Three vendors shipped structurally identical agent runtimes inside a 48-hour window last month. One is a hyperscaler. One is a managed database-as-a-service. One is an open-source database vendor. Each published the same six primitives — shell access, file operations, web tools, long-term memory, context-window management, subtask delegation. Each cited a cost reduction against the same unnamed competitor. None of them published a reproducible benchmark.
That final sentence is the only one that survives contact with an auditor. Code doesn't lie; audits do. When three independent engineering teams converge on the same abstraction inside the same week, the explanation is not coincidence and it is not genius. It is convergence on a local optimum — and local optima are, by definition, commodities. What these vendors shipped is not an architecture. It is a configuration file with a marketing budget.
For the record, none of the three products contains a single Web3 component. This is conventional AI infrastructure, and I do not write about it often. But the pattern is not new to anyone who watched EVM tooling consolidate between 2016 and 2020. The agent stack is running the same playbook, three years late and with better copywriting.
The abstraction all three converged on has been stable since 2023. It reads, in one line:
Agent Loop = model call + tool routing + context budget management + state persistence
The ReAct paper established the loop. MCP supplied the interface standard. What remained was the harness — the opinionated shell wrapped around the loop that decides how many tokens to spend, when to truncate a tool result, when to compact context, and when to hand work to a subprocess.
The harness is where the three products claim to differentiate, and it is where the only technically interesting disclosure lives. Tool results are truncated above roughly 1,500 tokens. Context compaction fires at 85 percent utilization. Those two numbers tell you what the harness actually is: a heuristic threshold system. Not a learned policy, not a fine-tuned model — a set of conditionals. Conditionals with published parameters cannot form a moat. Publish the thresholds and any competent team reproduces the runtime in a quarter.
MCP is the interface layer that made the convergence possible. Standardize the tool schema and the harness becomes the only remaining variable. A variable reproducible from a public config is not a business; it is a prerequisite.
This is a market brief, so I will state the trade plainly: the launch window is the signal, and the signal is that the middle layer has been marked down. In the sideways tape we have been stuck in for months — capital parked, no directional conviction, every desk hunting for a signal — the relevant data point is never the headline product. It is where the margin settles after the launch window closes. Trust is a bug, not a feature, and the trust here is placed in thresholds any competitor can copy before lunch.
The empirical claims are the part worth stress-testing, because they are the part being sold.
Vendor one reported a 28 percent token cost reduction. Vendor two reported 73 percent. Vendor three reported 77 percent against a named competitor, on the same underlying models, with a higher score on a terminal-execution benchmark. Every one of those numbers is self-reported. No independent party has reproduced them. No task set, no round budget, no cost-attribution methodology has been published alongside them.
In 2022, when I dissected the fraud-proof mechanics of Optimistic Rollups, I built the same kind of table. The critical variable was never the headline number. It was what the number was measured against. A 30-day challenge window reads as robust until you model the bond requirements and discover that censorship is profitable at the margin. A 77 percent cost reduction reads as decisive until you ask where the 77 percent actually comes from.
There are exactly three possible sources for a harness-level efficiency delta when the underlying model is held fixed.
- Fewer iterations. The harness terminates sooner and selects the correct tool on the first attempt.
- More aggressive context compression. Truncation and compaction fire earlier and harder, discarding history the model would otherwise retain.
- Cache reuse. Prefix caching and KV reuse at the inference layer absorb repeated context.
Only the first is genuine harness engineering. The second trades long-horizon consistency for short-task benchmark scores — and terminal benchmarks are short-horizon by construction, so they cannot detect the loss they are rewarding. The third is a property of the inference provider, not the harness at all. A 77 percent savings that lives in the cache is not a harness advantage; it is a repackaged platform feature wearing someone else's logo.
I have watched this exact attribution failure before. In 2020, my team verified 500,000 constraint gates in a Groth16 proof system for a privacy-focused lender. The circuit looked correct at the API level. The defect was a public-input encoding mismatch — an arithmetic circuit that satisfied every constraint while proving the wrong statement. The lesson generalizes: when a system advertises a performance property, open the circuit and locate where the property originates. A benchmark score is a public input. It proves nothing until you verify the encoding behind it.
