AV
Artificial Intelligence

AI Agents Are Now Infrastructure: What Building With Them Actually Looks Like in 2026

By Anurag Verma•June 3, 2026
AI Agents Are Now Infrastructure: What Building With Them Actually Looks Like in 2026

AI Agents Are Now Infrastructure: What Building With Them Actually Looks Like in 2026

The moment that crystallized the shift for me was reading Salesforce's Q4 FY2026 earnings call in February. Agentforce hit $800 million in ARR, up 169% year-over-year, and the company's exec team kept using a phrase that would have sounded like marketing fluff eighteen months ago: "agentic work units." They had logged 2.4 billion of them. These are not chat completions. These are completed tasks: a support case resolved without a human, a sales record updated after a phone call, an onboarding workflow kicked off without a ticket. At that point, the debate about whether AI agents matter in the enterprise is over.

What is not over is figuring out how to build and run them responsibly.

Where the Market Actually Stands

The global AI agents market sits at roughly $10.9 billion in 2026, up from $7.6 billion in 2025, growing at a 44% CAGR. Those numbers matter less to me than the adoption rate underneath them: 40% of enterprise applications now include agentic capabilities, compared to under 5% just a year ago. Something crossed a threshold.

The infrastructure story is even more telling. Anthropic's Model Context Protocol, which launched in late 2024, now sees 97 million monthly SDK downloads and has more than 10,000 active production servers. In December 2025, Google adopted MCP across its own services. By April 2026, Fortune 500 companies were running it in production. Sixteen months from research project to enterprise plumbing. That is fast.

The Linux Foundation formalized this in late 2025 with the Agentic AI Foundation (AAIF), anchoring MCP, OpenAI's AGENTS.md, and Block's goose under a single governance umbrella. Platinum members include Amazon, Anthropic, Google, Microsoft, and OpenAI. When your fiercest competitors co-fund the same standards body, the protocol layer is settled.

Where Coding Agents Fit

Software engineering ate roughly half of early agentic deployments, and I understand why. The feedback loop is tight and measurable. Cursor reportedly crossed $1 billion in ARR and reached a $29.3 billion valuation in the past year, growing from $100 million in ARR in just twelve months. GitHub Copilot, Claude Code, Windsurf and Devin are all competing in a market that did not exist in its current form two years ago.

The architecture shift is the part worth paying attention to. These tools are no longer autocomplete wrappers. They maintain state across a codebase session, open pull requests, run tests, read error output, and try again. OpenAI's Operator is scoring 87% on complex browser task benchmarks. AGENTS.md, released in August 2025, has already been adopted by more than 60,000 open-source repositories as a standard way to describe repo context for agents. The coding surface is the most mature proving ground we have right now.

I use Claude Code daily on the blog's Next.js codebase and the productivity difference is genuine, not hype. But I also know exactly what it cannot do: hold consistent intent across multiple tool calls when something goes sideways, or reason about side effects two steps out. That gap is the actual engineering problem.

The Part Nobody Talks About Enough

Here is the uncomfortable stat: only 11 to 14% of enterprise AI agent pilots reached production at scale as of March 2026. The failure mode is almost never the model. It is the orchestration layer. Context inconsistency at handoff points, agents entering feedback loops that drain API budgets in minutes, coordination errors that cascade into system-wide failures. Production multi-agent systems see 5 to 15% individual agent failure rates, and without proper circuit-breaking, one failure propagates.

Security is the other unresolved problem. Prompt injection attacks surged 340% year-over-year and remain the top category of agentic AI security failure in 2026, per OWASP's LLM Security Report. The indirect variety is particularly nasty: a malicious instruction hidden in a document the agent reads, triggering real-world actions (database queries, API calls, file writes) that operators never see coming. Microsoft, Google, and GitHub have all had production systems exploited this way. Twenty-nine percent of organizations planning agentic deployments say they are prepared to secure them. The other seventy-one percent are deploying anyway.

Eighty percent of organizations deploying agents have no mature governance model to manage them at scale. That number needs to come down faster than the adoption rate is going up.

What Good Architecture Looks Like Now

The teams I respect are not building monolithic agents. They are building networks of narrow, auditable agents with explicit handoff contracts, deterministic fallback paths, and human-in-the-loop checkpoints at every consequential action. The 2026 MCP roadmap addresses the stateful session problem, enterprise authentication gaps, and governance tooling that production deployments exposed. These are solved engineering problems once you commit to solving them.

The agent-to-agent (A2A) protocol, which Google highlighted at Cloud Next 2026, is the next piece. Agents need to discover, authenticate with, and delegate to other agents without a human in the middle. That plumbing is being built right now.

My own approach on projects: treat the agent's action surface like a security boundary, not a feature list. Every tool the agent can call is a potential blast radius. Instrument everything. Set explicit budget caps per run. Build evals before you build features.

The Bigger Picture

The framing of "AI agents as the new operating system" was directionally right but premature in 2025. What is truer in mid-2026 is that agents are becoming infrastructure in the same way databases and message queues became infrastructure: quietly, with a lot of early-stage pain, and then suddenly everywhere. The International AI Safety Report 2026 flags coordination failures at scale as the primary systemic risk, not individual model capability.

The builders who will do well here are the ones treating agent reliability, observability, and security as first-class engineering disciplines, not afterthoughts. The ones who think orchestration is someone else's problem are going to have a bad time in production.

Sources