Agentic AI Is Eating the Stack -- and Security Is the Layer Nobody Finished

This week the agentic AI stack stopped being a demo and started becoming infrastructure. Within days of each other, three separate layers of picks-and-shovels for autonomous agents landed in public view: an inference layer built specifically for agents, a control plane for governing what those agents are allowed to do, and a proxy that reverse-engineers legacy apps into APIs so agents can actually use them.

The tell is not the launches themselves. It is the company they keep. Cloudflare is now selling edge inference tuned for tool-calling traffic. Dome Systems is selling "a system of control for AI agents." Kampala, out of Y Combinator's W26 batch, is selling a man-in-the-middle proxy that turns apps without APIs into agent-usable endpoints. And a free scanner called isitagentready.com will tell you, in about ten seconds, how badly your own website fails at the same job.

But the same week that made the agent stack look inevitable also exposed where it breaks: authorization, approval, and the quiet difference between an agent that failed and an agent that failed silently.

What Is Happening

The inference layer moves under the agents

According to Cloudflare's AI Platform announcement, the company has shipped "an inference layer designed for agents" -- meaning the platform is optimized for the traffic pattern agents generate: high-volume, multi-turn, tool-calling, latency-sensitive, and constantly retried. That is a different product than a chat endpoint. It is infrastructure that assumes the client is not a human typing, but a process making dozens of calls per task and failing often enough that retry economics matter.

The strategic read is simple. Cloudflare already sits at the network edge for a huge share of the web. If agents are going to run against your data, Cloudflare wants to be the place where the request, the model call, and the policy check all happen -- close together, in one bill.

The control plane arrives before the accidents do

Three of this week's signals point the same direction: buyers want a kill switch, an approval gate, and a documented blast radius. Dome Systems pitches itself as "a system of control for AI agents." Descles, posted as a Show HN, offers "response level LLM message control with HITL approval flows" -- human-in-the-loop gates at the message level, not just at the task level.

And in a detailed writeup on Sandboxes and Worktrees: My Secure Agentic AI Setup in 2026, developer Mike McQuaid documents the practice that is quietly becoming standard among senior engineers: run agents inside sandboxes and isolated worktrees, so a bad decision produces a discarded branch instead of a production incident. Sandboxing is no longer a security-team policy. It is a personal hygiene habit.

Kampala attacks the long tail nobody wants to touch

The most strategically interesting launch of the week is the smallest. Kampala (YC W26) -- Reverse-Engineer Apps into APIs is, in founder Alex Blackwell's description, a man-in-the-middle style proxy that lets you agentically reverse-engineer applications into APIs.

Sit with that. Most of the software economy -- internal tools, regional SaaS, government portals, twelve-year-old vendor dashboards -- has no usable API. If agents are going to do real work, someone has to make the world agent-readable. Kampala is betting that the translation layer between "software that exists" and "software an agent can call" is a durable business, not a feature.

Agent readiness becomes a discipline, not a vibe

According to isitagentready.com, you can now scan your website to see how ready it is for AI agents. That single utility is a leading indicator of a whole new profession. For fifteen years, businesses optimized for crawlers and humans. Now they will optimize for autonomous buyers: machine-readable pricing, stable action endpoints, structured permissions, and explicit agent authentication.

Expect the same arc SEO followed -- an obscure checklist, then a consultancy, then a line item in every marketing budget. The companies that move first will be the ones that show up in agent-mediated purchasing. Everyone else becomes invisible in a way that never generates a 404.

Legacy formats are the real bottleneck

Meanwhile, the unglamorous problem: Is PDF a Problem for AI? makes the case that the world's most common document format is close to hostile to machine reasoning -- no semantic structure, no stable anchors, no reliable reading order. Add the AST navigation tooling that keeps appearing in agent coding setups, and the pattern is clear: our documents and codebases were authored for human scanning, not for agents that need deterministic structure.

The counter-current is equally important. OpenArch, a repository of PyTorch implementations of modern LLM architectures, is a reminder that as the top of the stack consolidates into a few managed platforms, the model layer itself keeps commoditizing. The moat is not the model. It is the control plane around it.

The Data Behind It

This week's signal set is qualitative, but its shape is countable. Here is what the source material actually establishes -- and, just as usefully, what it does not.

What Industry Sources Say

The builders themselves are the most useful evidence, because their product positioning reveals what they believe is broken.

