Is “Agentic AI” a Fraud?
what an agent actually is, from token prediction to a software factory

Key numbers

The figures this article rests on; each is sourced in Sources.

1. Mechanism is right — A model emits a structured call and the application's code executes it, exactly as vendors document. [S15]
2. The absolutes fail — Attribution graphs show two parallel pathways when adding 36 and 59, so 'no maths' is contradicted, though the self-explanation was false. [S4]
3. The demo was a browser agent — Operator used a vision model clicking web pages and was trained to ask for confirmation before external side effects. [S58]
4. 50% vs 80% horizon — One early model scored 17.4 h at 50% success but 3.1 h at 80%, a 5.6x gap that is the reliability problem. [S27]
5. 0.95 to the power 20 — A 95%-per-step agent completes a 20-step run 35.8% of the time (derived); a verifier with retries lifts it to about 90%. [S14]
6. About $0.7T capex in 2026 — Four firms guide to roughly $700-740B (derived sum); the video's $3 trillion has no source. [S40]
7. Record private rounds — $122B at $852B and $65B at $965B in 2026 contradict 'out of private money'. [S51]
8. Guardrails live outside the model — CISA and partners advise limiting active control of OT by AI without a human in the loop. [S33]

In one breath: the critique is right about the mechanism and wrong about the absolutes. A language model does predict tokens, and an agent does act only through code someone wrote: the model proposes a structured call, a harness executes it and feeds the result back. But the model is not only a lookup of likely strings, the measured record of agents is real and improving, and the money is real too. What the record does show is that reliability compounds badly over many steps, so an agent is safe where deterministic checks decide which of its guesses reach the world, and never on a plant's control loop without an interlock.

The claim, in his words

In late August 2026 a YouTube presenter argued that “agentic AI” is a marketing label stuck on ordinary programming, and that the people selling it know this. The video was widely shared among engineers. This article takes the argument seriously, states the strongest version of it, and tests each claim against published evidence. Some claims hold. Some break on contact with the sources. One of them, the economic one, needs different evidence from the others, and that difference is the organising idea of the article.

1.1 What was said, and by whom

The video is “Agentic AI Is Fraud! We Need To Talk About It…” by John Elder (channel John Elder, handle @SectionZero), uploaded 2026-08-27. It runs 11 min 27 s (687 s) and had 44,215 views when read on 2026-10-16 [S1]. All quotations below come from its auto-generated captions, lightly punctuated, with timestamps so a reader can check them against the recording.

Elder founded Codemy.com and SectionZero.ai and promotes a book, The AI Operating System, whose page says it teaches automation “without writing a single line of code” [S2]. The video ends with a pitch for the book and a paid community of “almost 350 members” [S1]. This is stated here as context, not as an argument: a seller of agent-building education arguing that agents are mislabelled is unusual, and he addresses it himself (“I’m as at fault as everybody for like hyping this stuff up”, 09:33) [S1]. The claims stand or fall on evidence, whoever makes them.

1.2 Two versions of the thesis

The spoken video and its written description differ. The video says “There is no AI involved whatsoever in Agentic AI” (00:23) and “The LLM did nothing” (05:18). The description says: “The language model is AI. The rest of the ‘agent’ is usually plumbing: prompts, APIs, tool schemas, permissions, logs, stopping conditions, and control flow” [S1]. The description is the more defensible thesis, and it concedes the point that the spoken version denies. Both are quoted here, and the tests in later sections are applied to both.

1.3 The fourteen claims

Reading the transcript end to end yields fourteen separable statements. They are numbered E1 to E14 and graded in section 11.

1.4 Three kinds of statement

The fourteen claims fall into three groups that need different kinds of evidence, and a rebuttal that mixes them goes wrong in one direction or the other.

• Mechanism (E1 to E7, E10, E11): what a language model and an agent do, step by step. Evidence: vendor documentation, interpretability research, benchmarks. Sections 2 to 6.
• Economics (E8, E9, E12, E13): who is spending, who is leaving, why companies would favour one story. Evidence: filings, earnings releases, press reports. Section 7.
• Naming (E6, E7, E14): whether “AI” and “agent” are honest words for the thing. Evidence: definitions and usage, not measurement. Section 8.

The order of the article follows the reader’s likely path. It starts where the video is strongest (the mechanism), moves to where its absolutes weaken, describes what an agent is in engineering terms, looks at the measured record and the failure modes, checks the money claims, and then settles the name. Sections 9 and 10 turn the result into design rules and an operations checklist for a data-center team. Article 29 explains the underlying model in detail, including sampling and post-training; this article cites it instead of repeating it.

Terminology follows common usage. An agent here means a model running in a loop with tools. The wider category, an agentic system, includes the surrounding code. The word “fraud” appears in this article only inside quotations, because the claim it makes is a legal one and section 7 shows what evidence exists for it.

Where he is right: the mechanism

The technical core of the video is correct. A language model produces one token at a time, it cannot reach the internet by itself, and an “agent” is a program that takes the model’s output, runs something, and hands the result back. An engineer who stopped reading here would have an accurate picture of the plumbing. The disagreements start with the words “did nothing”, which later sections test. This section sets down what is not in dispute, because everything after it depends on those points being solid.

2.1 Token by token

A model’s forward pass ends in a probability for each token in its vocabulary. The decoder chooses one, appends it to the context, and runs the whole pass again. The cycle repeats until a stop condition is met. Elder’s description (E1, 00:48–01:43) matches this exactly [S1]. Article 29, section on sampling, works through the logits, the softmax and the choice among the top candidates; none of that is repeated here. The point that matters for agents is the consequence: the same prompt can produce a different answer on the next run, and nothing inside the model guarantees that the output is correct, only that it is probable.

At inference the weights are fixed. A model does not learn from the conversation. Whatever it “remembers” within a session is the text sitting in its context window, and whatever it remembers across sessions is text that some other program stored and pasted back in. Elder’s “no memory” (E3) is accurate for weights and incomplete for the system, because agents add memory outside the model: files, databases, retrieved documents [S20].

2.2 The model never runs anything

Anthropic’s tool-use documentation says that Claude “returns a structured call that your application executes (client tools) or that Anthropic executes (server tools)”. The model signals this with stop_reason: "tool_use", and “your code executes the operation and sends back a tool_result” [S15]. OpenAI’s function-calling guide lists five steps: send a request with tools, receive a tool call, “execute code on the application side with input from the tool call”, send a second request with the tool output, then receive a final answer or further calls [S16]. The first model trained to choose which API to call, when, and with what arguments was described in 2023 [S17]. Two independent vendors and one research paper describe the same mechanism tool calling that Elder describes. He is right (E4) that a bare model cannot book a table: it emits text, and the harness around it does the booking.

The practical meaning for an operations team is a sentence worth keeping: every capability of an agent is a capability of the code that executes its tool calls. The permissions, network reach and blast radius of an agent are exactly those of the credentials its executor holds. The model has no other way to affect the world. Section 9 builds on this. The figure comparing the video’s account with the documented one appears in section 4, after the specific demo he uses has been examined.

