The model was never the hard part

The model was never the hard part.

For two years we argued about benchmarks while the actual bottleneck sat one layer down: an agent that can write a deploy script still has nowhere to run it, no account to run it in, nowhere durable to keep what it learned, and no safe way to hold the keys to anything that matters. The smartest model in the world is a brain in a jar until you solve those.

In 2026 the industry quietly solved most of them.

An agent can now create a cloud account and burn it down in an hour

On 19 June, Cloudflare shipped Temporary Accounts for Agents. An agent runs wrangler deploy --temporary and gets a live Worker on a workers.dev URL — no signup, no OAuth, no API token. Cloudflare’s CLI even advertises the flag in its own output when an unauthenticated deploy fails, so the agent discovers it without being told. The account self-destructs after 60 minutes unless a human opens the returned claim URL to take ownership.

Read that again as a security model, not a demo. The agent never touches your real account. The blast radius is one disposable sandbox with hard quotas that evaporates on its own. If the agent does something dumb, the worst case expires by lunch.

That’s the shape of every good idea in this space right now: give the agent exactly what it needs to ship, scoped so tight and so short-lived that a mistake can’t metastasize.

1. The account: short-lived by default

Cloudflare’s throwaway account is the vivid version of a principle the whole industry converged on this year: agents should run on credentials that are scoped and expire, never standing access.

AWS spelled it out in April: hand agents short-lived credentials via STS AssumeRole with a per-tool session policy, where “effective permissions are the intersection of the role’s policies and the session policy.” Their reasoning is the whole game in one sentence — agents “can make thousands of API calls in seconds, so the impact of misconfigured permissions scales quickly.” A human with a leaked key fires it a few times an hour. An agent with a leaked key fires it a thousand times a second.

So the unit of trust shrank. Not “here’s an API key for the company account” but “here’s a credential good for this task, this scope, this hour.”

2. The sandbox: run its code without it running you

Once an agent writes code, you have to execute it somewhere that isn’t your laptop or your prod box. Two camps emerged.

VM-grade isolation. E2B (Firecracker microVMs; a $21M Series A in 2025), Modal, Fly Machines, and Daytona all give each agent its own kernel and filesystem. Strong walls, real VMs, per-second billing.

Ultralight isolates. Cloudflare’s Dynamic Workers run agent-generated code in V8 isolates that start “in a few milliseconds” and cost $0.002 per unique Worker loaded per day — what they pitch as “100x faster than a typical container.” That same release introduced Code Mode: instead of making a dozen sequential tool calls, the agent writes one TypeScript program against the APIs. Cloudflare measured an 81% drop in token usage in their example — because tool calls burn context and tool code doesn’t.

The tell that this is now table stakes: the coding agents sandbox themselves. Claude Code shipped native sandboxing in October — macOS Seatbelt, Linux bubblewrap, network forced through an allowlist proxy — and reported an 84% cut in permission prompts internally. OpenAI’s Codex CLI does the same: no network and workspace-only writes by default. Sandboxing stopped being something you bolt on and became how the tools ship.

3. The state: git is still winning, and that’s the interesting part

Here’s where I expected to find a shiny new answer and didn’t.

For running several agents in parallel without them clobbering each other, the state of the art is git worktrees — a 20-year-old feature. Claude Code has a --worktree flag that drops each agent in its own branch and directory; there’s already a small ecosystem of GUIs to manage the swarm.

People did try to build agent-native version control. The clearest data point is a project called agentjj, which embedded Jujutsu to give agents a better-than-git history — and got archived in February with a postmortem concluding that “jj solves human problems, and agents have different problems.” Nobody has shipped the post-git thing yet. If you’re looking for an unclaimed hard problem, it’s right here.

What did get built is the layer above the filesystem: durable state. Cloudflare’s Fibers checkpoint a long-running agent to SQLite so it survives a crash mid-task and resumes instead of restarting. Turso’s AgentFS is a SQLite-backed filesystem an agent can mount and treat like disk. The pattern: an agent’s memory of a multi-step job is too valuable to keep in RAM and lose on the first timeout.

4. The keys: the most interesting reframe of the year

The last piece is access — letting an agent use Slack, GitHub, your database — without pasting long-lived secrets into a prompt.

The default answer is MCP, the protocol agents use to reach tools. But the sharpest take came from Sean Lynch, quoted by Simon Willison last week: “Maybe the idealized form of MCP is just an auth gateway for the API and nothing else. That’d still be a win.” His point: MCP’s real value over a plain CLI isn’t the tools — it’s that it moves the auth flow outside the agent’s context window. The agent never sees the credential; the gateway holds it.

And it isn’t just cleaner — it’s cheaper. Anthropic found that loading every tool definition into context up front cost one workflow ~150,000 tokens; re-implemented as code calling the tools behind a gateway, it dropped to ~2,000 — because the schema otherwise gets prepended on every turn. Lynch’s argument, priced out.

AWS productized it. Bedrock AgentCore ships an Identity layer that vaults provider credentials so the agent works through tokens and never handles the raw secrets, plus a managed Web Search tool at $7 per 1,000 queries the agent discovers over MCP. The gateway is the product.

Why all of this, all at once

Because the money figured out where the bottleneck moved. LangChain raised $125M in October on a one-line thesis I’d put on a wall: “agents are easy to prototype but hard to ship to production.” Baseten is reportedly raising ~$1.5B at up to a $13B valuation — up roughly 160% in under six months — selling the layer that runs models cheaply and reliably. The capital stopped chasing the model and started chasing the plumbing.

And the plumbing is racing ahead of what the agents can actually do with it. Artificial Analysis’s AA-Briefcase benchmark, out this month, ran models through realistic multi-week knowledge work — thousands of Slack messages, emails, exports. The best model fully satisfied every task criterion on just 3% of jobs. Infrastructure for autonomy is now well ahead of autonomy itself.

So what

For two years the honest answer to “what’s your moat?” was “we have access to a good model” — and that was never a moat, because everyone gets the next model on the same Tuesday.

The moat moved down a layer. It’s now whether you’ve built the boring four — the account, the sandbox, the durable state, the auth gateway — so your agent can do its job safely and repeatedly, on credentials that expire and in a sandbox that can’t hurt you. The model is a commodity you rent. The plumbing is the thing you own. Most of it is buyable off the shelf today, which means the question isn’t whether you can build it — it’s whether you’ve decided it’s the work that matters.

If your agent strategy still lives or dies on which model you picked, what are you actually building that the next model release won’t flatten?