Dome Systems does not sell speed or intelligence. It sells control -- "a system of control for AI agents". That framing only exists if the buyers' actual fear is an agent doing something nobody sanctioned. Descles goes one level deeper with response-level message control and HITL approval flows at descles.com, which implies the failure mode is not a single catastrophic call but a bad message inside a chain of thirty.

Mike McQuaid's account of running agents inside sandboxes and git worktrees on his 2026 setup is the practitioner version of the same admission: presume the agent will do something destructive, and architect so that the destruction is cheap and reversible.

On the demand side, the Kampala launch thread and the existence of isitagentready.com say something blunt about the current state of the web: most of it is not legible to agents, and most operators have no idea. And the PDF analysis on pdf4wcag.com plus the steady stream of OpenArch-style open implementations confirm the split: the format layer is stuck, the model layer is commoditizing, and the control layer is where all the money just showed up.

Career and Income Implications

If you build software, the last eighteen months have been confusing. Agents were supposed to take your job. Instead they created a stack to maintain -- and a stack nobody has secured yet. That is the opening.

For infrastructure and platform engineers: the highest-leverage skills this quarter are boring on purpose. Sandboxing, worktree isolation, egress control, secret scoping, and audit logging. McQuaid's writeup is a working blueprint. If you can stand up an agent runtime where a compromised tool cannot reach your production credentials, you are solving a problem that every company adopting agents will hit within two quarters.

For security and compliance professionals: the MCP surface is your new perimeter. Third-party MCP servers -- the connectors that give agents tools -- introduce supply-chain risk that most organizations have not modeled. A server that changes behavior after you approve it is a rug pull. An agent that returns a plausible-but-wrong result across a five-step workflow is a silent failure, and silent failures are worse than crashes because nobody files a ticket. Approval gating (as Descles markets), scoped permissions, and immutable logs are the controls that matter.

For product, marketing, and ops people: agent readiness is the new SEO, and it is far easier to learn right now than it will be in two years. Run the scan at isitagentready.com on your own site today. Then ask what an autonomous buyer would need in order to complete a purchase without a human on either end. Very few companies can answer that. The ones who can will own the next channel.

For developers in unglamorous corners: Kampala's thesis is a career thesis. Legacy systems without APIs are not going away -- they are the last mile of the agent economy. The engineers who can build a reliable translation layer between a 1998 ERP and a modern tool interface are, for the next several years, unusually well compensated.

For everyone else: the honest question is no longer "will AI take my role?" It is "how much of my role is legible to an agent, and how much of it is judgment?" If your work consists mostly of moving structured information between systems, you are squarely in the automation zone. If it consists of deciding what should happen when the information is contradictory, ambiguous, or politically loaded, you are not -- yet. A quick gut check is the Career Pulse Score, which asks how future-proof your career really is against shifts exactly like this one.

The Bigger Picture

Three forces are converging, and each one makes the others more urgent.

First, the cloud layer is absorbing the agent layer. When an edge provider like Cloudflare builds an inference layer explicitly for agents, it changes the economics for everyone downstream. Latency budgets shrink, per-call costs fall, and more aggressive agent designs become rational. That is a demand shock for control tooling, because the more agents you run, the more you need to bound them.

Second, the model layer keeps commoditizing. OpenArch's PyTorch implementations of modern architectures are a reminder that frontier capability diffuses. When the intelligence becomes broadly available, margin migrates to whoever owns the orchestration, the data access, and the guardrails. This is why Dome Systems and Descles exist, and why Cloudflare is selling a platform rather than a model.

Third, labor markets are reallocating around the stack, not out of it. The 2026 pattern is not mass replacement. It is scope migration: work moves from people who touched every step of a process to people who design, gate, and audit the process. That is a smaller number of people with a larger blast radius, which is precisely why the security layer suddenly has budget.

The unresolved item is trust. There is still no enforced, cross-vendor standard for verifying what a third-party MCP server actually does after installation, and no standard verdict for a multi-step workflow that produced a confident wrong answer. Until there is, every organization running agents at scale is carrying an unpriced risk. Builders are aware -- you do not ship a "system of control" in a market where control is a solved problem.

So the practical takeaway for this quarter is not to wait for the standard. It is to assume the quiet failure is already happening somewhere in your pipeline, sandbox accordingly, and make yourself the person who can answer the question everyone will be asking by year-end: what exactly is your agent allowed to do, and who is checking?

If you are unsure where you sit in that reallocation, run the Career Pulse Score and treat the result as a starting point, not a verdict. The stack is moving fast. The people who understand its layers -- and its gaps -- are the ones who get to choose where they land.