Operational agents for customer workflows

The persistent-agent workspace is acquiring dedicated hardware and packaged open implementations. Ghost raised $11 million around a $3,499 computer designed for personal agents that act on a user's behalf; OpenMuse combines a browser, terminal, files and ongoing work in an open agent; and Sooveryn packages shared project memory for coding tools. This extends the existing workspace line from cloud sessions into a device and software category. Ghost is an early launch and the open projects do not yet establish retention or reliability.

Agent products are converging on persistent work environments rather than one-shot chat tasks. OpenAI has introduced always-on Dots and reusable Codex cloud environments, Wabi is repositioning its app builder around a personal agent, and CopilotKit publishes open agents with browsers, terminals and files. Early users are already probing execution resources, messaging access and missing project memory. The emerging control point is the durable workspace: state, credentials, files, ongoing jobs and human handoff. These are product and implementation signals, not proof that unattended work is reliable or that users will abandon SaaS.

Agent safety is moving outside the model and into an independent execution boundary. NVIDIA introduced an open platform that combines sandboxing, runtime policy and in-silicon monitoring; Scale is integrating it, Perplexity reports adversarially testing its own sandbox across nine models, and independent builders connect weak isolation to recent agent incidents. The market is no longer treating containment as a prompt feature: it is becoming a separate control plane that can observe and stop an agent even when the agent itself is compromised.

Work software is beginning to treat agents as participants rather than embedded chat features. Ando gives agents identities and inboxes inside team messaging, Orchestrat coordinates coding agents through shared tasks and versioned documents, Whiteboard gives humans and agents a common design canvas, and Databricks is adding governed organization to agent assets. Identity, activity history and shared state are becoming native workspace primitives.

Agent evaluation is shifting from final-answer scoring to process, regression and checker quality. New work isolates trainable failure states, selects cheaper trajectory subsets, evaluates computer-use processes and mutates benchmark oracles; an operator message explicitly pairs online evaluation and offline benchmarking with production infrastructure. Reliability is becoming an always-on engineering layer.

Enterprise agents are moving into governed data and operational systems. Databricks released an MCP service for Genie, its CEO frames company context as meetings and email, and AWS case studies show multi-tenant agent security and automated cost control at scale. This is a shift from a chat assistant to a controlled work surface with identity, policy and audit requirements.

Agents are moving from separate chat windows into the places where work is executed. Claude is merging chat and Cowork while adding document and presentation workflows, Databricks reports a company-wide rollout to roughly 3,500 engineers, Replit is entering Slack Code, and Google is exposing Home devices through an agent interface. The shift is from AI as an add-on to software as an agent-operable work surface.

NVIDIA OpenShell uses formal proofs to establish that agent-proposed permission changes remain inside approved boundaries. Independent work adds a social harness for agents acting across principals, persistent adversarial worlds and runtime resilience checks for physical systems. AIUC's funding adds a capital signal around assurance and underwriting, not proof that these controls are already universal. Agent autonomy is creating a control market built around enforceable boundaries and evidence of safe execution.

Agent control is moving inside the runtime rather than remaining an external monitoring layer. Bedrock AgentCore now handles ephemeral code sandboxes and end-user OAuth consent; ToolReplay seals and deterministically replays tool transcripts; OpenBot gives each AI coworker an isolated computer with an action log; and HazardAuditor tests computer-use agents against executable threats. The market-forming layer is a control plane for identity, policy, replay, isolation and auditability across long-running agent work.

The agent workspace is taking shape across different surfaces: GenOffice lets agents edit real office files locally, Pi Dash assigns background implementation work to connected agents, Zyng records and narrates a running product through MCP, and users are beginning to imagine one remote agent connected to many systems. Files and workspaces are becoming places where agents execute, not only places from which they retrieve context.

Agent products are taking responsibility for verification, not only generation. Perplexity reports using GPT-6 Astra to change software and monitor production systems, Cognition describes Devin testing its own work, and Graphify C# supplies compiler-accurate semantic evidence for coding agents. The emerging product boundary is a runtime that can inspect, test and justify its actions before a human reviews the result.

Agent reliability is moving inside the execution runtime. OpenAI's Agents API packages sessions, orchestration, context compaction and recovery as a managed Codex harness; AWS's turn-level Agent Evaluation Metric isolates the first failure in a multi-turn run; Vercel's HarnessAgent demand is for input-dependent tool approvals; and axonpush replays complete production requests in CI. Together these products and operator requirements show a control layer forming around recovery, permissions and regression gates rather than prompt writing alone.

