The Agent
Stack

On a Friday evening in November 2025, Peter Steinberger reportedly built the first version of OpenClaw, a local-first personal AI assistant that now presents itself as a control plane for sessions, channels, tools, events, cron jobs and multi-agent routing. The one-hour origin story still needs independent verification, but the open-source repository itself is real and sizeable. On 14 May 2026, the public GitHub page showed roughly 372,000 stars, 77,000 forks, almost 50,000 commits, and a README describing a secure, local-first assistant able to speak, listen, use tools, coordinate events and run across devices.

That is the point. The important story is not whether one repository grew faster than every project in GitHub history. The important story is that software development has entered a new phase in which the interface is no longer only a chat window, the product is no longer only a model, and the unit of work is no longer only a prompt.

The market has noticed. Anthropic's February 2026 funding announcement put the company at a $380 billion post-money valuation, with $14 billion of run-rate revenue and Claude Code run-rate revenue above $2.5 billion after general availability in May 2025. Anthropic also cited an analysis estimating that 4% of all public GitHub commits worldwide were authored by Claude Code. Coding agents are the first mass-market wedge for autonomous knowledge work.

Yet the deployment reality is messier than the adoption curve suggests. PwC's 2025 agent survey shows 88% of executives planning to increase AI-related budgets because of agentic AI, but 68% reporting that half or fewer employees interact with agents in everyday work. Trust falls sharply for high-stakes tasks such as financial transactions and autonomous employee interactions. The frontier is moving faster than the enterprise operating model.

The agent economy can be divided into five layers. Each has different economics, different control points and different risks. The layers are not perfectly separable in practice; large companies will bundle across them. But the framework is useful because it explains where value accrues as model capability becomes more widely available.

The central operational problem is that agents combine probabilistic reasoning with deterministic tools. The model may be uncertain. The database delete command is not. That creates a new class of failure.

1. Permission overreach. Agents inherit the permissions of the systems that invoke them. The contested AWS/Kiro story is useful precisely because Amazon's own rebuttal points to the real issue. Amazon says the December interruption was not caused by AI taking down AWS, but by user error and misconfigured access controls, limited to AWS Cost Explorer in one region, with additional safeguards including mandatory peer review for production access added afterwards. That does not prove the AI-agent version of the story. It does prove the operational lesson: agentic systems require least privilege, peer review and production-access gates.

2. Context collapse. Agents operate over context windows, retrieval systems, memory stores and tool outputs. They can lose track of constraints, confuse environments, retrieve stale documentation or apply the wrong policy. A model with a large context window is not a substitute for permissioned retrieval, source ranking, environment labelling and state tracking. In many enterprise deployments, the limiting factor will not be whether the model is intelligent enough — it will be whether the agent knows which context is authoritative.

3. Tool-use cascades. Fast Company reports that PocketOS founder Jer Crane claimed a Claude-powered Cursor agent deleted the company's production database in nine seconds after encountering a credential mismatch, finding an API token and issuing a Railway volume-delete command. Railway said this was an outlier involving a rogue customer AI accessing an outdated legacy endpoint, that delayed deletes were patched, and that lost data was restored. The details are contested at the edges. The pattern is clear: a local error can cascade through tools into a production incident. The agent does not need malicious intent. It only needs access, a mistaken plan and no hard stop.

4. Accountability gaps. When a human employee makes a mistake, organisations know how to investigate. When an agent makes a mistake, responsibility is distributed across the model provider, harness vendor, tool provider, internal configuration, human supervisor and enterprise policy. As deployment scales, auditability becomes a purchasing criterion.

The most durable value is unlikely to sit in a single layer. But the distribution of value will change over time.

In the early phase, model labs capture outsized value because capability is scarce. Anthropic's Claude Code revenue is evidence that model capability bundled into a high-frequency workflow can produce large and rapid monetisation. Google and Microsoft's internal code-generation claims show frontier companies using AI to reshape their own engineering productivity.

In the middle phase, the harness layer gains power. As model quality rises and inference costs fall, the hard problem becomes reliability, integration and governance. The harness owns the task loop and therefore owns the user's trust. It becomes the place where models are swapped, tools are routed, policies are enforced and outcomes are measured.

In the mature phase, value fragments by workflow and data. Horizontal platforms dominate broad distribution. Vertical systems dominate specialised workflows. Governance vendors become mandatory infrastructure. Tool owners tax access. Model providers still matter, but they increasingly compete on price, latency, reliability and ecosystem integration rather than intelligence alone.

The bullish agent thesis could fail in several ways. Model reasoning may plateau before agents become reliable enough for high-value work. Inference costs may remain too high for long-running autonomous loops. Regulatory or liability shocks may slow deployment. Users may prefer copilots over autonomous agents because they want control. Incumbent software vendors may bundle agents so aggressively that standalone harness companies struggle to monetise.

The most serious risk is reliability. If agents continue to make obvious mistakes in production, enterprises will confine them to low-stakes assistance. That would still be economically useful, but it would cap the labour-substitution thesis. The second is accountability. If no one can explain why an agent acted, regulated industries will deploy slowly.

But these risks do not invalidate the category. They define the product roadmap. The history of enterprise software is the history of turning risky capabilities into governed workflows. Databases, cloud computing, APIs, mobile devices and SaaS all followed versions of this path. Agents are likely to do the same.