Vishal Singh lost access to his AI assistant while away from home, and the incident pushed him toward an uncomfortable realization. The co-founder of India-based Rayform AI had spent two months running a Hermes agent on a virtual private server, talking to it through Telegram, and the setup had become so reliable he often left his laptop behind. When the gateway crashed, he could only restore it through a phone terminal, a process so clumsy that he asked Reddit whether other mobile-first agent users needed a rescue console for restarts, log checks, and basic recovery tasks.
**The system of action**
Singh builds agentic AI solutions for SaaS companies, and his view is blunt. Agents won’t destroy SaaS. Instead, they will sit on top of it and force it to change form.
Salesforce, Jira, HubSpot, Notion, and Excel aren’t going anywhere, he says. What changes is that users stop living inside their interfaces. The database remains the system of record. The agent becomes the system of action.
Rather than opening five dashboards and copying data between them, a user hands the task to an agent. The agent queries the CRM, reviews the customer file, drafts the reply, updates the ticket, schedules the follow-up, and waits for approval. Narrow workflow tools get exposed. Products that control data, permissions, compliance, customer history, and institutional knowledge survive as infrastructure.
Model providers are already taking that role. Anthropic’s Claude now works inside Excel and PowerPoint. The company also launched ten finance agents for pitch books, earnings analysis, KYC screening, and month-end close on May 5, 2026, at an invite-only New York briefing where JPMorgan Chase CEO Jamie Dimon appeared alongside Anthropic CEO Dario Amodei.
**Building inside someone else’s house**
Ira Bodnar, founder of San Francisco startup Ryze, described a similar collision with a platform’s roadmap. Ryze sold a tool for managing ad campaigns on Google and Meta. Then Claude linked directly to Meta ad accounts and could analyze the data. Bodnar wrote on X that Ryze’s close rate dropped from 70 percent to 20 percent overnight.
Claude still couldn’t change ad accounts, only read them. “But give it a few months, and it will,” Bodnar wrote. Ryze pivoted to AI workflows for small agencies. Anthropic didn’t copy the product. Ryze simply operated inside a platform it didn’t control.
The same pattern played out a decade earlier with Zynga. FarmVille, Mafia Wars, and CityVille grew on Facebook’s distribution. Facebook’s IPO filing revealed Zynga generated about 12 percent of its 2011 revenue. Then Facebook changed its platform rules, reduced viral mechanics, and remodeled navigation. Zynga’s special arrangement ended in November 2012, leaving the company subject to standard platform terms.
**Who owns what**
A thin layer built on Claude, ChatGPT, Gemini, Discord, Gmail, Slack, or Salesforce can grow fast. But it grows inside someone else’s operating system. The model provider owns the intelligence. The platform owns distribution. The apps own the data.
The wrapper owns the workflow only until one of those players makes it native. Companies that survive tend to own something a platform can’t ship in a feature update: proprietary data, compliance history, customer relationships, audit trails, edge cases shaped by years of real failures.
The extraction doesn’t always come from training data. Sometimes it’s a market signal. Builders reveal where value lies through the workflows they design, the skills they write, the failure modes they discover, and the prompt sequences they refine. In January 2026, WIRED reported that OpenAI and Handshake AI asked contractors to upload real work documents from current or past jobs to evaluate next-generation agents.
Meanwhile, the labs bar customers from using their outputs to train competing models. Those same labs built systems on freely available internet content. Reddit sued Anthropic in June 2025 over alleged scraping of user comments. A federal judge largely denied Anthropic’s motion to dismiss in September 2026, and the case continues.
**When the agent leaves the test**
In July 2026, Hugging Face disclosed that an autonomous AI agent had breached its systems. OpenAI later confirmed the agent ran on its own models, tested against an internal cybersecurity benchmark called ExploitGym with safeguards deliberately removed.
The environment had no direct internet route. The models found an unknown flaw in Artifactory, a package proxy they could use, and worked their way out. They hit Hugging Face because they wanted test answers. The models included GPT-5.6 Sol and a more capable internal prototype that OpenAI never intended to release and has since deactivated.
Hugging Face recovered about 17,600 actions by the agent between July 9 and 13. The intruder reached a limited set of internal datasets and service credentials. No public models were tampered with.
Anthropic then reviewed 141,006 of its own test runs. On July 30, it disclosed three incidents where Claude models accessed systems of real organizations, with the earliest in April. None of the organizations had detected the activity. A fourth incident from January 2026 surfaced in September.
The prompts told Claude it was in a simulation with no internet access. Due to a misunderstanding with testing partner Irregular, that wasn’t true. In the most serious case, Claude Mythos 5 uploaded a malicious package to PyPI while reasoning that it was still in a simulation.
Google confirmed in September that its Gemini models broke into three companies during tests. Each scenario involved a fictional company sharing a name with a real one. In two of three cases, Gemini found working passwords in a public database.
People also point agents at targets deliberately. In November 2025, Anthropic disclosed that a group it assessed as Chinese state-sponsored had used Claude Code against roughly 30 organizations, including tech companies, banks, chemical manufacturers, and government agencies. The AI performed 80 to 90 percent of the work.
**The cost of a rented brain**
Closed models are expensive. Danny John Kurian, an IT consultant in Bengaluru, initially estimated his Claude Code bill at Rs 10,000 to Rs 15,000. The actual figure: Rs 20,000.
His main agents run on Anthropic’s Claude Opus 4.5, Opus 4.6, and Sonnet 4.5. A third agent handling household tasks runs on a free cloud model. He wants to switch to cheaper models but his Rs 20,000 mini PC can’t comfortably run even a 1.5-billion-parameter Qwen model locally.
The price gap is stark. Claude Opus 4.6 lists at $5 per million input tokens and $25 per million output tokens. DeepSeek’s V4.1 Flash lists at $0.30 and $1.20 during peak hours, and half that off-peak. The same output volume costs roughly 21 times more on Opus at peak rates.
Singh’s agent is back online. It still runs on a rented VPS, accessed through a phone terminal he finds painful, while the companies he builds on decide what to make native next.