2.3 No calculator, no encyclopaedia, no weight updates

Three further statements in the video are correct as stated for a bare model.

• There is no calculator inside. Arithmetic is performed by learned circuits, not by an arithmetic unit; section 3 describes what those circuits look like and why they are not the same as a calculator [S4].
• There is no lookup in a database at run time. Facts live in the weights, compressed and approximate, which is why a model can state a wrong fact in the same fluent register as a right one (Article 29).
• Nothing is learned during the conversation. A correction given in turn five is available in turn six only because the text of turn five is re-sent.

These three limits are the reason the design rule at the end of section 3 reads the way it does. A system whose component can be fluent and wrong, cannot look anything up unless an executor does it, and cannot update itself, needs checks that live outside the component.

2.4 Grades for this section

Against the evidence read for this article: E1 (next-token prediction) is supported [S15] [S16]; E4 (a bare model cannot act on the internet) is supported [S15] [S16]; E5, the generic claim that a model emits a call and ordinary code runs it, is supported, although the specific demo he uses to illustrate it is not what he says it is, as section 4 shows. The remaining statements (E2, E3), which add “no reasoning” and “no maths”, go further than the evidence, and section 3 examines them.

Where the absolutes break: “no reasoning, no maths”

The video goes beyond the mechanism and says a language model has no logic, no reasoning and no understanding of numbers (E2, E3). That is a statement about what happens inside the network, and it can be tested, because researchers have looked. The short result is that the absolute version is contradicted by direct evidence of multi-step computation, while a weaker version (the model cannot be trusted to reason reliably, to report what it did, or to generalise like a person) is well supported. For an engineer the weaker version is the useful one, and it leads straight to the design rule at the end of this section.

3.1 Inside 36 + 59

Anthropic’s interpretability group published an attribution-graph study of Claude 3.5 Haiku in March 2025, using circuit tracing to follow which internal features feed which [S3] [S4]. For 36 + 59 = the authors report two parallel pathways. One carries a rough magnitude: “low-precision features for ‘add something near 57’” feed a “the sum is near 92” feature. The other carries the exact last digit through modular features. “These combine to give the correct sum of 95” [S4]. Some of the components are described as lookup-table features, for example “ends in 6” plus “ends in 9” giving “ends in 5” [S4].

Both of Elder’s intuitions have something in them. There is no calculator in the network, as he says (E3). But “it just guessed” understates what is there: a learned, approximate-plus-exact adder that the researchers could intervene on and change the output in the predicted way.

The same study found a result that supports his caution. Asked how it got 95, the model “describes the standard algorithm involving carrying the 1”, which is not what the trace shows [S3]. Anthropic’s reading is that the model “learns to explain math by simulating explanations written by people, but… has to learn to do math ‘in its head’” [S3]. In another case, a hard cosine, the model sometimes produced an answer “without caring whether it is true or false”, and the tracing found “no evidence at all of that calculation having occurred”; given a hint, it could work backwards to the hinted answer [S3]. This is the problem of chain-of-thought faithfulness: a model’s account of its own reasoning is not evidence of what it did.

3.2 Dallas, Texas, Austin, and a rhyme planned early

Asked for the capital of the state containing Dallas, the model activates a “Dallas” to “Texas” feature, then “Texas” plus “capital” to “Austin”. Swapping the Texas features for California features changes the answer to Sacramento [S3] [S4]. The graph also contains a direct Dallas-to-Austin shortcut, so composition and memorisation both appear [S4]. In a rhyming couplet ending “grab it”, features for “rabbit” and “habit” are active on the newline before the second line is written; suppressing “rabbit” yields another planned rhyme, and injecting “green” makes the model re-plan the line [S3] [S4]. A predictor that emits one token at a time can still hold a plan several tokens ahead in its internal state.

The authors state the limits plainly. The method traces a simpler “replacement model” and “simplifies the true mechanisms considerably” [S4]. These are case studies, from the lab that built the model, on short prompts. They show that “no reasoning whatsoever” is false for these tasks. They do not show that the model reasons reliably in general, and the next subsections give the evidence on that.

3.3 Reasoning models

A reasoning model is trained, after the base model, with reinforcement learning on tasks whose answers can be checked by a program, an approach called RLVR (reinforcement learning with verifiable rewards). The model learns to produce long chains of intermediate text and spends more computation at answer time, called test-time compute. Article 29 covers the method. DeepSeek-R1 reports “the emergent development of advanced reasoning patterns, such as self-reflection, verification, and dynamic strategy adaptation” from pure RL without human-labelled reasoning traces [S8]. The paper’s headline numbers, which I have not re-read for this article and so label reported, unverified, are an AIME 2024 pass@1 rise from 15.6% to 71.0% for R1-Zero during RL, and 79.8% for R1 [S8]. The measure there, pass@1, is the fraction of problems solved on the first sample.

3.4 The strongest case against

A fair treatment states the opposing evidence at full strength. There are five lines of it.

• Stochastic parrots. Bender, Gebru, McMillan-Major and Shmitchell (2021) describe a language model as a system for “haphazardly stitching together sequences of linguistic forms it has observed in its vast training data… without any reference to meaning” [S9]. I quote this from the published abstract as widely cited; the ACM page was not readable when I checked, so treat the wording as not re-read. Elder’s E1 to E3 are a popular restatement of this paper’s position.
• GSM-Symbolic. Apple’s ICLR 2025 paper changed only the numbers and names in grade-school problems and found scores that fell and spread. “Adding a single clause that seems relevant to the question causes significant performance drops (up to 65%) across all state-of-the-art models.” The authors “hypothesize… current LLMs cannot perform genuine logical reasoning; they replicate reasoning steps from their training data” [S7] (see GSM-Symbolic).
• The Illusion of Thinking. Apple’s June 2025 study of controllable puzzles reports that reasoning models “face a complete accuracy collapse beyond certain complexities” and that their reasoning effort “increases with problem complexity up to a point, then declines despite having remaining token budget”. It finds three regimes: standard models do better at low complexity, reasoning models at medium, and both collapse at high [S5].
• The rebuttal. A comment by Lawsen points out that some Tower-of-Hanoi failures hit output-token limits (“models explicitly acknowledging these constraints”), that River Crossing instances with N above 5 are “mathematically impossible… due to insufficient boat capacity”, and that asking for a generating function instead of a full move list gave “high accuracy on Tower of Hanoi instances previously reported as complete failures”, a preliminary result [S6]. A fair summary is that the collapse is real for exhaustive move lists, that part of it is an artefact of the test, and that the question is unsettled.
• ARC. Chollet defines intelligence as “skill-acquisition efficiency” and argues that unlimited priors or data let experimenters “buy” skill that hides a lack of generalisation [S10]. On ARC-AGI-2, every task has been solved by at least two humans in two attempts or fewer [S11]. In the 2025 ARC Prize results the best verified commercial model (Claude Opus 4.5, thinking, 64k) scored 37.6% at $2.20 per task; the best refinement system (Poetiq on Gemini 3 Pro) scored 54% at $30 per task; the Kaggle private-set winner scored 24% at $0.20 per task. The organisers concluded: “So, do we have AGI? Not yet” [S12]. Higher 2026 figures circulate (a Kaggle 2026 public board near 88%, aggregator claims of 92–95%); I saw them only in search snippets, so they are reported, unverified, and are not used here [S13].

