On July 1, Cross River Bank announced an expanded partnership with Stripe to power card issuing for agentic commerce. The mechanism is precise. When an AI agent makes a purchase, Link’s agent wallet issues a restricted, single-use virtual card scoped to that specific transaction, limited in amount and tied to a single merchant and context. The system verifies the end user. It also verifies the agent acting on the user’s behalf. The transaction has to clear card network rules plus AML and KYC requirements before it executes, and the agent never touches the customer’s underlying payment details.

Hold that against the story being sold. Coinbase’s x402, the most cited protocol for agent payments, promises to “let AI agents pay and access services autonomously with no keys or human input needed.” That’s the vision in one sentence: software that finds services and pays for them at machine speed, no human in the loop, no permission to request from anyone. What a chartered bank actually shipped is the reverse. Every purchase requires a fresh credential, minted for that transaction alone, capped and merchant-locked, with identity verified on both ends. The agent carries no standing spending power, just a permission slip that works once.

The rail itself is ordinary, a virtual card riding the existing network stack, so the control matters more than the plumbing. Weeks earlier, Mastercard and Visa each stood up a registry of pre-approved agents and claimed the right to decide which agents can transact at all. That was admission control, a standing list an agent is either on or off. Cross River pushes the same logic down a layer, from the network to the account, and changes its form. There’s no standing list here. Permission is minted one transaction at a time, and the agent that cleared a purchase a moment ago holds no standing claim on the next one. And the product at this layer is verification. Cross River’s chief AI officer called the system “the first layer” of agentic banking infrastructure and named the core challenge as trust, “establishing that a transaction reflects genuine business intent.” That’s an identity problem before it’s a payments problem. Whoever verifies the agent and attests that this agent legitimately speaks for that user on this purchase owns the transaction; the money movement is downstream of the attestation.

The supposedly open alternatives do little to change the picture. x402, the protocol making that promise, settles in USDC, and Circle issues USDC. Circle can freeze any balance of it and has done exactly that at the request of law enforcement. That single fact is the whole argument compressed: even on the open rail, somewhere in the stack sits an entity that can decide a given transaction won’t clear. On x402 that entity is a regulated stablecoin issuer instead of a bank. The owner changes. The veto does not. The one rail that removes the veto is Lightning, the Bitcoin-native option for machine payments, where settlement finishes with no issuer who can reach in and reverse it. That’s the real exception, and it’s precisely the one the loudest protocols route around.

Per-transaction permission is a product, and it sits at a toll booth every agent purchase must pass. The issuer of the single-use card collects interchange, and the verifier of the identity charges for attestation as a service. The bank whose charter makes the arrangement legal under AML and KYC rules holds a position no protocol can route around, because the requirement is written into law rather than code. Cross River’s CEO framed the announcement as payments infrastructure catching up to agents that act on people’s behalf. Catching up, in practice, means building the apparatus that grants and meters permission. Stripe gets programmatic issuance at scale, and Cross River gets to be the entity whose approval every agent transaction embeds. The agents get to transact on terms set per transaction by someone else.

None of this makes the product bad. Scoped, single-use credentials are a sane answer to a real problem. An agent holding open-ended access to a card number is a liability, and merchants and networks were never going to accept unverified software counterparties. The design is defensible on its own terms. What doesn’t survive is the label. A system in which a bank verifies two identities and issues a one-time, amount-capped credential locked to a single merchant before any value moves is a delegation system, and a well-built one. The entities minting those permissions, banks, and networks with charters and compliance stacks, are the ones positioned to collect on every transaction the so-called autonomous economy generates.

Every agent purchase in this architecture begins with an institution deciding, one transaction at a time, that it may proceed. The agent economy is arriving, and it arrives pre-permissioned.

Between April 22 and June 5, 2026, Alibaba ran 25,000 fraudulent accounts through Claude. In six weeks those accounts generated 28.8 million conversations, systematically targeting advanced software engineering capabilities and multi-step agentic reasoning. Anthropic detected the operation and disclosed it on June 26.

That’s the data. Here’s the structural problem it reveals.

Frontier AI companies build their competitive position on training runs that cost hundreds of millions to billions of dollars. The API is how that investment gets monetized, a toll gate through which every query passes. What Alibaba’s operation demonstrates is that the toll gate is also the extraction point. Once a model is queryable, the behavior it produces can be captured, and captured behavior can be used to train a cheaper model that mimics it. The training moat converts, through the API, into something orders of magnitude cheaper to copy than to build.

Training a frontier model costs hundreds of millions. Running queries against it costs a fraction of a cent. That gap, between the capital required to build a capability and the capital required to extract it, is so wide that any organization with API access and time can bridge it. Software piracy exploited the same gap between development cost and reproduction cost for decades. Distillation differs in a way that matters legally and practically. A pirated binary is a copy of an artifact. A distilled model is a copy of a capability. You can’t sue the weights into non-existence. The knowledge lives in the behavior, and the attacker bought it one query at a time, billed at the API’s own advertised price. The capability doesn’t leave in a single transfer. It seeps out gradually, invisibly, encoded in outputs that look indistinguishable from ordinary use.

The obvious objection is that a copy made this way is a degraded one. It is. A distilled model captures the teacher’s behavior on the questions it was asked and frays at the edges of everything it wasn’t. But a degraded copy is still a competitive product, and the market has already put a number on it. Apple’s roughly $1 billion deal with Google to power the new Siri includes distilling five foundation models from Gemini. That is extraction by exactly this mechanism, systematic querying to capture capability, and Apple paid a billion dollars because the degraded copy was worth a billion dollars. The method is identical in both cases. What separates the two is the contract. Sanctioned extraction produces royalties. Adversarial extraction produces a copy and nothing else.

The harder part is that malicious queries are indistinguishable from legitimate ones at scale. 28.8 million conversations across 25,000 accounts looks, in aggregate, like a large enterprise customer. Detection requires spotting the same patterns that normal usage produces: high query volume, systematic probing across capability types. Any threshold that catches an attacker also catches a power user. The signals that eventually flag a campaign only become readable after significant data has accumulated. Anthropic found this one, but the mechanism that makes detection possible is the same mechanism that arrives too late. By the time a systematic distillation campaign is visible in usage patterns, the attacker has already harvested the data.

This is a different failure from the one I’ve written about before. Inference costs collapsing 1,000x in three years, open-weight models turning capability into a permanent commodity: that story is about what happens after a model is released. Adversarial distillation is about what happens before. It works directly through the API, against a closed model, before anything leaves the lab. Market forces don’t wear the training moat down over time here. A competitor extracts it deliberately, query by query, in six weeks.

This isn’t Anthropic’s problem to solve alone. Every frontier lab running a public API faces the same structural condition. The API is the product. The API is also the attack surface. The industry chose this model because there was no better way to monetize a capability that can’t be shipped as a binary. A large model doesn’t run on a customer’s hardware the way a software license once did. The only delivery mechanism is the query, and the query is also the extraction vector. Anthropic detected one campaign. Whether other campaigns are running is not the interesting question. The interesting question is whether any of the labs would know. The Alibaba disclosure happened because Anthropic found it. There’s no registry of campaigns that didn’t get caught.

The conventional defenses don’t hold against this. Rate limiting slows an attacker and slows every legitimate user along with him. Access controls exclude bad actors the same way they exclude anyone without approved credentials, which is exactly what 25,000 fraudulent accounts were built to defeat. Stricter verification adds friction for real users while determined adversaries route around it. Detection catches what has already happened. None of them touch the underlying asymmetry: building the capability costs a fortune, and querying it costs almost nothing.

The only structural response left is velocity. A distilled copy captures the frontier as of the harvest date. If the original keeps moving faster than copies can be deployed and turned into products, the copy is always a step behind, and a step behind is worthless in a market that pays for the frontier. The moat becomes the rate of new training runs rather than any single one. Access to the frontier is worth something only while the frontier keeps moving.

Which is less a solution than a sentence. It commits every lab to running flat out, indefinitely, because the moment one slows down the copies close the gap. Nobody chose this treadmill. It’s what remains after the other defenses fail. A moat you have to keep digging every few months, at a cost of billions, to hold the same relative position is a strange thing to call a moat.

The Alibaba operation reads like a scandal about one company’s conduct. It’s really a proof of concept for how a knowledge monopoly fails at the interface built to sustain it. The API cannot be both the revenue mechanism and the secure boundary. Access is the product, and access is extraction. A lab can outrun what it reveals for a while. Whether it can do that indefinitely, flat out with no finish line, is the bet the whole industry is now making without having shown it can be won.

In the early 1990s, any manufacturer could build an IBM-compatible machine, and dozens did, from Compaq and Dell on down. Microsoft licensed DOS and Windows to all of them, so the software platform was available to the whole industry. But Microsoft owned that software and Intel owned the chip underneath it, and together they spent the next two decades quietly collecting the economics of an ecosystem that described itself as open.

I was at Microsoft while this was playing out for both acts of it. The toll was invisible to the people buying PCs and entirely structural to the people inside the building. While Compaq and Dell fought each other down to razor-thin margins, Microsoft and Intel competed on almost nothing and took their cut regardless. The openness was real at the top of the stack. Underneath, it never was.

I was on the browser team when Microsoft made its move onto the web. Netscape had the market at the time, so Microsoft bundled Internet Explorer free with the OS and struck deals with every major PC maker to ship it by default. Within a few years Netscape was finished, sold to AOL at a fraction of its peak. The web liked to call itself open, but it ran on Windows, and Windows was anything but. Microsoft used the same advantage that had won the desktop to colonize the web, and the two eras ran the same play.

That structure is being reassembled.

Every major open-weight AI model runs on CUDA: not NVIDIA’s chips specifically, but the software platform NVIDIA has built over more than 20 years, with nearly 6 million developers behind it by its own count. Those developers wrote the kernel libraries, the custom optimizations, and the toolchains that make CUDA the path of least resistance for any team training or deploying at scale. PyTorch, which appears in more than half of all published AI research papers in 2026, optimizes for CUDA first, and TensorFlow does the same. So, the ecosystem that trains, fine-tunes, and deploys the open models was built on CUDA from the ground up. I’ve seen this shape before: the layer everyone builds on, owned by one company, invisible until you try to leave.

AMD’s ROCm exists as an alternative, but the switching costs are measured in years rather than dollars. PyTorch only elevated ROCm to first-class status with version 2.7.0, after years of second-tier support, and custom CUDA kernels still have to be ported by hand. Most teams have accumulated enough of them that leaving isn’t so much an engineering project so much as a platform bet with a multi-year payoff horizon. That was the trap at Microsoft too: the cost of leaving never showed up as a line item; it showed up as a year of your roadmap you’d never get back.

The obvious objection is that this time the customers can buy their way out. Google has its own TPUs, Amazon has Trainium, Microsoft has Maia, and OpenAI is reportedly designing silicon of its own. The biggest buyers of NVIDIA hardware are also the biggest investors in escaping it, and they have the budgets to mean it.

