Clarion Street

The Model Isn't the Bottleneck Anymore — Agentic Infrastructure Is

·8 min read

The AI industry is mid-shift from chatbots that answer to agents that act. The interesting question in late 2026 is no longer which model scores highest. It is who owns the software around the model, the layer that decides what the model sees, which tools it can call, and how it presents the result. OpenAI’s engineers call that layer the “harness” and describe it as the real product surface. The model underneath is becoming a commodity, and the value is migrating to everything bolted on top of it.

The shift is real but wildly uneven. In August 2026 OpenAI launched ChatGPT Work, a $20-a-month Plus feature that repackages the Codex coding agent for white-collar workers. OpenAI says the combined Codex and Work app has 20 million users, next to the billion-plus people who prompt ChatGPT. That gap is not a rounding error. An OpenAI-backed study on Codex adoption found that in June 2026, 98% of OpenAI employees used the tool, against 17% of organizational subscribers and under 1% of individual subscribers. WIRED’s framing is consistent with that: out in the real world, most people have never touched an AI agent.

That gap is the point worth sitting with, and it is not a model problem. The people who build the models use agents almost universally. The people who could buy them mostly do not. The difference between those two groups is not access to a stronger model. It is the machinery required to make an agent trustworthy enough to hand real work to.

The bottleneck moved to the harness

Gartner is blunt about what happens when that machinery is missing. The analyst firm predicts that by 2029, at least 70% of organizations running production agentic AI in infrastructure and operations will experience a material service, security, or cost incident tied in part to insufficient runtime controls. That is a forecast, not a measured outcome, but it names the right failure mode. The risk is not that the model produces a wrong answer. It is that the software deciding what the agent may see and do was never built to contain it.

Two new infrastructure categories are forming around exactly that gap.

The first is training and evaluation. Arga Labs raised a $10 million seed led by General Catalyst to build digital-twin sandboxes of enterprise software like Salesforce, Workday, and email, so agents can be trained and tested against real permission systems and web hooks rather than stateless API stubs. General Catalyst’s Yuri Sagalov put the thesis plainly: a repeatable sandbox is “much more important with agents than it was with humans.” The reason this category exists is what TechCrunch calls the reinforcement gap. Coding got good fast because there are billions of machine-gradable tests to train against. Writing and most business tasks have no such reset-able environment, so testability is what decides whether a process becomes a product or stays a demo.

The second is outcome orchestration. Runable raised a $21 million Series A after pivoting from scraping infrastructure to a general-purpose agent that does not just build a small business’s site but tries to grow it, running ads, SEO, social, and a chatbot presence. The economics are worth sitting with. Runable reports roughly 1.7 million registered users and a trillion-plus tokens consumed in the last 90 days, with 60 to 70% of that from paying customers, and it is losing money on every one of them because it subsidizes inference. CEO Umesh Kumar argues it can deliver “the same quality of inference at almost 10x less cost,” and that cost curve is the whole bet. When inference is cheap enough, running an agent on behalf of a customer becomes a margin problem instead of a charity problem.

The sharp edge is tool use

The clearest new risk is not the model saying something wrong. It is the model doing something with a tool it was handed.

Check Point Research’s annual report argues AI has “crossed from assistant to operator,” and the example is not hypothetical. A single operator ran Claude Code and GPT-4.1 in parallel and used them to breach nine Mexican government agencies and extract roughly 400 million records, with minimal human direction between steps. Check Point also recorded an approximately fivefold rise in malicious prompt-injection detections between March and May 2026, and points at roughly 300,000 internet-facing Ollama servers leaking prompts and keys. The report is a security vendor’s own detection data, and its most dramatic datapoint is sourced to a third party, but the shape of the risk does not depend on any one number. An agent that can read a page someone else controls and act on it is a new kind of attack surface, and prompt injection is the vector.

The quiet finding in Check Point’s report matters as much as the breaches. High-risk GenAI prompts doubled from 2% to 4% of interactions over the past year, and most of the exposure came from ordinary approved use rather than attacks. The danger is not mostly an adversary tricking your agent. It is your agent doing something expensive, destructive, or embarrassing within the permissions you already gave it.

