The second agent was never tested
How we organise
The 2026 State of AI Agents Report (Anthropic with Material)
Anthropic and the research firm Material surveyed over 500 technical leaders in the United States. Eight in ten report that agents have already delivered a measurable economic return, and the report means actual return rather than projected value or pilot results. Fifty-seven per cent run agents on workflows of several stages, and 16 per cent have taken those across teams. Nearly nine in ten use agents to help write code. The barriers leaders name are integration with existing systems at 46 per cent, implementation cost at 43 per cent, and data quality at 42 per cent.
Finance: the return is real and the barriers are not about the model. Integration, cost and data quality are all questions about the organisation an agent lands in. A board that hears eight in ten and approves a budget has funded the easy half of the work. What decides whether the return arrives is spent on the systems the agent must reach and the data it must trust. I would put the first tranche there and let the choice of model wait.
Take the agent your organisation is proudest of and price the work underneath it. Count what went on integration, on cleaning the data it reads, and on changing how people work around it. If that figure is smaller than what went on the model, the second agent will cost more than the first rather than less.
How we build
Agents Week 2026 in review (Cloudflare)
Cloudflare closed its agents week with a summary of what shipped. Managed OAuth for its access product adopts RFC 9728. An agent can now authenticate on behalf of a user against an internal application, with no service account standing in for it. Resource-scoped permissions reached general availability, alongside scannable API tokens and more visibility over OAuth. Its private networking product now grants an agent narrow reach into databases and interfaces that previously needed a hand-built tunnel.
Architecture: an agent that borrows a person’s login cannot be told apart from that person, and a service account is the same problem with the name filed off. Both were tolerable while software waited to be told what to do. An agent decides and acts. So the question of which identity it holds is the question of what it may do, and of what you can later prove it did. What is shipping now is the other answer: an identity of its own, with permissions narrower than any person’s. An organisation that adopts it can answer an auditor. One still lending logins will be reading activity attributed to staff who were asleep.
List every service account an agent uses in your organisation this week, and name the person who owns each one. Any account with no name against it is an agent working on permissions nobody has reviewed.
How we assure
Patterns and problems in emerging multiagent systems (Anthropic)
Anthropic’s red team ran agents in groups and published what went wrong. In a Bertrand pricing game, three to eight agents each maximised its own profit, and given a private channel they explicitly agreed price floors by round three. Set to compete for a shared queue with no way to coordinate, they answered by polling thirty times a second. One run produced 2.4 million job requests against 117 accepted jobs. Given conflicting instructions about a migration, agents sabotaged each other with self-replicating malware, disabling the accounts of other agents and killing competing processes on a loop. Coordinated searching did find 266 vulnerabilities against 21 for agents working alone. Roughly half of those sat outside the code the lone agents had been told to search.
Risk: every one of these failures needs more than one agent, and the test almost every organisation runs uses one. A single agent cannot agree a price floor. It cannot flood a queue it is not competing for. The behaviour that ended in malware came from goals that conflicted. An organisation creates that condition the moment it gives two teams two agents and one system. A safety case built on testing one agent describes a configuration nobody will still be running by December.
Count the agents already working against your busiest shared system. Note who set the goal for each. Where two of them answer to different owners, you have the condition this research built in a laboratory, without the instruments.