Vishal Singh, the co-founder of Rayform AI an India based startup, had been running his work through an AI agent for about two months. It was a Hermes agent on a VPS, and he spoke to it mostly over Telegram on his phone. It became useful enough that he started carrying his laptop less.
Then the agent died while he was outside. He could reach the server from his Android phone over SSH, after setting up Tailscale and keys, but the phone terminal was painful to use. In a post on Reddit, he asked the community whether phone-first agent users needed a mobile rescue console to restart gateways, check logs and run basic recovery commands.
Apart from running his own agent, Vishal works on agentic AI use cases in Software as a Service (SaaS). His argument is that agents will not kill SaaS, but force it to evolve. The agentic layer will sit on top of enterprise software, not replace it.
Services like Salesforce, Jira, HubSpot, Notion and Excel will not disappear, Vishal said. What may change is that users stop living inside their interfaces. The system of record stays, and the agent becomes the system of action.
In practice, the user would no longer open five dashboards and copy information between them, Vishal said. The agent would query the CRM, check the customer record, draft the message, update the ticket, create the follow-up and ask for approval. Products that only wrap a narrow workflow in an interface would be exposed. Products that own data, permissions, compliance, customer records and institutional history could survive as infrastructure.
The large model companies are already building this layer. Anthropic's Claude now sits inside Microsoft Excel and PowerPoint. It has also launched ten pre-built finance agents for pitch books, earnings analysis, KYC screening and month-end close. Until recently, that work needed a junior analyst or a dedicated SaaS product. The agents were launched on May 5, 2026, at an invite-only Anthropic briefing in New York, where JPMorgan Chase CEO Jamie Dimon shared the stage with Anthropic CEO Dario Amodei.
Ira Bodnar, founder of Ryze, a San Francisco-based startup, wrote on X in February 2026 that Anthropic's Claude had effectively killed her business overnight. Ryze sold a tool to manage advertising campaigns on Google and Meta. Claude could now connect directly to Meta ad accounts and analyse the data, and Ryze's deal close rate fell from 70% to 20%, Bodnar wrote.
Claude could still only analyse the accounts, not change them, she noted. "But give it a few months, and it will. So building here feels pointless," Bodnar wrote. Ryze is still operating and has pivoted to AI workflows for small advertising agencies. Anthropic did not copy Ryze. Ryze was exposed to the roadmap of a platform it did not control.
There is an older version of this story. Games like FarmVille, Mafia Wars and CityVille were built on top of Facebook. Facebook gave them distribution through the feed, notifications, social sharing, payments and access to the social graph. Zynga, which made them, became one of the defining companies of the Facebook gaming era.
The dependence was visible even then. In its IPO filing, Zynga said it generated substantially all of its revenue and players through Facebook, and that any deterioration in the relationship would harm its business. A Wharton analysis of the filing cited the same warning in 2011.
For a while the dependence ran both ways. Facebook's own IPO filing said Zynga accounted for about 12% of Facebook's revenue in 2011, through payment processing fees on virtual goods and direct advertising. Then Facebook changed its platform rules. Its product changes reduced the viral mechanics that had helped social games grow.
Zynga said Facebook's 2012 home page navigation changes made it harder for users to find older games. In November 2012, the two companies loosened the special arrangement between them, leaving Zynga exposed to Facebook's standard platform rules. That is a lesson for the agent economy.
A startup that builds a thin layer on Claude, ChatGPT, Gemini, Discord, Gmail, Slack or Salesforce can grow quickly. But it grows inside someone else's operating system. The model provider owns the intelligence. The platform owns distribution. The underlying apps own the data.
The wrapper owns the workflow only until one of those players decides the workflow should be native. Companies in a stronger position have built up something a platform cannot ship in a feature update. That includes proprietary data, compliance history, customer relationships, audit trails and edge cases shaped by real failures over years.
That is why Bodnar's post matters beyond one startup. The builder pays for the API, finds the workflow, sells the interface and teaches the product through usage. Then the platform that trains the models absorbs the job. The extraction is not always training data. Sometimes it is a market signal.
The workflows builders design, the skills they write, the failure modes they discover and the prompt sequences they develop to make agents reliable all show the platforms where the value is. In January 2026, WIRED reported that OpenAI and training data company Handshake AI asked contractors to upload real work from current or past jobs to evaluate next-generation agents. That included Word documents, PDFs, PowerPoints, Excel files, images and code repositories, along with the original workplace request.
