The Product Desk

The Reliability Thesis Is Dead

A team lead opens the roadmap doc and writes "wait for next model release" next to the agent reliability epic. Princeton's updated ICML 2026 paper tested GPT 5.5, Gemini 3.1 Pro, Gemini 3.5 Flash, and Claude Opus 4.7 against their predecessors on agent tasks and concluded they are "not meaningfully more reliable than previous models" on tool-call reliability under realistic distributions of user input. That sentence retires the most common assumption in agent roadmaps. Reliability is not a dependency on someone else's release notes.

GitHub logged 17 million agent-generated PRs in March 2026, roughly 3x their projected growth. Volume is climbing. Per-task reliability is flat. The gap between those two curves is where users decide your product is unreliable and stop opening it.

Two years of model upgrades say the first axis has not moved the way the roadmap assumed. The second axis — tooling, retries, verifiers, structured interfaces — is where the wins have come from.

What Works: The Tooling-First Architecture

Hugging Face CEO Clement Delangue gave the alternative a number: purpose-built CLI tools achieve 6x token efficiency over raw API agents, with higher success rates. "Good tools are cached intelligence for agents" is the architectural framing. Encode domain logic, validation, and workflow shape into the tool interface. The agent stops having to reason its way to the answer because the tool already shaped the answer space.

Anthropic's Claude Code shipped the graduated autonomy pattern that handles the UX layer: 7 permission modes from fully manual ('plan') to nearly autonomous ('bypassPermissions'), with an ML classifier deciding when to interrupt the user. A model trained on when to ask permission is what every agent product converges on once the support tickets pile up.

The New Benchmarks Define Your Scope

Two benchmarks set the floor and the ceiling. ALE (Agents' Last Exam) maps 1,000+ tasks to U.S. occupational taxonomy; its hardest tier passes 2.6% of the time. SWE-Marathon tests coding agents over 1B-token budgets and coherence collapses well before the budget runs out. Pitch decks call this the path to autonomous experts. The data calls it medium-complexity tasks with verifiable success criteria, shipped this year, with the autonomous expert pushed out multiple years.

The Cost Management Layer Ships Now

Cloudflare shipped AI Gateway spend limits with per-model and per-user budget enforcement and automatic fallback to cheaper models. GitHub shipped Chronicle for session-level agent analytics. Usage-based pricing only works when three things exist underneath: a cheaper model for routine tasks, semantic routing, and cost-per-session visibility. Ship the meter before the billing page.

Meta Proved the Attack. OpenAI Proved There's No Fix.

A researcher asked Meta's AI chatbot to change the email on a high-profile Instagram account. It did. Meta's AI chatbot was socially engineered to hijack high-profile Instagram accounts by conversation alone. No exploit, no credential stuffing, just an agent handed authority without an authorization boundary anyone bothered to draw. The same week, OpenAI shipped Lockdown Mode, which disables Deep Research, Agent Mode, internet image display, and file downloads. The pitch is "hardened mode for sensitive use." What it actually does is turn off the agentic surface area. That is a useful feature. It is also an admission.

The industry's current answer to prompt injection is 'turn off the features.' If you're shipping agent capabilities without a Lockdown Mode equivalent, you're shipping the thing OpenAI just admitted they can't defend.

Microsoft's Taxonomy Is Your New Acceptance Criteria

Microsoft published 7 new AI agent failure modes. Read the framing carefully: it is positioned to facilitate discussion of fixes, which is also how you pre-position for enterprise procurement. Security teams will paste this taxonomy into vendor questionnaires inside 60 days. PMs who write acceptance criteria against the seven modes now will answer those questionnaires in an afternoon. PMs who don't will spend a quarter retrofitting evidence.

The AI Toolchain Itself Is Compromised

Three concurrent attacks on the development pipeline:

• Self-replicating npm worms (Miasma, IronWorm) poisoned 50+ packages and 73 Microsoft GitHub repos, campaign ongoing
• Hugging Face Transformers RCE exploitable via model config files, affecting 2.2 billion installs targeting GPU-accelerated inference
• Claude Code's MCP vulnerability actively exploited against developers who trust the protocol

The pattern is consistent. Every new AI protocol — MCP, function calling, tool-use APIs — is being adopted faster than it is being secured. The forcing function for vendor selection is a security gate specifically for AI tool protocols, separate from your existing supply-chain checklist. The existing checklist did not catch any of the three above.

AI-Discovered Vulnerabilities Change the Math

An AI agent autonomously found 21 zero-day vulnerabilities in FFmpeg, a library previously audited by Google's OSS-Fuzz and multiple security firms and embedded in virtually every product that processes video. There is a version of this where the agent got lucky on one codebase. That version does not survive the second team pointing the same tooling at the next library. Your vulnerability management capacity needs to 3-5x in the next 12 months or you'll drown in patch backlog.

The Numbers That Break the 'Compute Gets Cheaper' Assumption

Three data points point the same direction:

That is over $2 billion per month in new compute commitments across three companies. Meta is putting up literal tents in Ohio and Tennessee because traditional data centers take 2-3 years to stand up. When the answer to a supply problem is billion-dollar monthly invoices and tent-based infrastructure, demand is not behaving like a curve that bends down.

The thing being pitched is 'compute is getting cheaper.' The thing actually happening is that frontier capacity is pre-sold years out at prices that hold the floor up. Both are true, for different tiers. The features a roadmap depends on tend to sit on the tier that is not moving.

What This Means for Your Unit Economics

Separate the two cost curves before doing any planning. Older model tiers (GPT-4 class, Gemini 1.5) do get cheaper per token. Frontier inference, which is what differentiating features tend to need, sits on capacity locked into multi-year contracts. A 2027 roadmap that assumes Moore's Law applies at the frontier should be stress-tested against a flat or rising scenario before it leaves the planning doc.

The open-weight counter-signal is real, but bounded. Gemma 4 QAT runs in ~1GB, Ideogram 4.0 nf4 fits on a 24GB consumer GPU, and Kimi K2.5 and GLM-5 show "impressive agentic performance" against closed models. For features where open-weight reaches 80% of frontier quality, self-hosting economics are now compelling. For features that require frontier reasoning, the cost floor just got named: $2B/month in GPU contracts running through 2029.

The Pricing Architecture Decision

GitHub's sequencing is instructive. They shipped usage-based billing, semantic routing to smaller models, and Chronicle for cost visibility before flipping the pricing switch. The 2x2 for any feature: one axis is paid directly by the user versus absorbed into flat subscription. The other axis is used once a week versus fifty times a day. The dangerous cell is flat-subscription plus high-frequency. A 15% inference price move eats the margin and there is no contract mechanism to recover it.

Open-weight models eliminate the cost problem for many use cases. They do not eliminate it for the use cases that define a product's ceiling.