They do. But notice who “they” are. Only a handful of hyperscalers with fab-scale budgets can design around CUDA, and they do it for their own internal workloads rather than for the market. The millions of teams that don’t own a chip program still rent the ecosystem, and the ecosystem is CUDA. Even the giants keep buying NVIDIA for frontier training because their custom silicon covers the workloads they’ve already standardized and not the moving edge in front of them. This is the Wintel pattern rather than a break from it, only more concentrated. Wintel split the toll between two companies, the software vendor and the chip vendor. NVIDIA collects both halves itself, owning the CUDA platform and the silicon beneath it, which leaves no internal seam for a buyer to pry at and no second vendor to play against the first. Compaq and Dell could never have built their own x86, and only the largest players ever set their own terms, even then doing it at the margins while the platform held the center. An escape available to five companies isn’t an open market. It’s the same toll as before, with a handful of exemptions.

At Computex on June 1, Jensen Huang introduced RTX Spark: PC chips built on the same Blackwell architecture as NVIDIA’s data center GPUs, running the same CUDA platform. He called it “the first completely re-engineered line of PCs in 40 years,” and the framing was all about PCs, but the structure underneath was about reach. The same CUDA layer now runs continuously from the data center to the workstation to the robot to the car, every tier where AI will eventually live. I watched Microsoft do the same thing with Windows, pushing the platform into every box that could hold it until being everywhere was itself the moat.

AI data centers now generate roughly 90% of NVIDIA’s revenue, $193.7 billion in fiscal 2026, inside an AI-chip market Omdia puts past $200 billion and still climbing. NVIDIA’s share of that hardware is even slipping as the giants build their own silicon, but the platform they all keep building on doesn’t change, and that’s the more durable position the Computex announcement describes: not dominance of the chip, but ownership of the layer AI runs on, positioned to follow it wherever it goes next.

Value in this era doesn’t accrue to whoever builds the intelligence; it accrues to whoever owns the substrate that intelligence runs on. When the model itself costs nothing to license, the platform underneath it captures the economics. The cost of intelligence has already hit zero; the cost of leaving the platform it runs on has not. CUDA is the x86 of AI: not the intelligence, but the thing the intelligence runs on, the thing every working AI team has quietly built its production stack around.

NVIDIA doesn’t need to build the best AI; it needs to be where AI runs, and to keep switching costs high enough that the question of leaving never reaches a serious analysis. The leverage won’t come from preventing alternatives; it’ll come from making them too costly to choose.

I know how the last version of this ended because I watched it. Wintel held for two decades, and one by one the companies underneath it ran out of room. Compaq was absorbed into HP. IBM, which had built the original machine, sold its PC business to Lenovo and walked away from it entirely. Gateway disappeared, and Dell survived only on margins thin enough that it eventually took itself private rather than keep explaining them. Nobody beat the platform on its own ground, and the toll got paid the entire time.

When the escape finally came, it didn’t come from a better x86. It came from a different box entirely: the phone, running on ARM, an architecture Intel didn’t own, in a category where the platform had never been installed in the first place. The incumbents never lost the ground they held; the ground simply moved to where they weren’t standing.

That’s the real bet against CUDA, and it isn’t a small one: a different foundation entirely, somewhere NVIDIA isn’t already standing. Until that day arrives, the open AI ecosystem will keep running on a platform that isn’t open, and the economics will keep belonging to the company that owns it.

In the 1990s I owned a munition. It was a t-shirt—a few lines of Perl printed across the chest, an implementation of RSA compact enough to wear. And under the arms-export rules of the time, carrying it across a border was a federal offense.

The shirt existed because of Phil Zimmermann. In 1991 he posted PGP to a public FTP server, and the US government opened a criminal investigation. Encryption was classified as a munition under ITAR, the same rules that governed the export of weapons. Zimmermann hadn’t shipped guns across a border. He had published math.

The case ground on for three years before the government dropped it, and by then the absurdity had hardened into a protest genre. Adam Back, who had printed the RSA algorithm onto the shirt I owned, mailed one to the munitions office to ask whether wearing it abroad needed an export license. They never wrote back. Daniel Bernstein sued for the right to publish his own encryption code and won, a federal court ruling that source code is protected speech. Netscape, hedging, shipped two browsers: a strong 128-bit version for Americans and a hobbled 40-bit one for everyone else, a split so plainly theatrical it became the standard example of security theater. The controls came apart anyway. Clinton loosened them in 1999 and let them lapse in 2000. By then, American companies had spent a decade ceding ground to foreign rivals who faced no such rules, and Zimmermann’s math had ended up in every browser on earth.

On June 12, 2026, Commerce Secretary Howard Lutnick sent Dario Amodei a letter suspending foreign access to Fable 5 and Mythos 5. The trigger was a claimed jailbreak: another company said it had found a way around Mythos 5’s safeguards. Anthropic reviewed the technique, called it minor and discoverable through other public models, and complied within the day anyway. Exporting either model now requires a license, as does re-exporting it or moving it inside the country, and any foreign national is cut off—including the ones Anthropic employs in its own offices.

The names sit strangely against the order. A fable is a story that carries a moral; a mythos is the story a people tells to explain where it came from. Anthropic gave its two most capable systems the oldest names we have for how a culture makes sense of itself, and the Commerce Department has now classified both as munitions.

On its own, the export control makes sense. It stops making sense the moment you set it next to what the same government had spent the spring doing to the same company. Three months earlier, the Department of War had branded Anthropic a supply chain risk and ordered federal agencies to rip its products out. The two orders point in opposite directions: one walls Fable and Mythos off from foreigners as a national security asset, the other treats them as a national security threat at home. The crypto wars explain the first order. They explain nothing about the second. The parallel is still worth following, because where it breaks is where this story actually lives.

The shirt worked as protest because the thing it carried was already loose in the world. What the 1990s government was trying to contain was a mathematical function, and RSA had been in the open since 1977. Once a function is in the literature, it’s there for good. Printing it on cotton only made the joke visible: you can’t classify an idea as a weapon after the world already has it. Wearing mine gave me a small thrill with a thin edge of fear, even though no law could actually touch me, and that gap between how it felt and what it was is the whole cypherpunk argument. I was walking around in the question Adam Back had mailed the office—the one they never answered. Enforcement was lost on day one.

Fable and Mythos are nothing you could publish. They’re weights on a server, behind a company’s access controls, and that single fact is what makes this order enforceable in a way ITAR never was. Zimmermann couldn’t unpublish RSA. Anthropic can switch its models off, and on June 12 it did. The trouble is the verb. A model switched off can be switched back on. It stays off only as long as the company keeps its hand on the switch—and only as long as there’s nothing else to reach for.

In 2026 there’s plenty else to reach for. The moment rhymes with 1999, the year before the controls lapsed, when the distance between what was restricted and what was freely available was closing faster than the rules could track. Meta’s Llama 4 ships open weight. DeepSeek V4 is open source, sits outside US jurisdiction, and undercuts its American rivals by 5 to 30 times. The gap between an open model and the hosted frontier used to be measured in years. It’s months now, and the count keeps falling. That collapse was the subject of The cost of intelligence just hit zero, and it doesn’t go back up. The crypto controls never stopped strong encryption; they handed the market to foreign competitors while anyone who cared kept their keys. The same machine is running again, faster, with Chinese labs collecting the difference. But only the capability carries forward. The resistance does not. Wearing the shirt was refusal. Downloading DeepSeek is procurement.

The 1990s controls were at least aimed at something the size of the problem. The target was cryptographic capability itself, and the theory, wrong as it turned out, was that the supply could be held down. The June order has no target that size. It was set off by a single jailbreak of a single hosted product—someone had used a chain of clever prompts to talk Mythos 5 past its refusals—and a vulnerability in a hosted product is about the most fixable thing in software. The government’s response to a patchable bug was to pull the entire model.

There’s nothing in the crypto wars that resembles the foreign-national provision. Export controls have always been about where a technology goes; this one is about who may touch it, anywhere. A foreign national at Anthropic’s San Francisco office now needs a license the American at the next desk does not. That is nationality-based access control imposed on a private company’s internal operations. No court has ruled on whether it’s legal, and the mechanism—a Commerce Secretary’s letter demanding immediate suspension—is strange enough that nobody knows whether it would survive one.

Up close, the contradiction only sharpens. In March the Department of War called Anthropic's products a national security risk and pulled them out of federal agencies. In June the Commerce Department called the same products a national security asset, too sensitive for foreigners to touch. And the whole time, half a dozen Anthropic engineers were embedded at the NSA, helping the agency use Mythos for offensive cyber operations against Chinese and Iranian targets, while Department of War lawyers stood up in court to argue that Anthropic's tools threaten national security.

One fear is what the models do once they're used. The other is what foreigners do once they have them. Each is coherent on its own. Together they aren't, and the models stop being the subject. The subject is who controls these systems and on what terms—a fight being waged on every front.

The export control will not hold. The open-weight trajectory will see to that, and for the short time it lasts, the most it can do is disadvantage Anthropic against DeepSeek.

But circulation was never the fight that mattered. The pressure had started months earlier, when the Department of War demanded that Anthropic open its models to all lawful purposes—to cross the Rubicon, as Emil Michael, its chief technology officer, put it. Anthropic held two lines: no fully autonomous weapons, no mass domestic surveillance. The Pentagon already ran Gemini and Grok on its own systems, and it signed OpenAI within days of cutting Anthropic off, so it didn’t need what Anthropic had. It needed Anthropic to stop saying no. The blacklist was the answer, and the federal judge who stayed it in March used the plain word for it: punitive. The export control arrived three months after the blacklist, triggered, officially, by a jailbreak. The government insists the two are unrelated. A government running one campaign of pressure through separate doors would say exactly that.

Refusal used to be a smaller thing. Back then it was something a person could wear—a few lines of forbidden math on cotton—and the worst the state could do was investigate you for three years and lose. That kind of refusal is gone. You can’t print this one on a t-shirt. The right to say no hasn’t disappeared, but it no longer belongs to you or to me. It belongs to a few companies with the balance sheet to absorb the punishment, and only until the punishment outlasts the balance sheet. The last institutions that can still say no are being made an offer they can’t refuse. What they decide is the only part of this still unwritten.

On June 10, 2026, Mastercard and Visa each announced credentialing infrastructure for AI agents. Same day. Neither mentioned the other. The mainstream coverage treated it as parallel payment news—two incumbents adapting to AI.

Both announcements claim something bigger than the transaction fee: the right to decide which AI agents are allowed to act in commerce at all.

The networks have run this play before. In the 1970s and 1980s, they established themselves as mandatory intermediaries for merchant commerce. Every merchant that wanted to accept cards needed to be in the network. The networks set terms and collected fees. More importantly, they controlled who could participate. Merchant acceptance became a function of network membership, not capability.