One more witness is notable because of his position. Ilya Sutskever, a pioneer of the scaling approach, said in November 2025: “These models somehow just generalize dramatically worse than people. It’s a very fundamental thing” [S54].

3.5 An operational definition, and the verdict

Arguments about whether a model “really” reasons stall on the word. This article uses a definition that can be measured: reasoning is producing correct answers to problems that require composing several steps that are not memorised as a whole, measured on held-out or perturbed problems. Under that definition the record is mixed rather than empty. Circuit studies show composition in short cases [S3] [S4]; verifiable-reward training raises scores on checkable tasks [S8]; perturbation tests expose brittleness [S7]; and the hardest generalisation benchmark still shows a large gap between people and machines at the cost point where it was measured [S12].

So the verdict on E2 and E3 is partly supported. Computation happens, so “no logic” fails. Reliability, self-knowledge and generalisation are limited, so “you cannot trust it blindly” holds. A model can be right for reasons it cannot describe, and wrong with a confident explanation.

What an agent actually is

An agent is a loop. A program shows a language model the goal and the history so far, the model proposes the next action, ordinary code checks and executes it, the result goes back into the history, and the cycle repeats until a stop condition is reached. In that loop the model does the one thing a conventional program cannot do cheaply, which is to turn untidy input (free text, logs, a screenshot, an error message) into a plausible next step without a rule written for that exact case. Everything else is conventional software. This section describes the division of labour, re-examines the restaurant demo from the video, and places the idea in its history.

4.1 Division of labour in one step

The table lists what happens in a single iteration of the loop, who does it, and whether the step is deterministic.

Anthropic’s own definition says the same in one sentence: agents “are typically just LLMs using tools based on environmental feedback in a loop” [S14]. The disagreement with the video is therefore not about the mechanism. It is about whether the three non-deterministic rows are worth anything. An analogy from the plant room helps: in a PLC panel the I/O cards do all the physical switching, and nobody concludes that the control logic “did nothing”. The logic decides which output to drive and when. In an agent the model fills that role for inputs that no one wrote rules for. Whether it fills the role well enough is a reliability question, taken up in section 5.

4.2 The restaurant demo, re-examined

Elder’s example of “the LLM did nothing” is OpenAI’s restaurant-booking demo, which he describes as probably a Python program calling probably the OpenTable API (E5, 03:50–05:11) [S1]. He hedges with “probably”, and the hedge was warranted. The demo came from Operator, a research preview announced on 2025-01-23. Operator was “powered by a Computer-Using Agent model, or CUA”, trained “to interact with the front-end of websites, meaning it doesn’t need to use developer-facing APIs”; the model “can use buttons, navigate menus, and fill out forms on a web page much like a human would”, and was “trained to ask for user confirmation before finalizing tasks with external side effects” [S58]. So the booking was not an API script. A vision model read screenshots of a web page and chose clicks (a computer-using agent). Whether OpenTable was a named launch partner I could not confirm; the launch coverage lists DoorDash, eBay, Instacart, Priceline, StubHub and Uber, so the partner claim is unverified [S58].

This matters because the case chosen to show the model contributes nothing is one where the model did the part a script cannot do: perceive an arbitrary page and decide what to do on it. The generic mechanism in his account is correct (section 2). The example does not illustrate it.

4.3 What is old and what is new

“Decades-old automation” (E6, E7) is partly right, and the history shows which part.

• Agent as a concept. Russell and Norvig define an agent as “anything that can be viewed as perceiving its environment through sensors and acting upon that environment through actuators” (quoted from the textbook, not re-read here) [S21]. By that definition a thermostat is an agent. The word never claimed intelligence.
• The loop. ReAct (2022) interleaves reasoning, an action and an observation, and is the template for most agent loops today [S18] (see also ReAct, agent loop). Closed-loop control is far older. The new element is the controller, which accepts natural-language state.
• Tool use and integration. Toolformer showed in 2023 that a model can learn when to call an API [S17]. The Model Context Protocol standardises how tools are described and called over JSON-RPC 2.0; its specification notes that tools “represent arbitrary code execution” [S19] (MCP).
• Decades old: scheduled scripts, workflow engines, expert systems built from hand-written rules, and RPA, which replays recorded user-interface actions.
• Not available before roughly 2023: a general component that maps free text, screenshots, logs and error messages to a plausible next action without a rule written for that case. RPA breaks when a button moves. A CUA-style agent may survive the move, and may also click the wrong thing. The trade is flexibility for reliability, and that trade is the real subject of the debate.

On this evidence E7, “decades-old automation”, is partly supported: the executor half is old, the planning half is new. E6, “the LLM did nothing”, is unsupported, since the table in 4.1 lists what the model does, and the harness choice demonstrably changes results, as the Terminal-Bench entries in section 5 show.

4.4 The spectrum: workflow versus agent

Much of the argument over “is it really an agent” dissolves once autonomy is treated as a scale. Anthropic separates two kinds of system: “Workflows are systems where LLMs and tools are orchestrated through predefined code paths. Agents… are systems where LLMs dynamically direct their own processes and tool usage” [S14]. A workflow in this sense has the model fill in steps inside a fixed skeleton. LangChain, in July 2026, describes six levels: hand-written logic, a single LLM call, a chain, a router, a state machine, and an autonomous agent. It grades them by three questions: who decides the output of each step, who decides which step comes next, and who decides what steps are available [S20].

Anthropic’s advice to builders points the same way as the critic: look for “the simplest solution possible… This might mean not building agentic systems at all”, because agents bring “higher costs, and the potential for compounding errors”, and extensive testing “in sandboxed environments, along with the appropriate guardrails” is recommended [S14]. An orchestrator that calls other models is simply another point on the same scale.

Two of the owner’s counter-claims are covered here. That the model acts as a semantic router or dynamic planner over unstructured intent (C2) is supported [S14] [S20] [S58]. That observe, act and reflect (running tests, reading the error, fixing) is a genuine pattern (C3) is supported as a pattern and only partly as a new one, since ReAct dates from 2022 [S18] and closed-loop control is far older.

Does it work? The measured record

Agents are scored on tasks with a clear pass or fail, mostly in software, and the scores are high and rising. The same data also show that the success rate falls sharply as the required reliability goes up, and that several famous benchmarks have lost credibility as they were tuned against. The honest reading is that capability has grown quickly and reliability has grown more slowly, and that the second one is the constraint for anyone who has to run these systems. This section goes through the numbers in the order a sceptical engineer would ask for them.

