The Product Desk

The Infrastructure Layer Is No Longer Yours to Build

Anthropic's Claude Managed Agents, now in public beta, offers containerized execution, checkpointing, scoped permissions, automatic error recovery, and persistent stateful sessions — the exact capability list that most teams have been custom-building for the past 18 months. The research preview of sub-agent spawning (where one agent delegates subtasks to others) goes further than most internal implementations. Rakuten deployed agents across 5 departments in roughly one week each. Notion is already shipping a "delegate tasks to Claude" feature. Asana and Sentry are live.

The consumption-based pricing model — $0.08/hr per session, no platform fees — makes the math brutally simple. A continuously running agent costs ~$700/year. Compare that to the loaded cost of engineering months to build equivalent orchestration. Your engineering team will resist this — they want to build the cool infrastructure. Your job is to redirect that energy toward differentiated product logic that runs on top of managed infrastructure.

The agent orchestration layer is commoditizing. Your moat is the domain-specific workflow that sits on top of it.

Perplexity Validates the Revenue Model

Perplexity's ARR more than doubled to ~$500M in roughly one quarter, driven specifically by its agent-based "Computer" product. The monetization insight: they bundled agent credits into existing subscription tiers, creating a consumption flywheel inside recurring revenue. Combined with Anthropic's $0.08/hr, the pricing convergence is unmistakable — the industry is moving to value-per-action pricing, not per-seat licensing. If your AI features run on flat per-seat pricing, you're simultaneously under-monetizing power users and creating barriers for casual adopters.

The Lock-In Risk Is Real

Anthropic's architecture deliberately decouples agent interfaces from underlying model implementations, designed so harnesses can be updated as models improve. That's good for iteration, but it means your agent state lives in Anthropic's infrastructure. Checkpointing and persistent sessions create substantial switching costs. Notion has the leverage to negotiate favorable terms; your startup may not. The pragmatic move: adopt Managed Agents for non-core agent workflows where speed matters, but maintain an abstraction layer for your highest-value differentiating agent features.

Architecture Decision: What to Build vs. What to Buy

Walmart's 66% Conversion Collapse Is a Category Error, Not a UX Bug

Walmart embedded checkout into conversational AI interfaces for agentic commerce and watched conversions drop 66%. This isn't an optimization problem — it's a fundamental design mistake. Human checkout flows (cart → review → payment → confirmation) exist because humans need visual confirmation at each step. AI agents don't. The emerging pattern is "invisible payments" triggered by real-world events where agents autonomously execute transactions without user interaction.

But this requires entirely new infrastructure: machine-native payment protocols, agent identity and authorization systems, and granular spending controls. If your product roadmap includes any form of AI-assisted transactions, the Walmart data tells you to throw out your current wireframes. The question isn't "how do we make checkout conversational?" — it's "how do we make checkout invisible while keeping users in control?"

Agentic commerce doesn't need better chat UX. It needs payment rails built for machines, not humans.

ServiceNow Just Showed You the Toll Gate Model

ServiceNow's Context Engine, launched April 9, is the first concrete implementation of a monetization model every major SaaS platform will eventually adopt. The mechanics: aggregate customer data from across ServiceNow's apps into a single, real-time, AI-agent-friendly interface — and charge for outside agent access. Direct API connections remain free but are deliberately "harder for AI agents to handle." This is a classic value-based pricing squeeze.

The ecosystem is splitting into camps:

• ServiceNow: Monetize agent access (paid Context Engine)
• Atlassian: Restrict agent access (rate-limiting outside data pulls)
• AWS: CEO Matt Garman publicly warned that restriction is a "losing strategy"

For PMs building agent-powered products, this means your integration cost model needs a new line item — and ServiceNow hasn't even set pricing yet, so you're building features with an unknown COGS component.

The In-Platform Commerce Trust Gap Compounds the Problem

A study of digitally fluent shoppers reveals 81% awareness of in-platform shopping on Google, ChatGPT, and social media, but only 27% have completed a purchase. The sharpest resistance comes from tech-savvy users suspicious of monetized recommendation systems — inverting the typical adoption curve. However, a single completed purchase dramatically shifts attitudes, making the first-transaction experience the critical design challenge. AI referral traffic converts 11.5% worse than organic search but performs 4.6x better for complex, research-heavy products.