AI products are expanding from chat into complete work environments. OpenAI's Data agent connects company data and builds dashboards in natural language; Amazon Quick ships as a desktop environment and can automate an RFI workbook end to end; GenOffice edits real office files locally with a built-in agent; and Revinho gives agents read-only, workspace-scoped access to analytics and revenue data. The product boundary is moving toward a workspace where context, documents and actions are coupled.

As agents spread across local tools and subagents, control is moving from individual prompts to the host and execution environment. Agent inventories, context-reprocessing regressions, external subagent executors and self-hosted company operating systems point to a need to inspect what agents can touch, how they run and where their cost and failure modes accumulate.

As agents gain access to tools and external systems, reliability is being implemented inside execution rather than left to model alignment alone. Prompt-injection resistance, confirmation controls and automated agent evaluation are converging into a runtime control layer for actions, permissions and failure recovery.

Control is moving closer to the action. Agent-browser work emphasizes recorded, reviewable execution; production automation is adding safe target reconfiguration; and verifier-grounded training makes feedback part of the loop. Reliability is increasingly implemented in the runtime instead of left to user instructions.

Agent safeguards are moving from optional settings into the execution path. Cheqpoint pauses refunds, deletions and deployments before they run; an operator reports that none of 950 human- or agent-created bots adopted optional limits from a settings page, while agents did add limits when the constraint lived inside the workflow; another user describes prompt changes breaking tool behavior without version history; and NVIDIA documents identity propagation across federated AI platforms. Effective control is becoming a combination of versioned configuration, inline policy, identity and human approval at the moment of action.

Production reliability is shifting from checking an agent's answer to controlling the state transition it causes. Operators want previews cryptographically or semantically bound to the later apply operation, repeatable smoke tests against the real service, named approval before destructive commands, and visible reasons when workers skip tasks. A new approval product reflects the same commercial demand. Agent execution is beginning to require the transactional guarantees, observability and authorization boundaries already expected from financial and deployment systems.

Agent platforms are converging on a governed runtime layer: reusable skills and files, explicit policy enforcement, multi-agent operations and portable deployment patterns. The market is moving beyond a capable model or coding interface toward the operational substrate that makes agents controllable in real work.

The deployment bottleneck remains operational rather than purely model capability. A real browser-agent test completed only two of ten SaaS sign-up flows, while current engineering discussions focus on multi-agent failure patterns, evidence baselines, verification of mounted skills and the silent failures that appear after AI-generated code is accepted. Together these observations show why recovery, replay, validation and audit layers are becoming necessary around agents before wider workflow adoption.

Agent systems are being designed for work that lasts hours or weeks rather than isolated tool calls. NVIDIA is optimizing a model for high-volume execution and delegation, a recruiting operator describes the month-long horizon required for autonomous hiring, and research now measures when deep-research agents should stop gathering evidence and how agents perform in delayed business environments. The market bottleneck is shifting from task completion to continuity, cost control, recovery and auditable decisions across a long-running process.

AI agents are crossing from isolated tasks into core operating systems. Kavak reports that roughly 95% of interactions and transactions run end to end on AI and that as many as 200,000 agents operate daily, while independent research and tooling now focus on auditing whole agent systems, evolving harnesses, durable execution and tool-call accuracy. At this scale, model capability is no longer the main constraint: evaluation quality, runtime continuity and controlled improvement determine how quickly organizations can expand autonomous work.

Agent reliability is becoming a packaged production stack rather than a collection of prompt techniques. Operators now describe durable execution, authentication, streaming, sandboxes, evaluations and handoffs as the difficult part of deployment; new runtimes make state resumable, bitemporal memory makes decisions auditable, and a real billing incident shows that confident multi-agent review still misses production errors. The market consequence is a managed control layer around model intelligence, with orchestration quality becoming a measurable product differentiator.

The harness around an agent is becoming a measurable source of capability and reliability. New research benchmarks end-to-end harness optimization and machine-checks resume semantics across workflow frameworks; open-source runtimes add reversible traces, replay and loop-level diagnosis; and practitioners now treat benchmark scores as conditional on orchestration quality. This extends agent reliability from failure recovery into a competitive engineering discipline for prompts, tools, memory, control flow and persistence.

Agent-native workspaces are expanding beyond chat and code execution into the handoff layer between people and multiple agents. New products preserve visual review context for teammates and agents, while a voice-first development environment lets one operator spawn, redirect, and interrupt many coding agents. Combined with earlier chat-plus-repository workspaces, the line now has a second observation day and confirmation across product, engineering, and social sources.

The strongest global product evidence combines agent memory, access restrictions and post-launch operational feedback. This suggests an emerging demand for control, renewal and reliability layers around AI workflows rather than another standalone model wrapper.

Global posts point to AI agents becoming operational systems for call centers, appointments, customer support and per-customer workflows, not just chat interfaces.