AI agents take charge: new tech and guardrails for enterprises.

A quiet battle is unfolding over who will control the building blocks of agentic AI. Yesterday, Anthropic – one of the leading AI model providers – made a strategic move that sent a clear message. It bought a startup called Stainless, which provided a clever way for developers to generate and update software development kits (SDKs) for AI models automatically ([1]). Engineers at OpenAI, Google, and even Cloudflare had been using Stainless to simplify their AI integrations ([2]). By snapping it up (for a reported $300 million ([3])) and planning to cut off its services to competitors ([4]), Anthropic is effectively pulling up the ladder behind itself.

This acquisition highlights an emerging trend: major AI players are racing to build end-to-end ecosystems for enterprise AI agents. They’re not just offering powerful models; they want to own the whole stack – from custom silicon to developer tools to managed platforms. OpenAI, for instance, has been rolling out its own suites for enterprise AI agents, aiming to bind customers to its ecosystem. Now Anthropic is countering by locking down a piece of the “plumbing” that every AI application relies on. For enterprise leaders, this intensifying competition could lead to a more fragmented landscape, where interoperability becomes a challenge and vendor lock-in risks grow.

At the same time, new solutions are appearing to keep the ecosystem flexible. On one front, startups like WaveSpeed are tackling the complexity head-on by offering unified interfaces to many AI models: instead of getting tied to a single vendor, companies can use one API to tap into a whole library of models from different providers and even different modalities (text, image, audio) ([5]) ([6]). And beyond the commercial offerings, the open-source community is busy developing standards to ensure AI agents remain portable and extensible – for example, an emerging secure registry of vetted agent 'skills' for coding assistants aims to prevent unsafe plug-ins ([7]). The upshot: CIOs and tech strategists should decide whether to embrace a single vendor’s all-in-one agent ecosystem or adopt a more open, multi-model approach. The former can offer tight integration but at the cost of dependency, while the latter preserves flexibility and leverage at the expense of some extra complexity.

Perhaps the most convincing evidence that AI agents have matured is the real-world impact they’re already delivering. Adoption is now widespread – one survey found 96% of enterprises are using AI agents in some capacity ([1]) – and about 80% of organizations say these projects are yielding measurable returns on investment ([2]). In other words, autonomous agents are no longer just science experiments; they are starting to pay off in practice. The improvements can be dramatic: a major manufacturer, for instance, reduced a critical production optimization from six weeks to one day by letting an AI agent handle it ([3]). And a large energy company reported a 5% increase in output (worth over $1 billion annually) thanks to agent-driven adjustments in its operations ([4]).

In healthcare, AI agents are tackling stubborn operational bottlenecks. One hospital recently introduced a “virtual dispatch” agent to fill last-minute nursing shift vacancies via automated SMS outreach. The result: the agent finds a replacement in under five minutes — a task that previously took managers up to five hours of calls and messages ([5]). That speed translated into a 25% reduction in overtime costs at the hospital, relieving staffing pressure and burnout at a time of chronic nurse shortages ([6]). It’s a clear example of how agent automation can solve problems that humans used to just work around.

Even knowledge and creative work is being transformed. In marketing, for example, Skai’s newly launched platform lets swarms of AI agents run digital ad campaigns with minimal human intervention ([7]). These agent squads continuously monitor campaign metrics across channels, diagnosing issues and tweaking budgets in real time to hit performance targets ([8]). Human marketers still set the strategy and creative direction, but much of the tedious day-to-day optimization — tasks that once consumed countless hours — can now happen autonomously at machine speed. The early results are promising: faster campaign adjustments, more agility in responding to market changes, and marketers freed to focus on strategy and creative ideas ([9]). Similar experiments are underway in customer service, finance, and other fields as companies test how far they can safely hand off routine workflows to AI.

As businesses deploy more autonomous agents, a new challenge is coming into focus: how to govern these AI co-workers so they remain reliable and safe. This week, the U.S. National Institute of Standards and Technology (NIST) released a report synthesizing industry feedback on AI agent security ([1]). The consensus is sobering. Nearly all respondents agreed that AI agents introduce unique security threats, from the potential for an agent’s broad permissions to be misused by malicious insiders to the possibility of automated systems making mistakes at a scale and speed humans never could. NIST’s analysis concludes that while traditional cybersecurity principles (access controls, identity management, monitoring, etc.) remain crucial, they will require adaptation to address this new class of risk ([2]).

The governance gap is becoming impossible to ignore. Adoption of agentic AI is far outpacing the guardrails: according to one survey, 94% of organizations are worried that AI “sprawl” is increasing faster than they can manage it, adding complexity, technical debt and risk to the business ([3]). We’ve already seen hints of the dangers. In a joint advisory, intelligence agencies from the US, UK, Canada, Australia and New Zealand (the “Five Eyes” alliance) recently warned that rushing out agentic AI without proper controls will likely result in serious incidents. They gave examples like an AI agent asked to install software patches that, due to an overly broad mandate, also wipes critical security logs, blinding IT to an intrusion ([4]). Without strict policies and oversight, autonomous systems can amplify vulnerabilities or create new ones.

For senior leaders, the mandate is clear: treat AI agents as both a strategic asset and a potential liability. Just as companies enforce controls around human employees or outsourcing partners, they need equally robust frameworks for AI agents. That means maintaining an inventory of every deployed agent and its role, limiting each agent’s access permissions to the minimum necessary, monitoring agent decisions and actions in real time, and having emergency off switches and incident response plans in place for when things go wrong ([5]). Regulators and standards bodies are beginning to weigh in – and early guidance is likely to mirror these best practices. Ensuring strong governance isn’t a brake on innovation; it’s what will enable organizations to scale up the use of autonomous workflows with confidence.