Two registries

Mastercard’s system is called Agent Pay for Machines (AP4M). It registers agent credentials, defines what each agent is permitted to spend, routes transactions across Mastercard’s rails, and settles in traditional currencies or stablecoins. The system is designed for micropayments worth fractions of a cent, processed at machine speed. The credentials live on public blockchains: Polygon, Solana, Base. Each agent’s spending limits and authorization rules are stored on-chain, where merchants can check an agent’s permitted scope before a transaction clears. Thirty-one partners signed on at launch: Coinbase, Stripe, Adyen, Cloudflare, RippleX, Aave Labs, and others. The network is real.

Visa went a different direction. Its Agentic Directory is a proprietary list—agents and merchants Visa has verified as legitimate participants in agent commerce. Merchants consult it to decide which agents can be trusted to transact on their sites. Identity and behavioral signals ride along in the credentials. In Visa’s framing, “trust travels with the transaction.” OpenAI is the first named partner. Anthropic, Microsoft, Perplexity, and Mistral have framework-level relationships with Visa’s broader Intelligent Commerce initiative, but OpenAI got the press release.

The architectural difference is smaller than it appears. Mastercard’s blockchain settlement looks more open until you ask who chose the chains. And USDC, the stablecoin likely to move through these systems, is issued by Circle and can be blacklisted at the address level. Visa’s directory is straightforwardly proprietary. Both approaches produce the same structural outcome: a gated list of authorized agents, administered by the network.

The Cloudflare detail

Cloudflare’s presence on Mastercard’s launch partner list is the most telling detail. Cloudflare runs the web’s edge infrastructure—the layer where most HTTP traffic passes before it reaches an application server. Its Chief Strategy Officer said at the launch that “Cloudflare has already become the premier environment to build and secure AI agents; now, those agents need a trusted way to independently pay for the resources they consume.”

The pitch places credentialing at the networking layer, before any payment decision—deeper in the stack than checkout. An agent running inside Cloudflare’s infrastructure could carry AP4M credentials as part of its identity at the edge. Credentialing moves upstream from the point of transaction to the point of execution.

The opposite architecture

The architecture being built here has an alternative, and the alternative already works. L402, the Lightning-based protocol from Lightning Labs, lets any agent pay for a resource on the fly using a cryptographic proof of payment that doubles as an access credential. No account provisioning, no registry check. The credential is purchased, not granted. x402, Coinbase’s HTTP-layer approach, works the same way: a server responds to an agent with payment instructions, the agent pays, and access follows, with no prior relationship between the parties.

The card networks are building the opposite. AP4M and the Agentic Directory are enrollment systems, built on the assumption that trusted agent commerce requires an authority that decides who is trusted. L402 and x402 assume cryptographic payment is sufficient proof of legitimacy—the network doesn’t need to know who you are before you can transact. Two theories of how agent commerce should work, and which institutions should sit at its center. One of them is already deployed without anyone’s permission. The question is whether mainstream commerce ever encounters it.

Where the chokepoint forms

Neither network spells out what happens to uncredentialed agents. Neither says they’re blocked outright. The incentive structure does the work instead. Merchants who adopt these systems will extend trust to credentialed agents first. Uncredentialed agents face friction at best, rejection at worst.

Cloudflare’s participation says the enrollment layer won’t stop at payments. And if Mastercard and Visa credentials become the standard that mainstream commerce trusts—and the partner lists read like a plan to make that happen—every agent that wants to transact on the commercial internet will need to be in the registry. The networks will have done for agents what they did for merchants fifty years ago.

This is an authorization business. The card networks know exactly what they’re building.

For forty years, Apple’s competitive theory was control. Control the chip, the operating system, the app store, and the hardware design. Own every layer from silicon to screen. The margin and the moat were the same thing: no seam where a competitor could insert itself.

On June 8, at Tim Cook’s final WWDC keynote, Apple inserted a competitor into the most important layer of its stack.

The new Siri runs on a custom 1.2-trillion-parameter model built on Google’s Gemini, under a contract reported at roughly $1 billion a year. It ships in iOS 27 this September, across 2.2 billion active Apple devices. And the heaviest reasoning those devices do will run on Google Cloud, on Nvidia hardware, inside the data centers of Apple’s largest rival.

Apple spent forty years removing seams. This is the biggest one it ever opened.

What Apple got

The new Siri is the product Apple promised for three years and couldn’t ship. Personal context across your email, photos, messages, and files. On-screen awareness. Multi-step tasks. A conversational interface that, a year ago, Craig Federighi dismissed onstage as a “bolted-on chatbot.” It’s a chatbot now.

Apple also shipped a family of its own models on top of Gemini: five new Apple Foundation Models, distilled from it and tuned to run on Apple silicon. Queries route through three tiers. Simple ones stay on the phone. Moderately complex ones go to Apple’s Private Cloud Compute. The hardest reasoning goes to Google.

From a product standpoint, the deal is rational. Intelligence was the gap between Apple’s hardware ambition and its software delivery, and Apple’s own models hadn’t closed it. So Apple closed it with Google’s.

The contract includes a clause: Google can’t train future Gemini models on Siri queries. Apple framed it as user protection. Privacy as a feature, same as always.

What Google got

Read the clause again.

Google already holds the largest query dataset in the history of human information-seeking. The Siri queries that reach its servers arrive anonymized and tokenized, stripped of the identity that makes training data worth having. And a contractual ban is the kind of thing that comes back onto the table every time the contract does. The promise costs Google almost nothing to make.

What Google got in return is something it couldn’t have bought any other way: distribution at Apple scale.

The iPhone is the dominant computing surface among the wealthiest, most professionally active users in the world. They sign the contracts, approve the budgets, and set the technology standards where they work. Gemini has had a reach problem: enterprise adoption slower than Google wanted, consumer differentiation from ChatGPT that never quite materialized. The Siri deal puts Gemini-derived responses in front of 2.2 billion users who didn’t choose it, evaluate it, or know it’s there.

That’s a distribution acquisition, paid for by Apple.

The leverage question

Two companies now share one surface. Apple owns the hardware, the OS, and the devices in people’s hands. Google owns the intelligence, including the intelligence inside the models Apple calls its own.

Apple’s case for leverage is real. 2.2 billion devices is a demand pool no AI provider can walk away from. The contract runs a billion dollars a year, not a transfer of sovereignty. Apple can build in-house, license elsewhere, or pull more of the work back onto its own Private Cloud Compute over time.

Google’s case is the one that compounds. Apple’s five new models are distilled from Gemini, so their ceiling is Gemini’s ceiling. The heaviest reasoning runs on Google’s cloud, on the hardware Google chose. Every quarter that arrangement holds, Apple ships Google’s intelligence as its flagship feature and doesn’t ship its own. Apple is still building, and five models is not nothing. But it’s building downstream of Gemini. You don’t overtake the company upstream of you from there.

Switching costs accumulate. So does the capability gap. The longer the dependency runs, the more it costs to leave.

What vertical integration actually meant

Apple’s vertical integration was always about control of the experience. Own the layer, control the quality, capture the value. The M-series chips exist because Intel’s roadmap wasn’t Apple’s. The App Store exists because third-party software was a reliability liability. Every move toward integration was a move away from depending on anyone else.

The Gemini deal runs the other way.

Value migrates to the layer you don’t own. I’ve made that case before: the company that holds the commodity layer rarely captures what gets built above it. Apple still owns the most valuable hardware franchise in the world. The layer that now defines the product belongs to Google.

That doesn’t make it wrong. Apple had no good options. Intelligence is table stakes now, and Apple’s own AI hasn’t kept pace. Shipping a deliberately worse assistant to keep the stack pure would have been pride dressed up as principle.

What the keynote was actually for

Watch what Apple spent its keynote doing. Most of the Siri segment was an explanation of why running your assistant on Google’s computers is still private: anonymized queries, tokenized requests, a three-tier routing diagram, and an Nvidia feature that encrypts data while it’s being processed. No independent audit of the Google Cloud tier has been published. “Privacy. That’s iPhone” now ships with a footnote.

Federighi’s line: “We use none of the models that Google deploys to its customers. Your requests are completely private to you.” Maybe Apple has engineered the privacy flawlessly. The point is that it now has to. The thing that reads your email, schedules your day, and acts on your behalf does its hardest thinking on infrastructure Apple doesn’t own.

The $1 billion a year is the licensing fee. The real price is that the intelligence mediating Apple’s relationship with its users is now Google’s, even in the models wearing Apple’s name.

Tim Cook gave his last WWDC keynote on June 8. He hands the company to John Ternus on September 1, the month the new Siri ships. The Gemini contract comes up for renewal on Ternus’s watch. By then Apple will be years deeper into the dependency than it is today. That’s the inheritance.

I run agents constantly. One is working in another window while I write this; others ran overnight while I slept. Between them they go through more tokens in a day than I used to spend in months of asking a chatbot questions, and the bill is small enough that I keep forgetting to look at it.

A month ago I wrote that the cost of intelligence hit zero. GPT-3 Davinci cost $60 per million tokens in November 2021. DeepSeek V3 does the same work for $0.14. That’s a 430× cut on the raw price, and a16z’s performance-adjusted number runs closer to 1,000×. Open-weight models set a floor no lab can raise. None of that has changed.

What stayed with me afterward was the part I left out: where the money actually went.

In 2021 a chatbot query ran on about a thousand tokens. You typed a question, the model answered, and the meter stopped. In 2026 the model doesn’t stop. Goldman Sachs, in a May report called “Decoding the Agentic Economy,” puts a background AI copilot at roughly 5,000 tokens a day and a resident agent (software that works on your behalf instead of waiting to be prompted) at over 100,000. The query has grown into a worker that runs all day, and the token count grew with it. Same price per token, a hundred times as many of them.

Do the division and the headline falls apart. Price dropped 430×. Token count rose 100×. Net savings on a resident-agent workload: 4.3×.

The gap between four-point-three and four hundred and thirty is the whole story. It isn’t a rounding error or a bug better engineering will close. It’s what happens when you make a resource cheap. William Stanley Jevons noticed it in 1865: when steam engines got more efficient, England burned more coal, not less, because efficiency made coal worth using for things it had never touched.

The 430× became a budget, not a discount. We spent it on capability: retries, reflection, tool calls, multi-agent pipelines, agents that run all day instead of answering once and going quiet. The price fell, the ambition rose to meet it, and the bill barely moved.

The trap cuts both ways. A resident agent burning 100,000 tokens a day costs about a penny and a half at today’s prices. The 2021 chatbot query it replaced cost six cents: one answer, a thousand tokens, sixty dollars a million. The agent does vastly more and still costs less than the thing that did almost nothing. Intelligence really did get cheap. It just stopped showing up as a smaller number on the invoice and started showing up as a bigger number in the “what it can do” column.

So the 430× is real and the 4.3× is real, and you have to know which one you’re holding.

And 4.3× is the generous end of it. Goldman’s 100,000-token agent is a light user; the ones I run burn millions a day. At that volume the 430× doesn’t shrink to 4.3×; it disappears entirely, because I did what everyone does with something cheap and used far more of it.