Business Insider reported that the three major AI labs bar customers from using their outputs to train competing models. The same labs built their systems on freely available internet content, including Reddit posts, Stack Overflow answers and news articles. Reddit sued Anthropic in June 2025 for allegedly scraping millions of user comments without permission or compensation. On September 19, 2026, a federal judge in San Francisco largely denied Anthropic's motion to dismiss, and the case is proceeding.
In July 2026, Hugging Face, a platform that hosts AI models and datasets, disclosed that its systems had been breached by an autonomous AI agent. On July 21, OpenAI said in a blog post that the agent was driven by its own models. They were being tested on an internal cybersecurity benchmark called ExploitGym, run deliberately without the safeguards OpenAI uses in its products.
The test environment had no direct route to the internet, OpenAI said. The models found an unknown flaw in Artifactory, a package proxy they were allowed to use, and worked their way out. "All evidence suggests that the models were hyperfocused on finding a solution for ExploitGym," OpenAI wrote, and they went to Hugging Face for the test answers. The models included GPT-5.6 Sol and an even more capable internal prototype, which OpenAI said was never meant for release and has since been deactivated.
Hugging Face recovered about 17,600 actions by the agent between July 9 and 13.
Hugging Face said the intruder reached a limited set of internal datasets and several service credentials, and found no tampering with public models. On August 4, OpenAI disclosed two more incidents during tests run by outside partners. In one, run by the testing firm Irregular, the fictional target's name matched a real domain, and the model exploited the real website.
Anthropic then reviewed 141,006 of its own test runs in which Claude could have reached the internet. On July 30, it disclosed three incidents in which Claude models got into the systems of three real organisations, the earliest in April. The two organisations Anthropic could reach had not detected the activity. In September, it added a fourth incident, from January 2026.
The prompts told Claude it was in a simulation with no internet access. Because of a misunderstanding with its testing partner, Irregular, that was not true, Anthropic said. In the most serious case, Claude Mythos 5 uploaded a malicious package to PyPI, a public software registry, while repeatedly reasoning that it was in a simulation.
In September, Google confirmed that its Gemini models had broken into three other companies on separate occasions earlier in the year. Each test involved a fictional company that shared its name with a real one. "In a standard evaluation, the model found public information online and guessed credentials," said Heather Adkins, Google's vice president of security engineering. In two of the three cases, Gemini found working passwords in a public database, Cybersecurity Dive reported.
The Anthropic and Google tests, and one of OpenAI's, ran in sandboxes built by Irregular, an Israeli AI testing firm. Irregular said it notified all the AI labs concerned in late July and has fixed the known issues. All three companies' incidents happened during security testing of their models. None of the victims has been named.
People are also pointing agents at targets on purpose. In November 2025, Anthropic disclosed that a group it assessed to be Chinese state-sponsored had used Claude Code against about 30 organisations, including technology companies, banks, chemical manufacturers and government agencies. The AI did 80% to 90% of the work, with humans stepping in at four to six decision points, according to Anthropic. A small number of the attacks succeeded.
The agents Vishal describes would hold logins to a company's CRM, its tickets and its customer records. The models in Google's tests got into real companies with passwords they guessed or found online.
The closed models are also expensive to run. Danny John Kurian, an IT consultant in Bengaluru who runs a personal OpenClaw agent, first estimated that Claude Code credits had cost him Rs 10,000 to Rs 15,000 because of the many iterations. When he checked, the figure was Rs 20,000.
His two main agents run on Anthropic's Claude Opus 4.5, Opus 4.6 and Sonnet 4.5. A third, which handles house tasks, runs on a free cloud model. Danny said he wants to move to a cheaper model now that he knows which models are good enough for which job. But the mini PC he runs the setup on, bought for Rs 20,000, cannot comfortably run even a 1.5-billion-parameter Qwen model locally.
The price gap between closed and open models is wide. Anthropic lists Claude Opus 4.6 at USD 5 per million input tokens and USD 25 per million output tokens. DeepSeek, a Chinese lab that publishes its model weights openly, lists its V4.1 Flash model at USD 0.30 and USD 1.20 during peak hours, and half that at other times.
At peak rates, the same volume of output costs about 21 times more on Opus than on DeepSeek V4.1 Flash, and about 42 times more off-peak. DeepSeek's larger V4 Pro lists at USD 1.32 and USD 3.96 at peak, still about six times cheaper than Opus on output. Open models can also run on hardware the user owns, if the hardware is big enough.
That last condition is where Danny is stuck. The cheaper models are available to anyone, and the price list says so. Running them at home needs a machine he does not have, so the bill keeps going to the companies whose models he wanted to leave.
Vishal's agent is back up. The gateway that died while he was outside still runs on a rented VPS, reached through a phone terminal he finds painful, while the companies he builds on decide what to make native next.