You're being sold AI agents that replace your team. Meta ran that experiment ...
You're being sold AI agents that replace your team. Meta ran that experiment this year, then quietly killed it.
Two weeks ago at Carolina Code Conference I gave a talk with a one-sentence thesis: the moat was made of YAML, the new moat is judgment. When ops work gets cheap enough, the tools that survive aren't the ones with the slickest dashboard. They're the ones someone will put their name on when they break. This week Meta and Microsoft proved it from opposite ends.
Reuters dropped the investigation Tuesday. The plan was codenamed Project OT: cut some teams by 60 percent, hand the rest to agents, pocket the savings. First layoffs hit in May.
Then the agents started doing things nobody expected. Internal posts described "large-scale, disruptive actions that humans are unlikely to execute." Technical and security incidents jumped 40 percent year over year. Human cleanup time went up 70 percent. Code changes were up 220 percent, which sounds amazing until you notice features actually reaching users grew only 36 percent. The agents stayed busy. They just didn't build much. By July, Zuckerberg admitted the agents hadn't "accelerated in the way that we expected," and the second round of layoffs never came.
The difference from every SaaS tool you've ever bought: when Slack breaks, a vendor picks up the phone. These were autonomous systems touching production, with no line they couldn't cross and no one whose name was on it when they crossed it. Nobody had signed the accountability contract.
Microsoft shipped the contract this week. Their Agent Governance Toolkit, free and open source, builds on a finding that should end the "prompt safety" conversation: a 100 percent attack success rate against GPT-4o, Claude 3, and Llama-3 under adaptive attacks. Peer-reviewed, ICLR 2025, not a vendor whitepaper. Yes, those are last year's models, but adaptive attacks beat prompt guardrails by construction; newer models don't change that. Every jailbreak attempt worked. Prompt safety isn't a control surface. It's a wish.
AGT's answer is deterministic governance. Every tool call and every action gets checked in code before the model's intent touches anything real. If the rule says the agent can't issue a refund over $500, or can't email your customer list, it structurally can't. Not "probably won't" (Meta just showed what that costs). Structurally can't.
The code and config are cheap now; that part's solved. What's left is judgment: why should this exist, is it safe enough, and who answers when it goes wrong.
Meta spent the week proving the first half of what I said. Microsoft shipped the second.
The moat was made of YAML. The new moat is judgment. Those two stories are the same sentence, read from opposite ends.
Who is auditing what your agents can touch? Or are you missing out on the gains an agent could bring because you're not sure about how to implement things safely? Maybe we should talk