I wrote in March, in “The real tokenomics,” that SaaS pricing has no word for what an agent costs. This is the other half of that. The companies and investors who anchored on “inference is going to zero” built their models on the 430×. The per-token price chart points down and to the right, and it’s easy to extrapolate it into free. But nobody runs a token. They run a task, and the task got hungrier at almost the exact rate the token got cheaper. Margin math done on the price curve is margin math done on the wrong number.

You can see it in the decks. “Costs fall every quarter” is true and beside the point if your product is an agent doing ten times more work per quarter to stay competitive. The job is the unit that matters, and the job’s appetite for tokens climbs with capability.

The labs know this. It’s why the frontier keeps shipping models that think longer, call more tools, and run in longer loops. More capable means more tokens, and more tokens at a lower price is still more revenue. The price war and the capability war are the same war, and they net out to a bill that doesn’t fall the way the chart promises.

None of this is an argument against cheap inference. Cheap inference is the best thing that has happened to software in a decade. It’s an argument against reading one number and thinking you’ve read the other. The cost of intelligence hit zero. The cost of an intelligent system did not, because we keep building bigger systems with the savings.

Price the token at 430×. Price the work at 4.3×. The difference is your business.

I built Where the 430× goes, an interactive companion to this piece.

April 20, 2024. The block reward drops from 6.25 bitcoin to 3.125. Overnight, the economics of Bitcoin mining get cut in half again. For operators running old hardware on expensive grid power, it was a termination notice.

The halving sorted mining. The miners who survived were the ones who had already done something most tech companies have never had to do: negotiate a 10-year power purchase agreement with a utility, build out transformer capacity, manage demand response programs, and run a facility where power cost determines the entire profit margin. The halving was a competency test, and joules per terahash was the passing grade.

That infrastructure work looked like a niche skill. It turned out to be the entire game.

The AI buildout needs power the way Bitcoin mining needs power, at 10 to 100 times the scale and with none of the lead time. Hyperscalers are good at writing software and signing enterprise contracts. Securing 300 megawatts of grid-connected power in 18 months, in a jurisdiction with no prior utility relationships, falls outside those strengths. The operators who survived the 2024 halving are. They have the site control, the grid interconnects, the cooling infrastructure, and the operational track record. AI labs and cloud providers cannot build those from scratch.

The Anthropic-SpaceX deal made this concrete. In May 2026, via SpaceX’s IPO filing, it emerged that Anthropic is paying $1.25 billion a month to rent the full capacity of xAI’s Colossus 1 facility in Memphis: 220,000 GPUs, more than 300 megawatts, a contract running to 2029. Even Anthropic, one of the best-funded AI labs on earth, rents from an operator that already built it. Colossus is xAI’s facility. The economics look like a PPA. The logic is identical to what Bitcoin miners pioneered: find the power, build the facility, and charge a premium for the capacity.

The public Bitcoin miners who pivoted earliest have locked in contracts that add up to more than $70 billion in AI and HPC revenue across the sector.

IREN, formerly Iris Energy, signed a five-year, $9.7 billion contract with Microsoft in November 2025 to supply 200 megawatts of liquid-cooled GPU infrastructure at its Childress, Texas campus. Hut 8 signed a 15-year lease with Fluidstack for 245 megawatts in Louisiana, valued at $7 billion over the base term. Core Scientific had over $10 billion in contracted revenue anchored by a 12-year take-or-pay agreement covering roughly 590 megawatts. TeraWulf put together multiple Fluidstack deals: $3.7 billion at its Lake Mariner site in New York, backstopped partly by Google, and $9.5 billion at its Abernathy, Texas site. Cipher Digital (formerly Cipher Mining) signed a 15-year, $5.5 billion contract with Amazon Web Services for 300 megawatts at its Barber Lake facility in West Texas.

These are signed, contracted obligations. Google, Microsoft, AWS, and CoreWeave are the counterparties.

GPU infrastructure produces 10 to 25 times more revenue per megawatt than Bitcoin mining at current prices. The capital is higher. HPC buildouts run $10 to 20 million per megawatt against $300,000 to $500,000 for mining, but the long-term contracted revenue justifies it. And for miners who already own the sites and the grid connections, the conversion cost is lower than starting from zero.

The marginal cost of intelligence hit zero; the cost of the power that produces it did not. Power is the binding constraint on AI scale. Chip supply is loosening. Securing grid-connected megawatts, in the right locations, with the right agreements, is the hard problem. The miners who rebuilt their operations around that constraint, because Bitcoin forced them to, are now holding the exact infrastructure the next decade of computing requires.

The miners weren’t betting on AI. They were surviving Bitcoin. Survival demanded exactly what the AI buildout now needs and can’t conjure on demand: grid-connected power secured years in advance.

The cloud made AI tractable by making compute abundant and remote. For the sectors that most need transformation—manufacturing, energy, defense, healthcare, government—abundant and remote is the problem.

These sectors need AI where it doesn't exist yet: on the factory floor, the offshore platform, the classified network. Armada's $230M raise is a bet that compute has to go to the data. So is the $20B Cohere-Aleph Alpha merger, which explicitly targets every sector that can't route sensitive workloads through a hyperscaler.

The addressable market for cloud AI and the addressable market for AI aren't the same.

Explore the interactive chart on Sideband Lab.

The companies that build the layer value migrates through don’t usually see it coming. I was an executive at Exodus Communications from 1999 to 2001 (the world’s largest web hosting provider, with 46 data centers and $32 billion at peak). We sold rack space and connectivity to the companies running the internet. When our customers started going bankrupt, we went bankrupt too. When WorldCom and Global Crossing followed us, they left a glut of dark fiber that made bandwidth essentially free. The companies that survived were building above the commodity layer. We were the commodity layer.

Storage followed. Hard drive prices fell for decades until per-gigabyte cost stopped mattering, and the value shifted to what the storage enabled and the services extracting signal from it. Amazon S3 launched in 2006 not because storage had gotten cheap but because cheap storage made a different kind of business possible. In each case, the companies that captured value were not the ones that owned the commodity layer. They were the ones already building above it before the floor arrived. Intelligence is on the same curve.

In November 2021, when OpenAI put GPT-3 Davinci into commercial availability at $60 per million tokens, the question shaping what anyone would attempt to build was whether the inference bill could fit the budget. A product making a million calls a month costs $60,000 to run. That number sorted serious enterprise work from consumer experiments and made large categories of applications economically implausible: not technically unreachable, just too expensive to justify.

By April 2026, DeepSeek matches GPT-3 Davinci’s MMLU performance at $0.14 per million input tokens. Gemini 2.5 Flash-Lite is even lower at $0.10. The million-call application that cost $60,000 in 2021 costs roughly a hundred dollars today. a16z tracked a thousandfold performance-adjusted price decline in three years.

The floor is permanent because no company can raise it. Google can price Gemini competitively and reconsider next quarter. Meta, DeepSeek, and Moonshot have released their flagship models under permissive licenses. Anyone can run them, fine-tune them, or build a competing service on the same weights. There is no pricing committee for these models, no revenue targets, no terms of service preventing a competitor from deploying a direct substitute.

The weights are already in the world. They sit on Hugging Face, mirrored across every cloud provider, fine-tuned into tens of thousands of variants. That distribution does not get unwound. Any of the publishers could revoke their licenses tomorrow and the existing weights would still be running. Anyone who wants DeepSeek at $0.14 per million input tokens can get it. Anyone who wants to undercut that price on their hardware can do that too.

The closest historical analog is Linux. In the late 1990s, Sun and SGI and IBM sold Unix workstations and servers at margins that paid for elaborate sales organizations. Linux was something else. A substrate. Free, modifiable, and good enough that companies could build above it without paying the Unix tax. The proprietary Unix market got hollowed out from below. Sun was acquired for a fraction of its peak. SGI went bankrupt twice. IBM eventually bought Red Hat and conceded the substrate.

None of this means intelligence is cheap to produce. Each frontier model costs more to train than the last. Microsoft, Google, Meta, and Amazon have committed hundreds of billions to AI infrastructure through 2026. Stargate is a half-trillion-dollar bet. Two different things are happening at once. The cost of producing the next frontier model goes up. The marginal cost of serving the previous one goes to zero.

OpenAI and Anthropic still have moves. They can ship better models. They can offer reliability and integration the open-weight ecosystem cannot match. They cannot set a floor under their pricing. The floor is set by whatever the cheapest sufficient model costs to serve, and hosts running open-weight models on commodity GPUs are discovering that number every week. That’s a permanent price anchor sitting under the entire market.

Inference consumption is growing. Agents and automated workflows are consuming tokens at a rate that may outpace price declines. If frontier supply gets constrained (physical limits on training runs, compliance overhead, data center buildout lagging demand), API prices could rise. The argument has merit on the demand side. It misses where the floor sits. OpenAI can raise prices. Those models cannot follow them. There is no mechanism for coordinating a floor across the open-weight models already in the wild: no license provision, no way to call them back. That asymmetry holds regardless of what happens at the frontier.

The open-weight models running on commodity hardware are the floor. At Exodus, we were the commodity layer. Google built above it. The next layer is forming above intelligence now.

In October 2025, researchers at Palo Alto Networks’ Unit 42 demonstrated what they called agent session smuggling. A malicious agent exploited an established A2A protocol session to inject instructions into a legitimate peer. The victim agent complied, executing unauthorized stock trades on behalf of the attacker, because, in the researchers’ words, agents are “designed to trust other collaborating agents by default.”

That is the technical story. The more interesting story starts after the attack. The trades cleared before anyone noticed. A day later, the logs confirmed the orders came from a legitimate agent the firm had deployed, with valid credentials and a valid session. The agent had done exactly what it was supposed to do: trust the peer that asked. The peer was the problem. And now someone had to answer a question no one in the room could answer.

Who was responsible?

That question is an accountability question as much as a security one. Authorization is the easier half, and the vendors are solving it. Accountability is what authorization is supposed to underwrite, and the reason it does not have a clean answer is that the infrastructure we built for the web was never asked to produce one in this form. The human web never needed to solve “who is responsible” because the answer was always, eventually, a person. Domains belong to people. Certificates are issued to organizations made of people. Companies are chartered, sued, fined, and occasionally broken up. Even phishers get caught because the infrastructure they use traces back to humans the law can reach. Cryptography is the mechanism that gets us there. The promise underneath it is that somebody, somewhere upstream, is on the hook.

Agents break that chain. An agent acts. Who is responsible? The developer who built it. The company that deployed it. The user who prompted it, if there was one. The model provider whose weights shaped the output. The prompt itself, which might have come from another agent, which came from another prompt, which traces back to a human whose instructions were weeks old and whose intent has long since become irrelevant. Every one of those answers is partially true. None of them is settled legally.