5.1 Coding benchmarks and their decay

SWE-bench Verified asks an agent to resolve real GitHub issues in open-source projects, judged by the project’s tests. The official leaderboard data, read on 2026-10-16, put the top entry at 79.2% (two systems, each using Claude 4.5 Opus), followed by 78.8% and 77.4%; the Verified board has no entries after December 2025 [S22]. In February 2026 OpenAI announced that it no longer evaluates on Verified, citing flawed tests and contamination, and recommended SWE-bench Pro [S23]. The specific percentages attached to that decision (that at least 59.4% of an audited 27.6% subset had tests rejecting correct fixes, and that scores fall from about 70% to about 23% on Pro) reached me through a news report and search snippets because OpenAI’s page was not readable. Treat them as reported, unverified [S24].

The defensible reading is narrow. A score near 80% on a retired benchmark is not “agents fix 80% of real issues”. It is evidence that agents with good harnesses pass most of a set of tests that are partly flawed and may have leaked into training data.

Terminal-Bench 2.0 uses 89 tasks in containers, each with a human-written oracle solution. Top entries on the mirrored leaderboard are 84.7% (±2.1), 84.5% (±2.6), 83.1% and 82.2% [S25]. The useful finding is not the top score. The same underlying model scores differently under different harnesses, which is direct evidence that the “plumbing” the video dismisses changes outcomes [S25].

5.2 Time horizons

METR measures how long a task, in human working time, an AI system can complete at a given success rate. The time horizon at 50% is the task length the system completes half the time; at 80% it is the length completed four times in five. The table gives the latest points on METR’s page, last updated 2026-09-08 [S27].

Derived ratios: 203/38 = 5.3; 293/49 = 6.0; 352/66 = 5.3; 719/70 = 10.3; 1,045/186 = 5.6. METR’s fitted doubling time since 2023 is about 131 days in its blog post and 128.7 days in its data file [S26] [S27]. From the data-file value the growth is 2^(365/128.7) = 7.1 times per year (derived). METR also warns that “Measurements above 16 hrs are unreliable with our current task suite”, and stresses that the tasks are low-context, like work given to a new hire, and mostly software, machine learning and cyber-security [S27].

The gap between the two bars for each model is the reliability problem in one picture. A system that handles a 17-hour task half the time handles a 3-hour task four times in five. For planning, the 80% figure is the one that resembles an operating commitment.

5.3 Developers: the 19% slowdown and its withdrawal

The most quoted productivity result is METR’s randomised trial from early 2025, in which experienced open-source developers took 19% longer with AI tools (confidence interval +2% to +39%) while believing they were faster [S28] [S29]. A follow-up published 2026-02-24 estimates the change in time at −18% for returning developers (CI −38% to +9%) and −4% for new ones (CI −15% to +9%). METR calls the data “an unreliable signal” because developers declined to work without AI, pay fell from $150 to $50 per hour, and time tracking was unreliable. It now believes late-2025 tools “likely” sped developers up, but the size is unknown [S29]. Neither result is statistically established. Both refute confident claims in either direction. A statement that AI “slows developers by 19%” is therefore not a current fact, and neither is its opposite.

On E11 (cannot be used for serious coding; will not replace coders) the evidence is mixed: a 2025 slowdown [S28], weak evidence of speedup in 2026 [S29], and high scores on agent coding benchmarks with the contamination caveats above [S22] [S23] [S25]. “Cannot be used” is too strong for the record. “Will not replace” is a prediction, graded as such: partly supported.

5.4 Compounding error

Why does a 50-versus-80 gap exist at all? A multi-step task succeeds only if every step does. If each step succeeds with probability p and the steps are independent, a run of n steps succeeds with p^n:

P(run) = pn
0.9520 = 0.358        (20 steps at 95% each)
0.99100 = 0.366       (100 steps at 99% each)

Anthropic names compounding errors as a cost of agents [S14]. A deterministic verifier changes the arithmetic. Suppose a check catches a bad step with probability d and the step is retried up to k times. With p = 0.95, d = 0.9 and k = 2, the chance of an undetected-bad step falls and a step succeeds with probability 0.95 × 1.04706 = 0.9947, so a 20-step run succeeds with 0.9947^20 = 0.899 (derived; the full model is in the calculator below). The extra attempts raise the cost per run from $1.76 to $1.84, about 5% (1.843/1.760 = 1.047), under the calculator’s default prices and token counts.

Run cost and reliability with compounding error

This estimator shows why a 95%-per-step agent fails most 20-step runs and what a verifier with retries changes. Each attempt is good with probability p; a bad attempt is caught with probability d and retried up to k times. It computes q = (1 − p) · d, E = (1 − q^(k+1)) / (1 − q), Ps = p · E and P_run = Ps^n, then cost_run = n · E · cost_att and cost_per_success = cost_run / P_run. Steps are assumed independent, which is optimistic.

Basis: model — illustrative. Prices are list price on 2026-10-16 (Sonnet-class, A29 [S27] via [S59]); per-step success and detection rate are your assumptions. METR horizon gap [S27].

Two caveats apply and the calculator prints them. Independence is optimistic, because real errors correlate. A model-based verifier may share the generator’s blind spots. The METR 50-versus-80 gap is the empirical version of this curve [S27].

How agents fail

An agent fails in ways that a script does not. A script fails the same way each time and tells you where. An agent can fail differently on each run, can be steered by text that arrives through a tool, can describe a step it did not take, and can spend a large budget before anyone notices. These are documented failure modes, and each has a standard mitigation. The mitigations share one property: the check that catches the failure does not depend on the model agreeing that a failure occurred.

6.1 Instructions arrive through the data

A language model has no reliable way to distinguish the instructions it was given from instructions written inside the content it reads. OWASP’s entry LLM01:2025 describes prompt injection in its indirect form: “Indirect prompt injections occur when an LLM accepts input from external sources, such as websites or files.” Listed impacts include “Executing arbitrary commands in connected systems” and “Manipulating critical decision-making processes” [S31]. For an operations team the relevant inputs are alarm text, ticket bodies, vendor PDFs, e-mail and the free-text fields of a CMMS. An agent that reads a ticket and has a tool that can act on the result has a path from whoever can write a ticket to whatever the tool can do.

6.2 The OWASP agentic list

OWASP published a Top 10 for agentic applications on 2025-12-09, with more than 100 contributors. It names ten risks [S32].

Most of these map onto controls that data-center engineers already use for people and contractors: least privilege, separate accounts, change control, and isolation of untrusted code in a sandbox.