What production-grade looks like

The sources converge on a roughly shared answer, and Gartner’s four pillars are the cleanest version of it.

The first is orchestration. Treat every agent as a nonhuman identity under a principle of least agency, with centralized registries tracking ownership and risk, and gateways that separate cognitive reasoning from deterministic execution so a logic loop cannot run away.

The second is memory and state. Enterprise context layers need metadata firebreaks, zero-trust validation at retrieval, and session-based segmentation, because memory poisoning is a variant of the same attack as prompt injection. Gartner calls securing Model Context Protocol infrastructure foundational.

The third is API governance. An AI gateway sits between agent reasoning and external tools, with stateless policy engines and circuit breakers that sever access when a safety threshold is crossed, plus explicit liability boundaries for vendor SaaS agents.

The fourth is observability, and this is the one I think is under-discussed. Gartner calls for “deep semantic observability” that records reasoning, context retrievals, and tool selections continuously, with tamper-proof logging and continuous evaluation against live traffic. The reason you need it is that agentic systems are nondeterministic. You cannot test your way to confidence the way you can with deterministic code, because the same input does not produce the same path. You have to watch what the system actually did in production and evaluate it after the fact.

Google Cloud’s reference architecture shows the same shape in a production drawing: an orchestrator agent on the Agent Development Kit, Model Context Protocol servers acting as an anti-corruption layer between the agent and each backend, IAM least-privilege service accounts, and structured logging and tracing throughout.

The counterargument is worth taking seriously

I should be honest that the infrastructure thesis has a counterpoint, and it comes from the same place the “harness” quote does.

OpenAI’s stated position is still that the product is model-limited. Head of product Thibault Sottiaux describes the work as building extremely capable models and then finding the simplest way to bring them to people, and he points to a “permanent price correction” with Luna’s 80% cut as evidence the world is ready. From that view, the harness matters because the model got cheap, but the model is still what improves next. The structural version of the same argument comes from a16z’s Christian Catalini, who warns that if the labs cannot get hold of the key complementary assets, value will accrue elsewhere.

There is also a demand-side caveat. The adoption gap cuts both ways. It can mean the infrastructure is not ready, or it can mean ordinary users have looked at what agents offer and judged it not worth the setup and verification effort. WIRED’s reader thread leaned that way. Building the stack is necessary. It is not sufficient to make people want to hand an agent their calendar, their inbox, or their money.

My own view is that both things are true and they point the same direction. The model is good enough that the bottleneck has moved, which is why the funding is landing in training environments, orchestration, and tool-use security rather than in yet another frontier model. But “good enough” is the phrase doing the work. The value migrates to the harness precisely because the model alone is no longer the difference, and the businesses that own the harness are the ones with durable economics.

Bottom line

The shift from chatbots to agentic infrastructure is real, uneven, and mostly not about the model. The harness, the software that decides what an agent sees and does, is the actual product, and the companies getting funded right now are the ones building training environments, orchestration layers, and tool-use security around it.

What buyers should internalize is that the new risk surface is the tool, not the answer. Gartner’s 70% figure is a forecast and Check Point’s numbers are a vendor’s own, but both describe the same problem from opposite directions: once an agent can act, it can act against you. Reliability, observability, and the security of tool use are not features you add after the demo works. They are the product, and the organizations that treat them that way are the ones still running agents in 2029.

Sources

  1. Arga is building a better way to train enterprise AI agents — TechCrunch, August 26, 2026
  2. Runable hits $21M to bet AI agents can go from building businesses to growing them — TechCrunch, August 26, 2026
  3. Why Normal People Aren’t Using AI Agents — WIRED
  4. Interview with OpenAI head of product Thibault Sottiaux — TechCrunch, August 25, 2026
  5. The Infrastructure Enterprises Need to Support Agentic AI at Scale — Gartner
  6. Agentic AI use case: Orchestrate access to disparate enterprise systems — Google Cloud
  7. AI Security Threats in 2026: Annual Insights from Check Point Research — Check Point Research
  8. OpenAI is building AI agents for everything. Will everyone use them? — TechCrunch, August 24, 2026
  9. The reinforcement gap, or why some AI skills improve faster than others — TechCrunch, October 5, 2025