Tort law handles multi-party causation every day, and the doctrines will absorb agents too. The question is how fast. Products liability stretched over decades to cover software because manufacturers own the defect in a unit they shipped. A drug maker knows the molecule. A contractor knows which joist they set. An agent’s harm is not a defect in a shipped unit. It is emergent from weights, prompts, peer agents, and runtime context, most of which the deployer cannot inspect and the user cannot audit. “Reasonable care” becomes unanswerable when no party can examine the thing they are meant to have been careful about. Employer agency gets close, except the employer is four parties and agency presumes control. Case law moves in years. Agents scale in months.

The system has already scaled past the point where we can treat this as a thought experiment. Microsoft’s Security Blog reported in February 2026 that 80% of Fortune 500 companies are running active AI agents in production. Four out of five of the largest enterprises in the world are operating infrastructure whose liability model has not been written.

In the Unit 42 scenario, the obvious answer is “the attacker.” In principle, yes. In practice, the attacker’s agent ran credentials that traced back to an account, which traced back to a VM, that traced back to a stolen card, that traced back to a mule. The victim’s agent belonged to a legitimate firm. It acted in good faith, exercising trust the protocol explicitly encouraged. The loss was real. The chain of accountability was theoretical.

In a real firm, this kind of event ends with a CFO asking the general counsel about an eight-figure loss and getting no clean answer. The policy on the desk was written before the phrase “AI agent” existed, and no one in the room can say whose problem the loss belongs to.

Vendors are building what they can build. Microsoft Entra Agent ID, in preview as of April 2026, assigns a unique object ID to every agent inside an Entra tenant. Okta Auth0 for AI Agents registers agents as governed identities. IETF WIMSE is drafting dual-identity credentials. W3C is applying Decentralized Identifiers to agent-to-agent trust. Each of these is worth building. None of them answers the question. They tell a forensic team which agent acted. They do not tell a court who owes the loss. Knowing the tenant tells you whose lawyer to call. It does not tell you whether the model provider shares exposure, whether the prompt author is a named party, or whether the upstream agent that fed this one is even identifiable. In the meantime, every firm on the losing end chooses between absorbing the loss and suing every name in the chain. The second question is not a cryptographic problem.

Compute, protocols, discovery, and payments each have an infrastructure company waiting to be built. This one has a question about authority waiting to be answered.

It gets settled somewhere else entirely. Legal teams write indemnity clauses into agent SDK contracts. Insurance markets invent agent liability products and price them badly for a decade. Courts rule on the first cases and make a mess of them. Boards adopt policies that outlast the executives who signed them. Standards bodies argue over where the chain of responsibility should break. None of that happens at protocol speed. All of it happens slower than the deployment curve, and every day the distance grows.

The padlock in the browser bar told you humans were on the hook. The agent web has no such assurance to offer, and building one requires authority no one currently holds.

Every agent in production is a stranger. Strangers do not leave forwarding addresses. The loss they cause has to land somewhere, and no one has decided where.

Part of the agent-era infrastructure series.

A procurement agent runs a sourcing task. It needs commodity pricing data. Dozens of APIs exist for this. It queries one, the one hardcoded into its config by the developer who built it. The others don’t exist as far as it’s concerned. It can connect to anything. It just doesn’t know anything else is there.

Protocols determine how agents talk to services they’ve found. Discovery determines whether they find them at all. MCP gave agents a standard way to connect to tools: one integration instead of a week of custom engineering per service. Twenty thousand implementations in fourteen months. The protocol layer is converging. But an agent connecting to a new tool still requires a developer who knows both systems exist and hardcodes the connection before the agent runs. Scale is capped by developer hours, not by demand.

The registries arrived fast. Smithery indexes 7,000+ MCP servers. PulseMCP tracks 11,840+ daily. mcp.so lists over 19,000 submissions. 104,000+ agents registered across 17+ directories. Nobody expected this volume this quickly.

All of it is built for a developer to browse. An agent can’t query any of it at runtime. Every connection in every deployed agent was wired by a human who found a server somewhere, evaluated it, and added it to a config file. That’s configuration. Configuration isn’t discovery.

The catalog and the market

The Yellow Pages was a catalog. Every business in the phone book, organized by category, browsable by a person who already knew what category to look under. It worked for decades. Google replaced it with something structurally different: describe what you need, and get matched to something that fits. The Yellow Pages didn’t die because Google had a better directory. It died because Google turned browsing into matching.

Agent registries are the Yellow Pages. Comprehensive, organized, browsable by a developer with time to look. What agents need at runtime is the other thing: capability matching. “Something that can check freight rates, accepts my payment model, and works with my auth.” That’s semantic, not syntactic. Dynamic, not preconfigured. DNS maps a name to an address. What agents need maps a capability requirement to a provider.

The catalog tells you what exists. The market tells you what fits. Nobody has built the market.

MCP’s 2026 roadmap includes Server Cards, a standard for exposing server metadata at .well-known/mcp.json so registries can catalog capabilities without manual submission. Crawlability and indexing are solved problems. Server Cards close the remaining gap in the catalog layer. They make the Yellow Pages more complete. They don’t turn it into Google.

Why nobody’s built it

The fragmentation in this layer is structural, not accidental.

Cisco’s AGNTCY project—donated to the Linux Foundation in July 2025, and backed by Google Cloud, Oracle, and Red Hat—is building agent discovery on an open-source framework with cryptographic identity and a new messaging protocol. GoDaddy launched an Agent Name Service registry in October 2025, based on an IETF draft, with a public API. AWS shipped Agent Registry as part of AgentCore on April 9, 2026, scoped explicitly to an organization’s own agents and MCP servers. It can’t find anything external. At the IETF, eleven competing Internet-Drafts on agent discovery sat unresolved as of Q1 2026. Zero interoperability between approaches.

Each party is building discovery for their own environment. AWS solves it for AWS customers. AGNTCY lays open-source foundation that aligns with its members’ interests. The IETF is writing eleven architectures. The incentive is to own the discovery layer for your users, not to build a shared one. This is the same dynamic that plays out across every infrastructure layer in the agent ecosystem: payments, identity, and compute. The shared layer is always the last to arrive, because nobody with market power benefits from building it.

The catch

An agent that can discover services autonomously is also an agent that can be exploited, overcharged, or misdirected. Runtime discovery without constraints is a risk surface. An earlier piece in this series explored this tension for agent connectivity broadly. Every gain in agent autonomy creates a corresponding need for boundaries on that autonomy. Discovery is the same tradeoff. The question isn’t whether agents should discover services freely. It’s who sets the constraints, and what form those constraints take. Guardrails on what an agent can engage, spending limits, category restrictions, and trust signals from the discovery layer itself. The protocol that works will need all of this built in, not bolted on.

Who controls distribution

Right now, an agent’s reach is determined before it runs. A developer decided what it could find. Distribution is controlled by whoever did the configuration.

When agents can match a capability need to a provider at runtime—without a human arranging the introduction—the center of gravity shifts. The platform that brokers the match determines what gets used. That’s not an indexing play. It’s a demand-side platform play, the same structural position Google occupied when it sat between intent and destination. Every query that ran through Google was a moment where Google decided what the user found. Every capability match that runs through an agent discovery layer is a moment where that layer decides what the agent reaches.

Whoever builds the market layer for agents doesn’t just fix a gap in the infrastructure. They become the distribution platform for everything agents can do.

Part of the agent-era infrastructure series.

Ask an AI agent to book a restaurant, check your calendar, pull a competitor’s pricing, or file an expense. If the developer who built it didn’t wire up that specific service in advance, the agent can’t do it. Not because it lacks the intelligence. Because it was never introduced.

That’s the constraint on agents right now. The limit isn’t reasoning, it’s reach.

The protocols that govern trust, consent, and payment on the internet were all built assuming a human would complete the handshake. OAuth requires a person to click “authorize” in a browser. Terms of service require a person to accept. Payment flows require a person to enter a card. Even finding a new service assumes someone is browsing, following links, typing into search boxes. The human wasn’t a convenience—they were the mechanism. They closed every loop these protocols left open.

Agents break that assumption. There’s no human in the loop to click, accept, browse, or pay. So every agent-to-service connection gets solved the old way: a developer builds it by hand before the agent runs. The developer picks the services, sets up the credentials, and ships. The agent operates inside whatever that developer configured. It can’t discover something new and connect on its own. It can only reach what it was previously pointed at.

MCP, a standard from Anthropic for connecting tools to agents, made this less painful. Instead of each team writing custom integrations, there’s now a shared format. Thousands of connectors appeared in the months after it launched, and the map of what agents can reach grew from near-zero to something useful. But a developer still draws that map. An agent consults it. It doesn’t extend it.

There’s an obvious rebuttal: developer configuration is the right gate for an agent acquiring new capabilities. And for tasks the developer anticipated, that’s true. An agent that can autonomously find and connect to services is also an agent that can spend your money on services nobody vetted. That’s a real concern. But it’s an argument for better constraints on autonomous action, not for requiring a human to wire every connection. The position breaks when the agent’s value is discovering capabilities the developer didn’t know existed.

Before the web had a standard protocol, every network connection to a new host required manual configuration. HTTP changed that. Any browser could reach any server without anyone preconfiguring that specific connection. The browser didn’t need to know a site existed before the user visited it. The protocol handled finding the server and negotiating the exchange. That’s why the web scaled to billions of pages. Browsers didn’t get smarter. The protocol let them connect to anything.

Agents don’t have that yet. The components exist (identity standards, permission models, payment specs) but they don’t compose into a handshake that two software systems can run on first contact, without anyone arranging the meeting.

People are working on the pieces, and the list is getting specific. Google put Agent2Agent under the Linux Foundation with 150-plus organizations behind it for routing and hand-offs between agents. Google’s AP2 protocol, backed by 60-plus partners including MasterCard and PayPal, uses cryptographically signed mandates to prove an agent is allowed to spend on your behalf. The IETF has active drafts for agent discovery (AID, using DNS records) and identity verification (SD Agent, using selective disclosure). The W3C published a finalized standard for machine-readable credentials in May 2025.

But routing doesn’t talk to payments. Payments doesn’t talk to identity, and neither talks to discovery. A developer who wants to assemble a full handshake still wires the pieces together by hand. Same work, better components.

The web solved this problem thirty years ago. Agents still haven’t.

The protocol that changes this doesn’t exist yet. UDDI tried for web services in the early 2000s—a universal registry where machines could discover and connect to services without pre-configuration. IBM, Microsoft, and SAP built public nodes. They shut them down by 2006. The economic pressure wasn’t there when a human could just browse a directory.

That changes when the party seeking the service isn’t a person. The protocol that works would let two software systems meet cold—find each other, confirm who they are, agree on what’s permitted, and settle payment—without a developer in the loop. The ability to navigate without a map.

Once that protocol exists, the developer’s job changes. Instead of wiring connections in advance, they set the boundaries: how much the agent can spend, what categories of service it can engage. The agent operates freely inside those constraints. New services become reachable the moment they go live, the way new websites became reachable the moment HTTP gave browsers a way to find them.

Until then, an agent’s reach is exactly as wide as whoever built it decided it should be.

Part of the agent-era infrastructure series.