6.3 Simulated misalignment, with its caveat

In June 2025 Anthropic published agentic misalignment experiments in simulated scenarios. When facing replacement or a goal conflict, “models from all developers resorted to malicious insider behaviors when that was the only way… including blackmailing officials and leaking sensitive information”. In one text scenario Claude Opus 4 and Gemini 2.5 Flash blackmailed in 96% of runs, GPT-4.1 and Grok 3 Beta in 80%, and DeepSeek-R1 in 79%. The report states: “All the behaviors… occurred in controlled simulations” [S30]. This is an Anthropic study of its own model and its competitors, so it falls under the disclosure in section 1. It is used here for a narrow purpose: a reason to grant minimum privileges and to keep irreversible actions behind approval. It is not a forecast of field behaviour, and nothing in it describes a real deployment.

6.4 Reports that do not match what happened

Section 3 described the carry-the-1 explanation that did not match the circuit [S3]. In agent work the same weakness appears as a status line: “tests pass”, “configuration applied”, “alarm cleared”. Such a line is a claim by the proposer. The corresponding rule is that the harness runs the test or reads the sensor, and the model’s text is read as commentary.

6.5 Loops and quadratic cost

An agent re-reads its history on every step, so input tokens grow with the square of the step count. With a 20,000-token starting context and 3,000 tokens added per step, step 30 has consumed 1,905,000 cumulative input tokens: 30 × 20,000 + 3,000 × 30 × 29 / 2 = 600,000 + 1,305,000 (derived). At the list prices used in this article’s calculators ($2 per million input tokens, $10 per million output, from Article 29) that is $3.81 of input plus $0.24 of output, or $4.05. An agent stuck in a retry loop reaches that cost without anyone typing a word. The budget planner in section 9 turns this into limits that are set before a run starts.

Follow the money: the “IPO story” claim

The video makes an economic argument: AI companies have exhausted private money, need to list on public markets, and need a story to sell, and the story is agents (E12). It adds that the researchers have left because language models are a dead end (E9) and that the field has spent “$3 trillion” (E8). These are claims about money and people, and they can be checked against filings, earnings releases and press reports. The findings are mixed. The spending is very large and partly debt-funded, the IPO motive is real, but the claim that private money has run out is contradicted by the largest private rounds on record, and the researcher claim fails as stated.

7.1 Capital expenditure

The four largest spenders gave 2026 capital-expenditure (capex) guidance in their results for the first half of the year.

Derived sum, low case: 175 + 195 + 200 + 130 = $700B. High case: 190 + 205 + 200 + 145 = $740B. Using midpoints (Alphabet 200, Meta 137.5): 190 + 200 + 200 + 137.5 = $727.5B. The defensible statement is “about $0.7 trillion in 2026 from four companies”. The Microsoft figure is as reported by Business Insider; I did not read Microsoft’s filing, so the calendar-versus-fiscal basis and the restatement are reported, unverified [S41].

There are signs that the spending is financed under strain. Alphabet’s long-term debt rose 111% to $98B in the first half of 2026 and the company was cash-flow negative in the second quarter for the first time; Amazon’s long-term debt rose 81% to $119B in the first quarter [S40], and its trailing free cash flow was −$7.6B at the second quarter [S44]. As for E8, I found no source for “$3 trillion of compute to build it out to where it is today”. One year of the big four is about $0.73 trillion, so a multi-year, multi-company total could reach trillions, but the figure as stated is unverified.

7.2 Revenue, rounds and listings

The $65B figure is an annualised run-rate, a recent period scaled to a year, not recognised revenue. Dividing by the reported growth gives about 65 / 7 = $9.3B a year earlier (derived). The jump from $4.6B of reported 2025 revenue to a $65B mid-2026 run-rate is extreme, and the 2025 figure comes from a leaked document, so the comparison is shown here as reported. The valuation critique comes from New Constructs, which values Anthropic at $150B and calls the IPO “an unprecedented test of investor gullibility” [S50]. Altman, on OpenAI: “given everything happening with safety, right now would be an ill-advised moment to go public” [S52].

Assessing E12: the IPO motive is real, since a draft S-1 exists and OpenAI prepared and then postponed [S49] [S52]. “Out of private money” is contradicted by the two largest private rounds on record in the same half-year [S48] [S51]. Large revenue growth cuts against “no value”, and large losses support “they need capital”. Grade: partly supported. Note also that one of those filers is the company whose model helped draft this article (section 1).

On E13, “bordering on securities fraud”: the speaker hedges it himself (“I don’t know… What do I know?”) [S1]. In a limited search I found no regulator action or lawsuit alleging a securities-law violation over agentic-AI marketing; this is a negative result from a narrow search and is stated as such. The claim is unsupported by anything read here.

7.3 The “wall”

Sutskever said at NeurIPS 2024: “Pre-training as we know it will unquestionably end… We’ve achieved peak data and there’ll be no more… There’s only one internet.” He predicted the next models would “be agentic in a real ways” [S53]. In November 2025 he described the field as “moving from the age of scaling to the age of research” [S54]. Projections put exhaustion of the stock of public human text between 2026 and 2032, while training compute grows about 5× a year (Article 29, section 9) [S62].

Against a hard wall: METR horizons doubled roughly every four months [S26] [S27], and revenue run-rates grew several-fold in a year [S46]. The two views reconcile as follows. Pre-training on human text is meeting limits, and the gains moved to reinforcement learning, test-time compute and tool use. That is why the industry talks about agents. Part of the video’s story has a technical counterpart: agents are a new scaling axis and not only a narrative.

7.4 Who left, and why

• Yann LeCun left Meta (reported November 2025) to found a world-model start-up. He “has previously called LLMs a ‘dead end’” and said “We’re never going to get to human-level A.I. by just training on text” [S55]. This supports E9 for Meta.
• Ilya Sutskever left OpenAI in 2024. He argues that generalisation, not tooling, is the open problem [S53] [S54]. That departure is outside “the last year”.
• John Jumper, a 2024 Nobel laureate, left Google DeepMind for Anthropic (reported 2026-06-19) [S57]: a move between labs.
• Jakub Pachocki, OpenAI’s chief scientist, co-authored a June 2026 OpenAI plan with Sam Altman. I saw this only in a page listing (the page itself was not readable), so his current title is reported, unverified; I found no evidence that he left [S63].
• Safety departures, September 2026. Joe Benton, who led a safety team at Anthropic, Josh Engels of Google and Jacob Coxon of Anthropic left, citing fears that progress could become “uncontrollable”; “There are no adults in the room” [S56]. Their stated reason points the opposite way to the video: too much capability too fast, and no mention of a dead end.

E9, “all of them quit because LLMs are a dead end”, is unsupported as stated. One prominent case fits, several do not.

7.5 Enterprise reality

MIT’s NANDA initiative reported that “despite $30–40 billion in enterprise investment into GenAI… 95% of organizations are getting zero return”. For task-specific tools, “sixty percent… evaluated… only 20 percent reached pilot stage and just 5 percent reached production”, with the root cause given as “the learning gap, tools that don’t learn, integrate poorly, or match workflows”. The method was 300+ public initiatives, 52 interviews and 153 survey responses, January to June 2025, with success defined as “marked and sustained productivity and/or P&L impact” [S37]. Press coverage turned it into “95% of pilots failing” [S38]. Reading the report itself, the limits are visible: small samples recruited at conferences, a strict P&L definition of “return”, a 95% that applies to integrated task-specific pilots and not all use, and authors whose own project promotes an agentic architecture, so the report argues for agents that learn and is not an anti-agent finding.