The commodity test is narrower than the marketing. A technology is a commodity when three conditions hold simultaneously: the interface is standardized, the implementation is replaceable, and performance differences fall inside a 2× band. MCP standardized the interface. The six-primitive feature list standardized the implementation surface. The 28–77 percent spread looks wide on paper, but it collapses once you subtract the cache contribution, which is not harness-specific and not controllable by the harness author.
Three conditions. All three satisfied. Zero knowledge, maximum proof — and the proof here is that the middle layer has no proof of its own.
One more layer deserves attention, because the harness vendors omitted it. If a commodity harness is cheap to run, the constraint on agent deployment stops being software and becomes execution capacity. Every shell call needs an isolated environment — a container or micro-VM — with cold-start latency measured in fractions of a second and a lifetime measured in minutes. That is a different resource profile from training and different again from batch inference. It is bursty, long-lived on the connection, and sensitive to startup cost.
In the gas-cost-versus-security whitepaper I wrote in 2022, the finding institutional analysts kept quoting was not about the dispute game's elegance. It was about the bond. An insufficient bond turns a security guarantee into a censorship vector. The sandbox has an analogous parameter: the cost and latency of isolation. Set it too high and agents become uneconomical; set it too low and one tenant's shell command leaks into another's filesystem. No vendor in this launch disclosed that parameter. Not one published a per-session isolation cost, a concurrency ceiling, or a cold-start figure.
That omission matters because it is the only part of the stack with a real engineering moat. Sandbox vendors — the micro-VM and edge-compute shops the launch posts named only as deployment targets — are the ones actually absorbing the deterministic demand. The harness is the commodity. The sandbox is the constraint.
Here is the blind spot, and it is the one that will produce the first nine-figure incident.
All three products grant the agent the same three capabilities: shell execution, filesystem read and write, and — in the database vendor's case — a direct connection to production databases. Add MCP, which ships with no signature verification, no tool-description audit, and coarse permission granularity, and you have composed a system where a prompt injection no longer rewrites an output. It executes an arbitrary command.
The attack surface is not theoretical. The DAO was a warning we ignored. The six-month forensic audit I ran in 2017 disassembled 12,000 lines of EVM assembly to find the point where high-level Solidity abstractions masked a low-level memory-safety failure. The reentrancy bug was invisible in the contract's English and unmistakable in the instruction pointer. MCP tool-description injection has the same shape: invisible in the tool's marketing, visible only in the execution trace — and by then the shell command has already run.
Stack the incentives and the picture sharpens. When the harness is a commodity, security becomes a cost center rather than a differentiator. The same aggressive truncation that produces the 77 percent headline produces fewer validation rounds and looser tool permissions. The efficiency claim and the security debt are the same coin, minted in the same commit. The vendors are not lying about the savings. They are simply not billing the risk to the same account.
There is no liability framework for what comes next. If a malicious MCP server injects an instruction and the agent drops a production table, who pays? The protocol author? The third-party tool vendor? The harness maintainer? The customer who deployed it? Under the current contract landscape the answer is no one, because the component chain is replaceable by design — and replaceability is exactly what makes forensic attribution impossible. This is the DAO's other lesson, the one nobody priced: an architecture optimized for composability is an architecture optimized for unaccountability.
The commoditization is real, and it points in the correct direction. Value is migrating to the model layer, which sets per-token pricing; to the data layer, which owns migration cost; and to the execution layer, which supplies the sandbox every shell call requires. The middle layer — the harness — is being squeezed toward zero margin, exactly as container orchestration squeezed the tooling layer a decade ago. The harness authors will not become the Ranchers and Dockers of this cycle. They will become the runtime nobody mentions by name.
The part that has not shipped is accountability. Not one vendor published a permission model, an execution-approval flow, a red-team result, or an audit-log schema. Zero knowledge, maximum proof is a slogan the agent stack has not earned.
Watch the next two quarters for a single event: the first publicly disclosed agent privilege-escalation incident involving shell access or MCP injection. That event, not any benchmark, will set the enterprise adoption curve — because trust is a bug, and the first exploit is the patch. The DAO did not kill Ethereum. It redefined what "audited" had to mean. The agent stack is about to receive the same lesson, and its vendors have already decided not to pay for it in advance.