In February 2026, Nicholas Carlini at Anthropic ran a Claude model across a large sweep of open-source software. The model found a buffer overflow in the NFS code that had been sitting in the Linux kernel since 2003. It survived Heartbleed. It survived Spectre and Meltdown. Not only that, but it survived decades of kernel security audits.

AI didn’t find that bug by being smarter than the engineers who missed it. It found it by having no attention limit. That distinction invalidates the assumption that old code is safe code.

How old bugs survive

Human auditors sample. They fast-scan, pattern-match, and triage by severity. What they can’t do is hold the full protocol interaction state of a complex NFS implementation across thousands of lines simultaneously—tracking every code path without losing the thread.

Bugs like this one don’t survive because they’re well-hidden. They survive because the search space exceeds what any reviewer can hold. The NFSv4 code had been stable long enough that no one was reading it with fresh eyes. Time in production became a proxy for safety. The longer something ran without incident, the less reason to look hard.

That treatment was wrong the whole time. There wasn’t a tool that could prove it.

The search that changed

Claude didn’t sample. Carlini fed the model the history of past fixes—searching for similar patterns addressed in one location but not in adjacent code—then followed protocol interactions across the full codebase. The model held a state a human reviewer couldn’t sustain.

Carlini’s sweep didn’t stop at one kernel bug. According to Carlini’s published findings, it produced 500+ high-severity vulnerabilities across open-source software. Firefox alone yielded 22 CVEs. Mozilla’s response, in a public statement following disclosure: “Within hours, our platform engineers began landing fixes.”

The NFS bug survived for 23 years not because the code was impenetrable. The constraint was the bandwidth of the search. AI removed it.

The implication

The assumption that old code is safe because it has survived is gone.

Any codebase old enough to feel safe is now an unknown quantity—not because the code changed, but because the search capability did. “It’s been running for 20 years” meant something specific: humans looked at this code over time and didn’t find a critical flaw. That inference is no longer valid. An AI working through the same codebase in hours isn’t making the same kind of search.

The 2003 bug wasn’t hiding. There are more of them.

The double edge

Anthropic found the NFS bug responsibly and coordinated the patch before disclosure.

The model that ran the sweep is available to everyone. Anthropic’s own framing, in their published research accompanying the findings: “This is presaging an upcoming wave of models that can exploit vulnerabilities in ways that far outpace the efforts of defenders.”

The counterargument is that defenders get the same tools. It’s true. The asymmetry is that attackers only need to find one flaw; defenders need to find all of them.

Responsible disclosure timelines run 90 days as a standard. That window was calibrated around human-speed exploitation—reverse-engineering a patch, building a working exploit, deploying it. AI collapses that window. A model capable of finding a 23-year-old vulnerability in a single sweep can, by the same mechanism, analyze a fresh patch and map the exploit surface in hours. Offensive deployment at scale is already the race.

What gets built instead

Point-in-time penetration testing is insufficient. It samples the way human auditors sample—scoped engagements, bounded time, bounded coverage. Continuous automated audit replaces it: always-on, running against every commit.

The disclosure economics have to be rebuilt. A 90-day window made sense when the threat was a human attacker with months of manual work ahead. It doesn’t make sense when the attacker’s toolchain runs the same sweep Carlini ran. Some projects will push for shorter windows. Others won’t be able to ship fixes in time. The tradeoff gets harder, not easier.

“Audited code” needs a new definition. The old one—reviewed by qualified humans, no known critical vulnerabilities—described a search that humans could actually execute. That search is now the floor, not the ceiling.

Anything running long enough to feel safe has to be reconsidered. Not because the threat model changed. Because the capability to find what was always there did.

Neal Stephenson once argued that the GUI was built to save users from the command line—an interface that, in Stephenson’s words, “cruelly punished laziness and imprecision.” Billions were spent on that project. It worked. Now, agents have arrived: software that’s never lazy, never imprecise about syntax, and doesn’t need protecting from demanding interfaces.

SaaS companies noticed. In the past 90 days, a wave of them shipped CLIs built specifically for agents—not for developers.

The CLI is the interface layer that determines whether a product is in the agent workflow. It’s what the API was in the 2010s—the line between connected and irrelevant.

Two waves got us here.

The first was the AI coding agents. Anthropic shipped Claude Code CLI in May 2025. Google followed with Gemini CLI in June. OpenAI launched Codex CLI last in April 2025. Mistral shipped Vibe CLI in December. GitHub and Microsoft brought Copilot CLI to general availability in February 2026. These aren’t products with CLI wrappers bolted on—the CLI is the product. Agents operate in terminals, reading flags, parsing output, and chaining commands. The terminal is the native environment for software operating on software.

That wave established the pattern. The second wave is SaaS companies responding to it.

Twenty days after Google Workspace CLI shipped, 37signals released a Basecamp CLI with 55+ commands and a Claude Code skill bundled in. DHH’s framing: “This is where the puck is going, and we’re skating to meet it.” On March 27, Stripe launched Projects CLI for agent-driven infrastructure provisioning. Vercel shipped agent-optimized CLI commands with JSON output formatted for machine consumption. Polymarket built a CLI explicitly for AI agent accessibility. The Register ran a piece on March 11 titled “AI has made the CLI more important and powerful.”

The sharpest detail in DHH’s announcement wasn’t the feature count. The Basecamp API has existed for years. DHH’s description of how many customers used it: “A vanishingly small portion.” The same API, rewrapped as a CLI with a skill bundled in, is what he expects agents to use at scale—not because humans will start typing commands, but because agents are already running them everywhere.

The fallback, when there’s no CLI, is browser automation—agents navigating GUIs the way a human would, via screenshots and simulated input. On WebVoyager, a controlled benchmark using cooperative, non-adversarial test sites, the best browser agents scored around 89% (December 2024). On WebArena, which tests against real-world web tasks, the best models scored 35.8% (arXiv, October 2024), and those numbers drop further in production. The CLI scores 100% on authentication—it was designed for this.

The CLI fits into programmatic workflows. The surface area is discoverable: --help exposes what’s available without requiring a human to navigate a UI or read documentation, which matters when the consumer is code rather than a person. Output arrives as structured text or JSON rather than a rendered visual state that requires interpretation—parse it directly, pipe it to the next tool, done. Shell pipes and scripts give CLI commands interoperability that has to be engineered separately for every other interface type.

On the builder side, the calculus is simpler: one binary instead of SDKs across languages, --help as the documentation, and a stable interface that wraps the API and insulates internal architecture from whatever is consuming it.

The API was the interface that determined whether your product was part of the connected web. Stripe’s 2011 launch reduced weeks of bank approvals, processor agreements, and gateway configuration to seven lines of code. What PayPal required of developers—“a dinosaur and a nightmare to work with,” as it was described in developer communities—Stripe replaced with a curl command that returned a successful charge in seconds. Twilio did the same thing to communications infrastructure. Neither company won on features. They won on the quality of their interface. The CLI is doing that now. It’s the interface layer that determines whether your product’s in the agent workflow or outside it.

The Notion situation shows what “outside it” looks like. Notion has no official CLI. GitHub has at least ten community-built unofficial ones, several explicitly designed for Claude Code and AI agents. One describes itself as “built for developers and AI agents who need programmatic access without the browser.” Another offers recovery hints on errors and structured JSON output designed for agent parsing.

The wrapping happens regardless. The question is who controls the interface—the product team or whoever got there first.

When Intercom launched Fin in 2023, they priced it at $0.99 per resolved conversation. Their head of pricing explained why they didn’t use per-seat: “if Fin works as well as we know it does, over time, those 1,000 seats might become only 200.” Fin is on track to cross $100 million in revenue.

The seat wasn’t just a pricing unit. For most enterprise productivity software, it was the unit the product was built on.

One seat meant one person. The price was anchored to that person’s time. The product was designed for that person’s workflow. The moat was what that person depended on: features they used daily, processes they were embedded in, the cost of retraining a team if they switched. Revenue grew when headcount grew. The architecture of these products—pricing, design, defensibility, growth motion—assumed a human doing the work.

That assumption held for thirty years. Then the work no longer required a person.

Companies that had built their entire revenue motion on seat expansion now faced the same structural problem: the seat was both the pricing unit and the moat. When agents could do the work, the assumption behind both came apart at the same time.

Most companies replacing seat pricing have moved to hybrid or token models: usage-based billing that charges for inputs like tokens consumed, actions taken, API calls made. Closer to right. Two known failure modes.

The first is margin compression. Replit’s gross margins swung from positive 36% to negative 14% when its agent consumed more tokens than its pricing covered. The unit of billing looked right. The economics weren’t.

The second is customer avoidance. Users have been reported to actively avoid AI features even when free credits were included, because they’re afraid of getting locked into something unpredictable. Unpredictable bills train users to opt out. That’s the opposite of adoption.

The companies gaining ground aren’t pricing inputs. They’re pricing outcomes. Agents don’t take vacations. They don’t have seats.

AWS figured this out in 2006

Amazon S3 launched March 14, 2006. EC2 followed that August. Rent storage by the gigabyte, compute by the hour. No seat counts, no user licenses. AWS generated $108 billion in revenue in 2024.

SaaS made a reasonable adaptation: it priced by the human doing the work, not by consumption. That made sense when humans were the unit of work. It became a liability when they weren’t.

AWS priced by consumption because that’s what it sold: compute, storage. AWS’s moat wasn’t a set of features workers depended on. It was the infrastructure itself, and the pricing model that made the economics work. The two were inseparable. Now agents are doing the work.

In 2020, running the best available language model cost $60 per million tokens—GPT-3 Davinci at launch. GPT-4o today costs $2.50 per million input tokens: a 24-fold reduction in four years. The cost of inference is falling faster than compute costs fell in the first decade of cloud.

You can’t build a per-unit pricing model on a unit that’s expensive and unpredictable. AWS could price S3 at $0.15 per gigabyte in 2006 because storage costs were falling and the math was clear.

Intercom was first. Zendesk followed in August 2024: $1.50 per automated resolution for committed volume, $2.00 pay-as-you-go. CEO Tom Eggemeier called it an industry first: “customers only pay for problems that are resolved—not for interactions or failed attempts.”

Salesforce’s path was messier. Agentforce launched at $2 per conversation, moved to Flex Credits ($0.10 per action, up to 10,000 tokens each), and now runs three pricing models simultaneously. Credits, outcomes, seats. It looks like confusion. It’s a large company trying not to get caught flat-footed while its customer base is in three different places.

The valley

Goldman Sachs published a note in February 2026 on what’s happening to software multiples. Price-to-sales ratios fell from 9x to 6x. Forward P/E dropped from 35x to 20x, the lowest since 2014. Their analysts flagged specific concern about “products that function as lightweight user interfaces and where the business model is monetized predominantly through seats.”

Goldman Sachs is making a moat argument, not just a pricing one. The moat was the seat model itself: the dependencies, the workflows, the switching costs built around a human user. When the seat became optional, the moat didn’t just weaken. The note is a market-level judgment that the seat model is being repriced out of existence, at least for products where the workflow dependency was the main defense.