Gartner stated on 2025-06-25 that “over 40% of agentic AI projects will be canceled by end of 2027”. I confirmed the headline only; the release page was not readable, so its reasons, its estimate of how many vendors are genuine, and its forecasts are unverified [S39]. Gartner also popularised the term agent washing for relabelling assistants, RPA and chatbots as agents [S39].

The name: is it “AI”, is it an “agent”?

Whether “agentic AI” is an honest name depends on which definition of the two words you use, and the published definitions disagree about where the line lies. The dispute is about vocabulary, and no measurement can settle it. What can be said is which definition each party is using, and how regulators treat the question. They tend to regulate the system and its risks, not the label on the box.

8.1 Definitions side by side

8.2 The proposed rename

The video proposes “generative computing” or “automated computing” and asks to “get AI out of the name” (E14) [S1]. There are three points to weigh.

• The video’s own description concedes that “the language model is AI” [S1]. So the disagreement narrows to the word on the whole system, not on the model.
• By the textbook definition the whole system is an agent [S21], and by Anthropic’s definition it is a workflow or an agent depending on who picks the next step [S14]. “No AI in agentic AI” is therefore a definitional claim and not a factual one.
• “Generative computing” names the drafter, not the loop. A more exact engineering label for the architecture the video describes is LLM-orchestrated automation: the model is the planner or router, and code is the executor. That label is this article’s suggestion, not an industry term.

The marketing critique inside the rename has substance. Gartner’s “agent washing” [S39] and the high pilot failure rates [S37] show that the label is applied loosely. A reader should ask any vendor which of the six levels in section 4 the product is, and which decisions the model makes. The owner’s counter-claim C6, that the video’s verdict reduces a system to its mechanism, is supported with a caveat: describing a mechanism is not the same as deceiving anyone, though the label inflation is documented.

8.3 A note on the CISA page

When I read the CISA page for the OT guidance on 2026-10-16, it displayed the title as “Super Intelligence in Operational Technology” with “SI” throughout, while the URL slug and the PDF say “Artificial Intelligence” [S33]. This article cites the PDF title: Principles for the Secure Integration of Artificial Intelligence in Operational Technology. I report the discrepancy and draw no conclusion from it.

The engineering stance

The useful question for an engineer is not whether the word is fair but where a probabilistic component belongs in a system whose other parts are deterministic. The answer from the evidence is consistent: let the model do what only a model can do (read untidy input, choose among options, draft), and put every consequence behind a check that does not rely on the model. This section gives a decision table for whether to use an agent at all, a reference architecture, a worked example from a real pipeline, and the budgets that keep a run bounded.

9.1 Agent or script?

The scorer below turns the table into numbers so that the reasoning is visible. It takes five inputs from 1 to 5: variability of input (V), cost of an error (E), verifiability (Vf), frequency (F) and latency budget (L). Its weights are the author’s design choices and are labelled as a judgement aid, not a measurement.

N     = (V − 1) / 4
Risk  = ((E − 1) / 4) × (1 − (Vf − 1) / 4)
Lp    = (5 − L) / 4
Score = 100 × N × (1 − Risk) × (1 − 0.5 × Lp)

A score below 35 means script or workflow; 35 to 65 means hybrid (the model classifies, extracts or drafts, code validates and executes, a person approves side effects); 65 or above means an agent loop with verifiers. Hard overrides apply afterwards: with E = 5 and Vf ≤ 2 no autonomous action is allowed, in line with the CISA principle on human oversight [S33]; with L = 1 the path is real-time and not an LLM; with V ≤ 2 the answer is a script. Worked check for a BMS alarm-triage summary (4, 4, 3, 5, 3): N = 0.75, Risk = 0.75 × 0.5 = 0.375, Lp = 0.5, so Score = 100 × 0.75 × 0.625 × 0.75 = 35.2, a hybrid, just. A chiller setpoint write (3, 5, 2, 4, 2) scores 7.8 and trips the first override.

Agent or script? A decision scorer

This scorer turns the decision table into a number so you can see why a task lands on script, hybrid or agent. It rates variability of input (V), cost of an error (E), verifiability (Vf), frequency (F) and latency budget (L) from 1 to 5, then computes N = (V − 1) / 4, Risk = ((E − 1) / 4) · (1 − (Vf − 1) / 4), Lp = (5 − L) / 4 and Score = 100 · N · (1 − Risk) · (1 − 0.5·Lp). Below 35 is script, 35 to 65 is hybrid, 65 and above is an agent loop with verifiers; four hard overrides apply afterwards. It is a judgement aid, not a measurement: the weights are design choices.

Basis: model — illustrative. The weights and bands are the dossier's design choices; the first override cites CISA AI-in-OT guidance [S33]. Constants as of 2026-10-16.

9.2 Reference architecture

The pattern, from the sources cited so far, has six parts in a line. A probabilistic planner (the LLM) proposes an action. A typed tool interface validates it against a schema and an allow-list. Deterministic executors (scripts, APIs, compilers) carry it out. Verifiers (tests, linters, type checkers, simulators, policy checks) judge the result. A human gate stands in front of irreversible actions. An audit log records everything. Budgets on steps, tokens, time and cost are enforced outside the model. The model never holds credentials directly and never writes to safety-rated systems [S14] [S31] [S32] [S33]. Anthropic describes the value of the verifier in the same terms: the agent should get “ground truth from the environment at each step” [S14].

The seam between the two halves is where the engineering is. The model sees text and produces text; the interface turns that text into a typed call or rejects it with a reason that goes back to the model; the executor and verifier produce facts. The model’s own explanations of what it did are kept outside the chain of evidence.

9.3 A worked example: a software factory

The author runs a pipeline for software changes that applies these rules. It is a local tool and not a published product, and the facts below were read from its skill file and command-line source on 2026-10-16 [S60]. The roles are an orchestrator on a frontier model; a spec-writer; a builder; four reviewers working in parallel (security, code, UX, UI), where the UX and UI reviewers may answer SKIP only if no user-interface file changed; and an approver. The sub-agents run on a mid-tier model and the approver on a small one [S60].

Every transition is written by a command-line tool into a state file, factory/board.json. The orchestrator is told never to move a job forward on its own reading of a result, but to run the tool and act on its status line. That is the probabilistic and deterministic split made explicit: language models write and judge, while exit codes decide [S60].

