anthropic’s enterprise lead and Google’s $750M check
- The Bubble Is Not in Valuations — the productivity gap
Sources
- Salesforce Q1 FY27 Earnings Call, Agentforce 360 Update (2026-05)
- ServiceNow, Now Assist Platform Architecture Brief (2026-Q2)
- a16z, State of Enterprise AI Spending (2026-Q1)
- Menlo Ventures, Enterprise LLM Spend Survey (2026-Q1)
- Anthropic, Claude in the Enterprise: Embedded Deployment Patterns (2026-04)
- The Information, Inside the SaaS Agent Re-Brand (2026-05)
- Foresiet, AI Security Incidents · April 2026 Path Analysis (2026-04-22)
- NBER Working Paper, AI Adoption and Productivity in U.S. Firms (2026-02)
