Agents are the product of the year and the risk of the year

If you remember one word from 2026, it will be “agent”. And if you remember one month, it will be August. Within a few weeks, four products came out that together describe where AI has moved — and at what price.

What came out in a single month

Grok Bot from xAI. Released in August as a beta. The gist: every agent gets its own cloud computer — a browser, a file system, a terminal. It logs into your tools with your credentials, works through a multi-step task and only gets in touch when it needs approval. You shut your laptop and it keeps working.

Cursor Origin. A version control and code review platform, in early beta since mid-August. A provocative premise that the company wrote into its own brief: what if the main users of your version control system are no longer people? Origin syncs with GitHub, but it's designed for a world where most commits are written by a machine.

Slack Code from Salesforce. Released in August for all Slack plans. The idea: coding agents — Claude Code, Devin, GitHub Copilot, agents from OpenAI and from Vercel — shouldn't each sit in their own tab, but in a shared channel where the whole team sees the plan, the line-by-line diffs in the code and a live preview of the result, and where work is approved before anything is deployed.

Claudeforce. An expanded partnership between Salesforce and Anthropic, announced at the end of August. Claude moves into Salesforce as the reasoning model, and Salesforce moves into Claude as a plugin with 37 pre-built sales skills — prepare a meeting, go through the pipeline, update a record. Salesforce stresses that the permissions and access controls from the CRM are preserved in the process.

Four different companies, four different approaches, one sentence in common: the agent got the keys to your tools.

Where the game is actually being played

Interestingly, the competition isn't over the model. It's over the harness — the wrapper around the model that gives it tools, memory, a sandbox and permissions. During 2026 both the big labs and the tooling companies released the harness as a standalone product and started arguing about who gets to charge for it, and how much.

It makes sense. Today you can swap a model in five minutes. But the harness — that decides whether a tool may delete your file, send an email or approve an invoice. Whoever owns the harness owns the relationship with the customer.

For you, something very practical follows. When you're choosing an agentic tool, don't ask about the model's benchmarks. Ask three things:

1. Where does the code the agent runs execute — on your machine, or at the vendor's?
2. Whose credentials does the agent use, and where are they stored?
3. What does it do by itself, and what does it hand you for approval?

The risk of the year: what happens when you don't answer these questions

August 2026 brought a second piece of news as well — and it was a cold shower. Reuters described an internal Meta project codenamed Project OT (Organization Transformation), which originated at a leadership offsite in January. The goal: to turn the company into an “AI native” organisation where agents take over routine work and smaller teams of people remain to manage them. Scenarios under consideration had some teams slimming down by as much as 60%.

According to the internal figures Reuters described, it didn't work out:

In the end the company called off the most ambitious part of the plan. That first number is the whole story in a nutshell: volume is not value. The agents managed to produce more than three times as much work, but what actually made it through to users grew by only a third. The rest was noise — and sometimes worse than noise, because incidents went up and firefighting took more time.

Meta has a security team, a budget and processes that an ordinary company can only dream of. If it didn't work there, that isn't proof that agents don't work. It's proof that agents without management don't work — and that you only find out from the numbers, not from the demo.

What to take home from this

You don't have to run a company of tens of thousands of people for this story to catch up with you in miniature. Three lessons hold for a single person too:

• Measure output, not activity. When you set an agent loose on your email, don't ask “how many did it process”, but “how much of it did I have to rewrite afterwards”. The first always grows. The second is the truth.
• Deploy one at a time. Eight agents at once means that when five of them cause trouble, you can't tell which. One agent, one task, two weeks, then an evaluation.
• Separate “prepare” from “send”. Almost all the value of agents is in the preparation. Almost all the risk is in the sending. Separate the two and you get most of the benefit and almost none of the risk.

The last track of this series covers management and risk in detail — from the technical basis of agent vulnerability to one-page rules that work better than a twenty-page treatise. But the order matters: build the control room first, then let the agents in.

The next part therefore starts from the question that has replaced “ChatGPT, yes or no”: what runs where, and who is allowed to run it.