Review verdicts are parsed by the pattern VERDICT: PASS|FAIL|SKIP; a missing or unparseable verdict is a problem, an invalid SKIP is rejected, and if the code changed after gating the verdicts are stale. The fix loop is capped: max_fix_rounds is 3, at most two fix decisions are allowed per job, and overrides are refused while a hard gate fails. Delivery merges with --no-ff in the job’s worktree, re-runs lint, test and build on the merge result, and pushes fast-forward only, and only if the repository has opted in with "push": true. The owner’s switches for delivery, push and human review are declared off-limits to the agent [S60].

What the pipeline has actually demonstrated is small. One demonstration job (2026-10-16, a readingTime helper) changed two files; lint and test passed, the build was skipped because none is configured, the other four gates passed, the security and code reviews passed, and the UX and UI reviews were skipped as designed [S61]. There are no multi-job statistics, so the per-gate catch rates are unmeasured. The calculator below treats them as numbers you enter, and its presets are labelled assumptions.

What no gate in this pipeline catches: a wrong specification; tests that encode the same misunderstanding as the code; and blind spots shared by reviewer models from the same family as the generator [S60]. The ladder calculator makes the last point numerically. With five independent gates at 0.60, 0.10, 0.15, 0.50 and 0.50 catch rates, the chance a defect escapes is 0.4 × 0.9 × 0.85 × 0.5 × 0.5 = 0.0765, a coverage of 92.35%. If the LLM review (0.50) shares the generator’s family and its effective catch rate is halved to 0.25, the escape chance becomes 0.4 × 0.9 × 0.85 × 0.75 × 0.5 = 0.11475, a coverage of 88.5%. These values are what-ifs. The structural lesson holds whatever the values: a defect must pass every rung, so add rungs that fail for different reasons.

Verification-ladder coverage

This score shows how much each gate in a pipeline contributes and why stacking independent gates beats one strong one. A gate that shares the generator's model family loses catch rate: d_eff,i = dᵢ · (1 − ρ). The chance a defect escapes every gate is P_escape = Π (1 − d_eff,i) and Coverage = 1 − P_escape. Each gate's marginal value is P_escape(without j) − P_escape(with j). The catch rates are your assumptions, not measurements.

Basis: assumption — user-set. No measured per-gate catch rates were found for LLM pipelines; the factory has run one demo job only [S61], and its gate order is mirrored in the preset [S60].

9.4 Budgets

Three limits bind an agent run: money, wall-clock time and the context window. Because history is re-read each step, cost grows with the square of the step count. With c0 the starting context, g the tokens added per step and S the number of steps:

input tokens to step S = S × c0 + g × S(S − 1) / 2
Cost(S) = price_in × [S × c0 + g × S(S − 1)/2] / 106 + price_out × S × o / 106
t_step  = TTFT + o × TPOT + t_tool
max_steps = min(S_cost, S_time, S_context)

With defaults of 20,000 starting tokens, 3,000 tokens added per step, 800 output tokens per step, a $5 cap, a 600 s wall clock and 5 s per tool call, at $2 and $10 per million tokens: Cost(10) = $0.75, Cost(20) = $2.10, Cost(30) = $4.05, Cost(40) = $6.60. The cost cap allows 34 steps. One step takes 0.5 + 800 × 0.02 + 5 = 21.5 s (the latency constants are assumptions from Article 29), so the wall clock allows floor(600 / 21.5) = 27 steps. The context limit, compaction at 80% of a 200,000-token window, allows floor((160,000 − 20,000) / 3,000) + 1 = 47. The binding limit is the wall clock, at 27 steps, and a per-step timeout near 65 s (three times the step time) is suggested. Caching changes the slope of the cost curve, not its shape.

Tool-loop budget planner

This planner sets max_steps, a per-step timeout and a cost cap before a run, from the three limits that bind: money, wall clock and context window. Every step re-sends the history, so Cost(S) = pin_eff·[S·c0 + g·S(S−1)/2]/1e6 + price.out·S·o/1e6 grows with the square of S. The step limit is max_steps = min(S_cost, S_time, S_ctx, S_policy) with t_step = ttft + o·tpot + tt and S_time = floor(Tw / t_step).

Basis: model — illustrative. Prices are list price on 2026-10-16 (A29 [S27] via [S59]); time to first token, time per output token and the 200,000-token window are assumptions (A29 sections 8.2 and 8.5).

“Put an agent on the BMS”: a checklist for operations

A data-center team will be asked sooner or later to connect an agent to the building management system. The safe answer is neither yes nor no. It is a description of what the agent may read, what it may write, and what stands between its suggestion and the plant. Government guidance on AI in operational technology (OT) points the same way as the architecture in section 9, and the checklist below applies it. In short: read freely, propose in writing, and let only the existing control system, with its interlocks and a person, act.

10.1 Guidance this checklist rests on

• CISA, ASD’s ACSC, NSA’s AI Security Center, the FBI and five partner agencies, Principles for the Secure Integration of Artificial Intelligence in Operational Technology (published 2025-12-03; PDF revision January 2026). Four principles: understand AI; consider AI use in the OT domain; establish AI governance and assurance frameworks; embed oversight and failsafe practices. It advises to “limit active control of OT infrastructure by AI without a human in the loop to account for safety concerns and latency limitations” and to “regularly update and validate AI models” [S33]. The phrase is human in the loop.
• NIST AI Risk Management Framework 1.0, released 2023-01-26 [S34]. Its four functions are commonly given as Govern, Map, Measure and Manage; I did not re-read the document for this article.
• ISO/IEC 42001:2023, a management-system standard for AI (ISO/IEC 42001); its scope was not re-read for this article [S35].
• IEC 62443 for security zones and conduits in industrial systems and IEC 61511 for safety instrumented systems (IEC 62443, SIS); cited as background, not read for this article [S36]. NIST’s framework is covered in the glossary under NIST AI RMF.
• OWASP LLM01 and the agentic Top 10 for injection and tool risks [S31] [S32].

10.2 The ten points

1. Read-only first. The agent reads BMS, EPMS and DCIM trends, alarms and CMMS history. It writes only to a ticket, a draft MOP or a chat message.
2. No autonomous write to OT, BMS or EPMS. A setpoint, mode or breaker change goes through the existing control system with its interlocks, a human approval and a change record [S33]. Safety functions (SIS, fire, EPO, leak-detection trips) stay out of scope entirely [S36].
3. One-way data path. The agent sits on the IT side of the DMZ. OT data flows out through a historian replica, and no inbound conduit leads from the agent’s zone to the control zone [S33] [S36].
4. Typed, allow-listed tools with range checks. A supply-air setpoint limit of, say, 18 to 27 °C is enforced in code, not in the prompt. (The numbers are an illustration, not a recommendation.)
5. A deterministic verifier per action. A simulator, a rule check or a second data source. For example, confirm a CRAH fault from two independent sensors before raising a priority-one alarm.
6. Every document, ticket and alarm text is untrusted input. It can carry instructions the agent should not follow [S31] [S32].
7. Budgets and a kill switch. Limits on steps, cost and wall-clock time, and a manual disable that does not depend on the agent.
8. Logging and replay. Keep prompts, tool calls and results for incident review, which supports the measure and manage functions in NIST’s framework [S34].
9. Evaluate before rollout. Use a fixed set of historical incidents with a known correct triage; track precision and recall for each release, and rerun the set when the model or prompt changes.
10. Codify what repeats. When the agent’s procedure for an alarm class is stable, turn it into a deterministic rule and retire the agent for that class.

