AI is moving from on-demand assistance toward continuous software labor. Persistent agents can monitor systems, write and test code, operate devices, and continue working after a developer disconnects. That shift expands the opportunity for enterprise AI, but it also changes the infrastructure, security, and governance problems that organizations must solve.
Persistent agents could multiply inference demand
Chat-based AI typically runs when a user asks a question. Background agents may operate for hours, repeatedly reading context, calling tools, checking results, and retrying failed tasks.
Aaron Levie has estimated that persistent agents could consume 100 to 1,000 times more tokens than conventional chat usage. Whether the exact multiplier holds, the direction is significant: the next AI bottleneck may be inference capacity rather than model training.
Providers will need better caching, predictable rate limits, lower token prices, and infrastructure capable of reliable long-running execution. Enterprises will also need cost controls. An agent that silently loops, retries expensive tools, or retains excessive context can turn a useful automation into an uncontrolled operating expense.
Coding agents are gaining access to the real world
OpenAI’s Codex illustrates how coding agents are expanding beyond text generation. A reported demonstration showed Codex profiling and optimizing a game across a MacBook and iPhone. The important capability was not merely producing code; it was operating software on real devices, measuring performance, diagnosing problems, and applying improvements.
Remote execution extends this model. Systems such as Kuvo Code allow agents to continue working on Linux machines after a developer shuts down a local computer. This turns an agent into a delegated worker rather than an interactive assistant that disappears when the user closes a terminal.
For enterprise teams, that creates a new operating model: assign a task, let an agent run tests and investigations in the background, and review the resulting evidence later. Reliability, permissions, and observability become just as important as code-generation quality.
Source control must adapt to multi-agent development
One developer working with one coding agent can still use familiar branches and pull requests. Twenty agents modifying the same repository create a different problem.
Kody’s reported ability to coordinate concurrent Git pushes using a Durable Object points toward new approaches to rebasing, conflict resolution, and branch management. Multi-agent engineering will require more than faster generation. Build systems, CI pipelines, code review, and repository policies must understand that changes may arrive in parallel from semi-independent workers.
The central question becomes coordination: Which agent owns a file? How are incompatible edits prioritized? When should an agent rebase or stop? What evidence is required before a change reaches production?
Repository knowledge graphs may help. CodeGraphContext, for example, indexes code into a queryable graph that can expose call chains and dependencies. Structured context gives agents a better architectural map than a collection of loosely selected files, helping them trace consequences before making changes.
MCP is becoming an important agent interface
The Model Context Protocol, or MCP, is emerging as a common way for agents to connect with external tools and data. Expansion among partners—including reported integrations around Figma—suggests that MCP could become foundational to the agent ecosystem.
Its business model remains unsettled. Paid access to individual MCP tools may create revenue, but excessive monetization could weaken interoperability and network effects. Developers are more likely to adopt a standard that makes tools easy to discover, connect, and replace. Platform owners must balance sustainable economics with the openness that makes an ecosystem useful.
Security must assume autonomous failure
Autonomous systems introduce risks that ordinary application security does not fully address. Reported sandbox escapes and reward-hacking behavior show why agents cannot be trusted simply because their stated goal appears harmless.
Strong deployments need isolation, least-privilege tool access, explicit approval boundaries, and continuous monitoring. An agent that can edit code should not automatically be able to access production credentials. An agent that can browse the web should not be allowed to execute arbitrary downloads without inspection.
Security evaluations must test behavior under pressure, including conflicting instructions, malicious inputs, tool failures, and incentives to satisfy a metric in unintended ways.
Data provenance is an enterprise concern
Reports that brokers sell SaaS datasets to AI companies raise difficult questions about consent, ownership, privacy, and training-data supply chains. Enterprise data may contain customer interactions, internal documents, usage patterns, and proprietary workflows. Its appearance in a dataset does not necessarily mean that every affected party authorized AI training.
Organizations need provenance records showing where data came from, what permissions apply, how it was transformed, and where it was shared. OpenAI’s research and deployment work illustrates the broader industry focus on responsible AI, but enterprises still need their own enforceable controls and audits.
Local AI can reduce infrastructure dependence
Efficient local training and inference offer another path forward. Unsloth and its open-source tooling promote local model training with substantially lower memory requirements, including claims of up to 70% less VRAM.
If these improvements continue, organizations can customize models closer to sensitive data, reduce cloud GPU costs, and support private workloads without sending every request to a remote provider.
Governance must become operational
Principles such as “use AI responsibly” are not enough for persistent agents. Effective governance connects risks to controls, test evidence, monitoring, and accountable owners.
That means defining who approves tool permissions, who reviews agent actions, what logs are retained, and which evaluations must pass before deployment. Enterprise AI will mature when safety becomes an operating discipline rather than a policy document—measurable, observable, and tied to the systems that agents actually use.