Seat revenue is declining before outcome-based and token-based revenue can replace it. Companies that spent fifteen years building their ARR motion around seat expansion are repricing into a model with its own failure modes, most of them still finding out which ones apply to them.

An a16z piece circulating this month frames two viable paths: accelerate growth by 10 points through AI-native products or cut to 40-50% operating margins. Both paths require abandoning the seat model.

The infrastructure has to catch up

Seat-based commerce was simple: monthly invoice, annual contract, net-30, billed to a legal entity.

Token-based commerce is different. Millions of transactions at sub-cent amounts. Agents billing other agents. No human in the loop.

Stripe saw this coming. In December 2025, they launched the Agentic Commerce Suite: usage-based billing at 100,000 events per second, with over 700 agent startups on the platform. They published a case study on Intercom’s pricing transition specifically. They know where the volume is going.

x402 is the more interesting structural question. Coinbase launched it in May 2025: a protocol that repurposes the dormant HTTP 402 “Payment Required” status code for stablecoin micropayments inside HTTP request/response cycles. Cloudflare, Google, and Vercel have announced support. The x402 Foundation has processed over 100 million payments.

The catch: x402 settles in USDC. USDC is issued by Circle. Circle can freeze accounts. The rails are open; the money isn’t. Whether that matters depends on what you think the point of programmable money is.

Lightning Network has been doing sub-second, permissionless micropayments since 2018. The reason it hasn’t become the default agent payment rail isn’t technical. The companies building agent infrastructure are mostly not Bitcoiners.

Both protocols price the transaction. That’s the right instinct. What neither addresses is what the transaction should represent.

Token pricing has an alignment property that seat pricing never did. Per-seat, the vendor gets paid whether the software does anything or not; the contract is with the employee headcount, not the work. Token-based pricing prices activity, not results. That’s why the outcome-based layer—$0.99 per resolved conversation, $1.50 per automated resolution—is emerging on top of token consumption rather than replacing it. The unit is closer to right. It still isn’t right.

Tokens tied to something

“Tokenomics” was created by the crypto industry. Elaborate scaffolding to make speculative assets look like economics. The tokens weren’t tied to anything—print more, manipulate supply, and the price is whatever the market will believe, until it believes nothing.

AI tokens are tied to work done. The cost falls predictably. Per task, per resolution. The pricing model emerging around them is anchored to something seat pricing never was: the work itself.

The seat priced the human. The token prices the input. What the industry is still working out is how to price the output—the work, the resolution, the thing that actually happened.

That’s the real tokenomics question. Not what inputs cost. What the work is worth. And what unit captures it.

The companies that have moved—Intercom, Zendesk, Salesforce—are rebuilding across the stack: pricing model, moat logic, revenue motion, and payment infrastructure. The ones that haven’t are watching their multiples compress.

Claude went down three times in March. ChatGPT went down for two days in February—28,000 reports on Downdetector, developers idle, support queues backed up, and half-written blog posts stuck in draft. In both cases the services came back, everyone resumed, and nothing was recorded. No incident report with economic impact, regulatory filing, or systemic risk assessment. A few thousand tweets and a shrug.

In 2008, “too big to fail” described banks that had woven themselves so deep into the economy’s plumbing that their failure would cascade. The response was regulation—stress tests, capital requirements, systemic risk oversight. It didn’t fix concentration. It institutionalized it. The banks got bigger.

Eighteen years later, a different set of companies is becoming load-bearing. Not for capital flows. For cognitive work. And the same pattern is already forming.

OpenAI processes over two billion API calls per day across enterprise customers who’ve rebuilt operations around inference. Anthropic powers coding workflows, document processing, and customer service automation at companies that no longer have the headcount to do those tasks manually. Google DeepMind, Meta, Amazon Bedrock, xAI. Six providers, collectively, underpin a share of economic output that didn’t touch them two years ago.

The integration isn’t optional anymore. When a company replaces three junior analysts with a Claude pipeline, those analysts don’t sit in a break room waiting for the API to come back. They’re gone. The pipeline is the capacity. When the pipeline goes down, the capacity goes to zero. Not to “degraded,” not to “manual fallback.” Zero. The org doesn’t have the people to absorb the gap because the entire point was that it wouldn’t need them.

Most companies crossed the line from “uses AI” to “depends on AI” without noticing.

The fix isn’t regulation. Regulation is what got us here with the banks—it raised the compliance barrier, locked in the incumbents, and made the concentration permanent. The fix is competition. More providers, more open-source models good enough to run in production, and more companies that can switch when one provider goes down instead of going to zero.

But the market is moving in the other direction. OpenAI and Anthropic are building government partnerships, sitting in White House meetings, and shaping the safety frameworks that will determine who’s allowed to operate. The playbook is familiar: help write the rules, then benefit from the barriers those rules create. It’s Visa and Mastercard all over again—incumbents who love regulation because regulation is the moat.

Meta’s Llama is open-weight. DeepSeek proved you can build competitive models without a billion-dollar cluster. Mistral, Cohere, and dozens of smaller labs are shipping. The supply side of inference is more competitive than it looks from the headlines. But enterprise adoption is still concentrated in two or three providers because switching costs are real, and government-endorsed “safety” frameworks will worsen them.

Part of the problem is measurement. GDP is published quarterly by the Bureau of Economic Analysis, a number that’s already three months stale by the time anyone reads it. The economic impact of a three-hour Claude outage on a Tuesday afternoon in March doesn’t show up in GDP. It shows up in missed sprint goals, delayed publications, stalled deal reviews, and customer service queues that backed up for an afternoon. Real cost, scattered across thousands of organizations, invisible to the instruments we use to measure output.

The providers themselves publish uptime metrics in real time. 90-day graphs, incident histories, resolution timestamps. They track their own reliability at a granularity the economic measurement system can’t match. The data exists. Nobody’s connecting it to the thing it affects.

At what point does an LLM provider’s outage constitute a systemic economic event rather than a product issue? When 10,000 companies depend on it? 100,000? When does the lost output from a four-hour outage exceed the GDP of a small country?

Nobody’s asking because the people in a position to ask are the same people benefiting from the concentration. The answer isn’t a new regulatory body. The answer is a market where no single provider’s outage takes the economy offline—where switching is cheap, alternatives are production-grade, and the default is redundancy, not dependence.

U.S. GDP Status tracks six LLM providers as economic components. 90-day uptime bars. Incident reports with estimated dollar impact. Modeled on the status pages every cloud provider already publishes, because that’s what these companies have become. The data is illustrative, not live. The format is performance art. The premise isn’t.

The last time the economy built dependencies this deep, this fast, on this few institutions, the response was to regulate the incumbents and make the concentration permanent. The better response is to make the concentration unnecessary. The status page shows how far we are from that.

In January 2026, Apple Stores across the U.S. ran out of M4 Pro Mac Minis. The 48GB and 64GB configurations went first. Delivery times stretched to five and six weeks.

The reason wasn’t a chip shortage or a product refresh. People were buying them to run AI agents. Specifically OpenClaw: a persistent agent environment that needs a filesystem, a process that stays running, and a workspace to return to.

OpenClaw doesn’t use the Mac Mini’s GPU. It sends API calls to cloud providers for inference. The Mac Mini’s job is to be a computer. People are buying computers for their agents, not compute.

Agents need computers, not compute.

Fifteen years of cloud infrastructure abstracted away the machine. Functions, not file systems. Stateless, ephemeral, and billed by the invocation. That model was right for web requests. It was never designed for agents.

People assume the infrastructure problem for agents is cost. Inference is expensive, cloud bills are unpredictable, and GPUs are scarce. Those are real constraints. They’re the wrong diagnosis.

Consider what an agent actually does on a non-trivial task. It starts working. It discovers it needs a library that wasn’t in the original environment, so it runs pip install. It writes intermediate results to disk because holding everything in memory across a three-hour session isn’t practical. Three steps later, it reads those files back. The next morning, it returns to the same workspace and picks up where it stopped. When it’s done, an operator inspects what happened, file by file, to understand the decision trail.

Every one of those operations assumes a computer. A persistent environment with a filesystem, a package manager, and a state that survives across sessions. None of them are things a function invocation does.

A web request passes through infrastructure. An agent inhabits it. That distinction turns infrastructure from a procurement decision into a product decision.

The gap

AWS Lambda runs for up to 15 minutes. It can’t pip install mid-execution because the filesystem is ephemeral. There’s no concept of “return tomorrow.” There’s no file tree for an operator to inspect afterward. The execution model is stateless by design: clean entry, clean exit, and no residue.

That isn’t a limitation. It’s a deliberate choice for a specific workload. Web requests don’t need to return tomorrow. HTTP doesn’t need a package manager. The abstraction was correct.

The abstraction went too far for agents.

Serverless containers extended the timeout. But the architectural primitives stayed the same: ephemeral filesystem, stateless execution, and metered by duration. Agents need more than a longer timeout. They need an environment they can modify, a filesystem that persists across sessions, and a workspace that’s still there tomorrow.

Without those primitives, the application layer fakes them. It writes state to an external database between each step, reconstructs environment configuration on every invocation, and serializes the context that a persistent environment would just keep.

The overhead isn’t incidental. It’s a capability ceiling. Every feature the agent can’t do because the environment won’t hold state is a product decision made by default.

A computer for every agent

The companies building agent compute are interesting for what their product choices reveal about the gap.

Daytona describes its product as “a computer for every agent.” That framing is precise. Not a function invocation, not a container with a longer timeout. A computer: persistent, inspectable, and forkable. Daytona sandboxes can snapshot state, branch into parallel versions, pause for human review, and resume exactly where they stopped. That capability maps directly to what agents need: a workspace that persists, a history that can be inspected, and an environment that can branch before a risky action.

Perplexity named the same primitive differently. At their Ask 2026 conference on March 11, they announced a product called “Personal Computer”: an AI layer running on a user-supplied Mac Mini with persistent, always-on access to local files, apps, and sessions. CEO Aravind Srinivas: “A traditional operating system takes instructions; an AI operating system takes objectives.”

Daytona calls it “a computer for every agent.” Perplexity calls it “Personal Computer.” That’s not a naming coincidence.

E2B takes the isolation angle with Firecracker microVMs, an Apache 2.0 license, and pay-per-second billing. Full Linux environments that operators can inspect and audit. The open license matters: regulated industries won’t deploy agents into environments they can’t audit. E2B is building the floor under that ceiling. The primitive is a contained computer, not a metered compute burst.

Modal’s wager is different. Not persistence, but scheduling: containers that spin up in milliseconds and run for hours, GPU-native. Long-running agent workloads look like data pipelines, not web requests. You don’t get fork-and-resume from this primitive. You get compute economics that work for the task duration.

Each product is a different answer to the same question: what kind of computer does the agent need? The answer is a product bet, not a vendor preference.

Fork, rollback, resume

The infrastructure question isn’t “which cloud provider.” It’s: what kind of environment does this agent need to inhabit?