The Scope Is Alarming

A single week's vulnerability bulletin contains critical CVEs across the most widely used AI development tools:

The Claude Code CLI vulnerability is especially instructive for PMs shipping agentic features: the command injection is in the authentication helper — the part handling credentials. As agents gain autonomy, the auth surface area expands dramatically. SANS confirmed that for the first time in RSAC keynote history, all five most dangerous new attack techniques carry an AI dimension.

The AI tools accelerating your roadmap are simultaneously the least-audited dependencies in your stack.

Security Scanners Are Now Attack Vectors

Aqua Security's Trivy — a security scanner trusted by thousands of organizations — was weaponized to breach the European Commission's AWS environment. The attack chain: stolen API keys from a compromised Trivy instance (March 19) gave attackers AWS access. Five days before detection. Nine days until ShinyHunters published 340 GB of data — including 52,000 email files across 71 entities (42 EC departments + 29 EU entities). Mandiant puts the broader campaign at 1,000+ SaaS environments compromised.

For PMs: "we use industry-standard security scanning" is no longer a sufficient answer to customer security questionnaires. You need to articulate how your supply chain is verified, not just that it's scanned.

Nation-State Actors in Your npm Dependencies

The DPRK was attributed to the axios npm package compromise, which cascaded to Bruno IDE users during a 3-hour window on March 31. The credential-to-data-leak pipeline operated in under 10 days. Additionally, several low-code/no-code platforms used by product teams for internal tooling have critical RCE vulnerabilities: NocoBase (9.9), Budibase (9.0–9.6), Kestra (9.9), Windmill (9.9).

Anthropic Is Building HR Software — While Still a Workday Customer

Anthropic hired Peter Bailis, Workday's CTO (who lasted less than a year at Workday), and is simultaneously posting for an engineering manager to build "people products" covering hiring, training, employee development, and promotions. Anthropic was listed as a Workday customer as recently as February 2026. Connect the dots: an AI company decides it can build its own enterprise tools better than the incumbent, starting with its own internal use case.

This is the classic innovator's dilemma playing out in real-time. If this pattern extends — and it will, since why wouldn't OpenAI, Google DeepMind, or Meta build their own HR/finance/ops tools powered by their own models? — every enterprise SaaS company faces a new competitive threat from its most technically sophisticated customers.

Your most dangerous competitor isn't the startup in your category — it's the AI company that decides your software isn't good enough for their own team.

Canva Is Running the Platform Expansion Playbook

Canva's simultaneous acquisition of Simtheory (agentic AI workspace) and Ortto (customer data + marketing automation) is a declaration of war on the marketing tech stack. The pattern: massive horizontal user base (design) → layer on data and execution → campaign orchestration platform. This directly targets HubSpot and Salesforce's SMB/mid-market territory by bundling AI agents, customer data, and campaign execution into a single system. Canva starts with a self-serve, bottom-up adoption engine that HubSpot would kill for.

The Data Says Vertical AI Is Where Moats Form

Vertical AI captured 53% of VC deal volume in 2025, with 60% of earliest-stage startups being vertical AI companies. Healthcare and Financial Services dominate, with Manufacturing, Legal, and AEC as breakout categories. The winning architecture pattern: an orchestration "harness" that structures tasks, manages memory, routes across multiple models, and minimizes tokens per outcome. These harnesses create proprietary workflow knowledge from execution data — knowledge that model providers can't replicate because they lack domain-specific feedback loops.

The concrete benchmarks tell the story: Cursor hit $2B ARR as a single-vertical AI coding agent. Perplexity hit ~$500M pivoting from search to agentic tasks. Databricks sits at $5.4B ARR and $134B valuation. Foundation model providers capture the largest share, but vertical agents capture disproportionate willingness-to-pay relative to their size. The question for your product: are you building the orchestration harness for your domain, or are you just wrapping an API?