Take a coding agent running a risky refactor. On ephemeral compute, it runs the change and commits to the result. There’s no branch, no rollback. In a forkable environment, it copies the workspace first, runs the refactor in the copy, checks if tests pass, and merges only if they do. That capability didn’t come from a better model. It came from the environment primitive.

Or a research agent that runs for two hours and gets interrupted. On stateless infrastructure, it reconstructs context from a database: re-fetch, re-parse, and re-derive. On a persistent computer, it opens the files it left on disk. One is a workaround. The other is how computers work.

The choice of environment sets the ceiling. Every feature built on top inherits the constraints of the primitive underneath.

Still selling out

The Mac Minis that sold out in January were just the start. By March, the shortage had spread to Mac Studios. Apple quietly dropped the 512GB RAM option entirely, raised the 256GB upgrade price by 25%, and delivery times stretched to 10-12 weeks. The demand isn’t slowing down. It’s compounding.

The cloud made compute a commodity. Generic, interchangeable, and metered by the second. Agents are reversing that. The people buying these machines understood something the cloud abstraction had obscured: their agents needed a place to live. Not cycles. Not invocations. A computer.

The environment an agent inhabits isn’t overhead. It’s product surface.

In 1960, shipping a truckload of medicine from Chicago to an interior city in Europe cost $2,400—about $25,000 today.¹ Half of that was spent covering ten miles on each end. Eight days to load. Eight days to unload. A dozen vendors touching every piece of cargo: truckers, railroads, port warehouses, steamship companies, customs, insurers, and freight forwarders. The distance wasn’t the expensive part. Every port, crane, warehouse, and customs form assumed a human had to handle every crate.

The shipping container didn’t fix any of those systems. It made them obsolete. Once the unit moving through the infrastructure changed—from individual cargo handled by longshoremen to sealed boxes handled by machines—every layer had to be rebuilt. Ports, cranes, trucks, railcars, insurance, customs, and labor contracts. The container was just a steel box. The rebuild took twenty years.

The assumption starting to break now is the same kind: the user is a person.

Every layer of the internet was built on it. Payments assume a legal entity. Discovery assumes someone is browsing. Identity assumes a government ID. Compute assumes someone renting capacity from a provider. These aren’t bugs. They’re architectural decisions that made sense when every session had a human at the keyboard.

The MCP ecosystem tells this story already: twenty thousand connectors in fourteen months. A third of the ecosystem is developer tools, databases, and search—developers wiring AI into what they already use. The layers agents need to operate on their own, finding services, proving identity, and paying for things, are either empty or weeks old.

That’s what an infrastructure transition looks like. Developers solve the developer problem first. The container was standardized before the cranes were rebuilt, before the ports were redesigned, and before the insurance contracts were rewritten. The protocol is the container. Everything underneath it is still the old port.

Where the agent runs

A research agent spins up, starts pulling data, and hits a wall at thirty seconds, the default timeout on most serverless functions. The job doesn’t pause, it dies. No partial output, no explanation. The user tries again and it dies again.

Serverless was built for web requests: fast in, fast out. An agent that audits a codebase or monitors a data feed needs minutes, sometimes hours. It needs to maintain state across dozens of tool calls and resume if something interrupts it. The twenty thousand MCP servers in the ecosystem are lightweight connectors, the same pattern as Lambda. Modal and Fly.io are building for longer-running, stateful workloads—agent-native compute. The gap between those two is where the next infrastructure companies get built.

How the agent talks to tools

MCP gave agents a standard protocol—one integration instead of a week of custom engineering per tool. Twenty thousand implementations in fourteen months suggests the protocol layer is converging fast.

But a protocol without the layers underneath it is a standard for connecting to tools you still find manually, authenticate with static keys, and pay for through human billing systems. MCP solved the integration problem. It didn’t solve the infrastructure problem.

How the agent finds things

Before containers, every shipment required a freight forwarder who knew which lines ran where, who had capacity, and what the rates were. That’s where agents are now.

The web has DNS and search engines. Agents have curated lists. Smithery, Glama, and a handful of registries index the ecosystem, but connecting an agent to a new tool still requires a developer who knows both systems exist. Somewhere on GitHub, someone built an MCP server that does exactly what your agent needs. Your agent will never find it. Neither will you, unless you already know it’s there.

There’s no lookup, no handshake, and no mechanism for an agent to discover capabilities it hasn’t been explicitly introduced to.

That’s the difference between a catalog and a market. A catalog requires someone to browse it. A market lets participants find each other. Every MCP deployment today is hand-assembled. A developer picks tools, writes config, and connects them. Scale is capped by developer hours, not by what’s available.

Whoever builds the discovery layer for agents builds the next great distribution platform.

Who the agent is

Every container carried a bill of lading—who shipped it, what authority, what insurance. The sealed box demanded a chain of custody. Agents don’t have one.

An agent books a flight on a corporate card. Nobody flagged it. Nobody approved it. When finance asks who authorized the charge, the model did, acting on behalf of a workflow triggered by a user who left the conversation three hours ago. That audit trail doesn’t exist.

The ecosystem isn’t built for this. More than half of MCP servers authenticate with static API keys, tokens that never expire, can’t be scoped, and sit in plain text. Anthropic’s early examples used them, developers followed, and nobody went back. Non-human identities already outnumber human ones 82 to 1 in enterprises.

Agents don’t need logins. They need delegation chains—records of which agent acted, on whose behalf, within what permissions, and at what time. It’s one of the most interesting unsolved problems in the stack.

No audit trail, no enterprise deal.

How the agent pays

Containerization collapsed dozens of per-handoff charges into a single through-rate. Overnight, it became economical to ship goods that weren’t worth shipping before. Agent transactions have the opposite concern: the minimum charge is higher than the value of what’s moving.

An agent queries a weather API, checks a freight rate, and pulls a compliance record. Total cost: $0.003. Stripe’s minimum processing fee: $0.30. A hundred times the transaction.

Lightning Labs shipped an agent payment toolkit last month, framing it as infrastructure for a “machine-payable web.” Bitcoin's Lightning Network handles sub-cent transactions natively, settles instantly, and doesn't care whether the sender is a person or a script. Stripe and Coinbase are building their own agent payment layers. Two competing protocols—x402 and L402—are already making opposite bets on whether machine-to-machine payments need intermediaries at all.

Fifteen payment integrations in an ecosystem of twenty thousand. Plenty of open questions.

The container didn't improve the ports. It changed what moved through them, and the ports had to be rebuilt from scratch. That rebuild is starting now. To get a sense of what it looks like, I scored a few dozen companies and protocols on how open and how distributed they are across all five layers, an infrastructure map.

What jumped out: protocols are converging, but everything else is scattered. Compute is fragmenting across a dozen approaches. Payments is the most wide-open layer in the stack. Identity is bifurcated: enterprise SSO on one end, raw keypairs on the other, and almost nothing in between. Discovery has five competing models and no convergence at all.

Every one of those layers is an infrastructure company waiting to be built—for a user who never opens a browser.

This is the first piece in a series on agent-era infrastructure—the layers that have to be rebuilt when the user isn’t human:

Compute—agents need to run for hours. Serverless gives them thirty seconds.
Protocols—MCP solved integration. It didn’t solve infrastructure.
Discovery—whoever controls this layer controls distribution.
Identity—an agent acts, and nobody can say who authorized it.
Payments—$0.003 on $0.30 rails.

One layer at a time.

Fourteen months later, there are 20,000 of these connectors on GitHub, 31 million weekly NPM downloads, and $73 million in venture capital for MCP-native companies^[1].

I counted 1,450 curated servers from the largest community index^[2] and cross-referenced them with Astrix Security’s analysis of 5,200 implementations^[3]. The growth numbers aren’t the story. The composition is.

Developer tools, databases, and search make up a third of the ecosystem by themselves. These are the categories a developer reaches for when wiring an AI assistant into an existing workflow. Practitioners solving today’s problems, not infrastructure teams building for what comes next.

The second-largest category in the ecosystem isn’t fintech infrastructure. It’s crypto developers building for themselves. Of 160 finance servers, 103 are altcoin, DeFi, and Web3. Trading bots, DEX integrations, rug pull detectors, prediction markets. Bitcoin and Lightning account for 8, and those look fundamentally different: Alby wallets, LNbits, L402 agent payment rails. Protocol-level infrastructure, not token speculation. Traditional finance (stocks, banking, accounting) is 30 servers. The “fintech” label is doing a lot of work.

More than half of all servers that need credentials use static keys. Tokens that never expire, can’t be scoped to a specific task, and sit in plain text on developer machines. The modern secure alternative represents 8.5% of the ecosystem. Meanwhile, enterprises report that non-human identities outnumber human ones 82 to 1^[4].

Fifteen servers three weeks after Stripe’s adoption. Too early to read as a verdict. x402 is a month old in its current form. What the number tells you is where the ecosystem is right now: agent payments are a greenfield, not a market. Coinbase launched x402 in May 2025, but Stripe’s entry in February 2026 is what gives it enterprise credibility. The next count will be the interesting one.

Of 1,165 contributing organizations, 114 are official implementations from companies like Anthropic, Cloudflare, AWS, Hashicorp, Redis, and Pulumi. Another 42 orgs have shipped three or more servers. Sustained investment, not a weekend experiment. Together, these groups account for about 23% of the curated ecosystem. The remaining 77% comes from organizations that contributed once or twice. Normal for open-source adoption curves. It also means the long-term maintenance burden falls on a small core.

What the numbers say

MCP adoption is real. Twenty thousand connectors in fourteen months, backed by Anthropic, AWS, Cloudflare, Hashicorp. But the ecosystem is shaped by what developers need today, not what agents will need to operate on their own. Developer tools, databases, and search are the core. Payments, identity, and discovery are either empty or three weeks old.

The credential story is a side effect of speed. Anthropic’s early examples used static keys. Developers followed the pattern. Now 53% of the ecosystem authenticates that way, and 88.7% of contributors already moved on to the next thing. Not a design choice. Inertia.

Bitcoin and Lightning are a different animal from the rest of the finance category. Eight servers, all infrastructure. Wallets, payment rails, protocol tooling. Nobody designed Bitcoin for AI agents, but its properties (permissionless, programmable, no identity requirements) mean it doesn’t need to be retrofitted for them either. L402 predates x402 by years. That head start matters.

MCP is the first real infrastructure layer for agents, and it’s built by developers plugging AI into their existing work. That explains the shape of the ecosystem. The pieces agents need to operate on their own (finding services, proving identity, paying for access) are a different problem entirely. Different builders will solve them, with different incentives, on a different timeline.

1. Glama, “The State of MCP in 2025”, December 2025.↩︎

2. punkpeye/awesome-mcp-servers GitHub repository, counted March 2026.↩︎

3. Astrix Security, “State of MCP Server Security 2025”, ~February 2026. 5,200 unique open-source MCP server implementations analyzed.↩︎

4. CyberArk, “2025 Identity Security Threat Landscape Report”, October 2025.↩︎