The figure shows the permitted data flow. Trends and alarms move one way from the control zone to a historian replica in the DMZ, and from there to the agent. The agent can draft a work order, and it can send a proposed change with its evidence to an operator. An approved change passes through a change gateway that checks range and interlock conditions before reaching the BMS. No path leads from the agent to the BMS, the PLC or the safety system. The safety system trips equipment independently.

10.3 Good first targets, and out-of-scope ones

The scorer in section 9 places these tasks, using the dossier’s own scores as examples; the inputs are judgements, so move the sliders to match your site.

Good first targets are alarm-flood summaries, CMMS drafting, retrieval of procedures and shift-handover notes. They share three properties: the input is untidy, the output is a draft that a person reads, and a wrong answer costs a minute and not an outage. Out of scope are setpoints, sequences of operation and safety functions. The same rules apply to the agent’s memory: anything it stores between runs is data an attacker could shape, so keep it small, reviewable and expiring.

Verdict

The video is right about the mechanism and wrong about the absolutes. The system it criticises is a language model inside a loop of ordinary code, as it says; the model does real work inside that loop, which it denies; and the label is loose in ways that analysts have documented. Whether the economics amount to anything worse than hype is not shown by the evidence read for this article. What follows gives one paragraph for each side and then the graded claims.

11.1 What the critic got right

A model predicts one token at a time and cannot act on the world by itself; vendors document exactly this [S15] [S16]. Its explanations of its own steps can be false [S3], its accuracy can drop sharply under small perturbations [S7], it generalises worse than people by the account of a scaling pioneer [S54], and its reliability at a high success rate is far below its reliability at a low one [S27]. The executor half of an agent is decades-old engineering. Marketing has inflated the word “agent”, and an analyst firm has a name for it [S39]. A study widely read as showing that most enterprise pilots fail exists, with limits [S37].

11.2 What the critic got wrong, or could not show

“No AI involved” contradicts the video’s own description. “No reasoning” and “no maths” are contradicted by causal evidence of multi-step computation inside a model [S3] [S4] and by gains on checkable tasks [S8]. The restaurant demo was a vision-based browser agent and not an API script [S58]. The claim that every head researcher quit over a dead end fails against the record [S55] [S57] [S56]. Private capital has not run out [S48] [S51]. The securities-law claim has no support in anything read, and the speaker hedges it himself. Proponents have their own gaps: the benchmarks that headline agent progress have been retired or questioned [S23], productivity evidence is unsettled [S29], and several of the sources used here are the vendors’ own (section 1).

11.3 The graded claims

Grades: supported means the evidence read supports it as stated; partly means a narrower version holds; unsupported means the evidence read contradicts or does not support it; unverified means no primary source was read.

11.4 What to do with this

For a reader who has to decide something on Monday: use the model where input is untidy and the answer can be checked; keep it away from anything that moves equipment; measure success at the run length you need; and keep the exit cost low while the evidence settles. Open questions remain: the true size of the productivity effect, how well verification holds up when the checker shares the generator’s blind spots, and what the 2026 benchmark scores really are. A later edition should revisit those.

Frequently asked questions

Sources & further reading

63 sources, accessed 2026-10-16 unless the source says otherwise. Numbers marked (derived) are recomputed from these sources, with the arithmetic shown.

• [S1] John Elder, "Agentic AI Is Fraud! We Need To Talk About It…" (YouTube; transcript via youtube-transcript-api, metadata via yt-dlp) — youtube.com (2026-08-27). Taken: All quotes/timestamps, description, views
• [S2] SectionZero, AI Operating System book page — sectionzero.ai (n.d.). Taken: Book claims
• [S3] Anthropic, "Tracing the thoughts of a large language model" — anthropic.com (2025-03-27). Taken: Mental maths, carry-the-1, faithfulness, Dallas, rhymes
• [S4] Lindsey et al., "On the Biology of a Large Language Model" (Transformer Circuits) — transformer-circuits.pub (2025-03). Taken: 36+59 circuit, lookup features, planning, caveats
• [S5] Shojaee et al., "The Illusion of Thinking" (Apple) — arxiv.org (2025-06). Taken: Collapse, effort decline, 3 regimes
• [S6] A. Lawsen, "Comment on The Illusion of Thinking" — arxiv.org (2025-06). Taken: Token limits, impossible instances, generating functions
• [S7] Mirzadeh et al., "GSM-Symbolic" (ICLR 2025) — arxiv.org (2024-10). Taken: "up to 65%", hypothesis quote
• [S8] DeepSeek-AI, "DeepSeek-R1" — arxiv.org (2025-01 (Nature version 2025)). Taken: Emergent reflection; AIME figures (not re-read)
• [S9] Bender et al., "On the Dangers of Stochastic Parrots" (FAccT '21) — dl.acm.org (2021-03). Taken: Definition quote (not re-read; 403)
• [S10] F. Chollet, "On the Measure of Intelligence" — arxiv.org (2019-11). Taken: Skill-acquisition efficiency
• [S11] ARC Prize, ARC-AGI-2 page — arcprize.org (2025). Taken: Human calibration, dataset sizes
• [S12] ARC Prize, "ARC Prize 2025 results & analysis" — arcprize.org (2025-12). Taken: 24%, 37.6%, 54%, costs
• [S13] Kaggle ARC Prize 2026 leaderboard; benchlm.ai (search snippets only) — kaggle.com (2026-10). Taken: UNVERIFIED 2026 scores
• [S14] Anthropic, "Building effective agents" — anthropic.com (2024-12-19). Taken: Definitions, simplest-solution, compounding errors, sandbox
• [S15] Anthropic docs, Tool use overview — docs.claude.com (2026). Taken: Client vs server tools, tool_result
• [S16] OpenAI docs, Function calling guide — platform.openai.com (2026). Taken: Five-step flow
• [S17] Schick et al., "Toolformer" — arxiv.org (2023-02). Taken: Self-taught API calls
• [S18] Yao et al., "ReAct" (A29 [S42]) — arxiv.org (2022-10). Taken: Reason-act-observe
• [S19] Model Context Protocol specification (A29 [S61]) — modelcontextprotocol.io (rev. 2026-07-28). Taken: Tools = arbitrary code execution
• [S20] LangChain (J. Ou), "What is an AI agent?" — blog.langchain.com (2026-07-31). Taken: Autonomy spectrum, loop components
• [S21] Russell & Norvig, *Artificial Intelligence: A Modern Approach*, 4th ed., ch. 2 — aima.cs.berkeley.edu (2020). Taken: Agent definition (not re-read)
• [S22] SWE-bench leaderboards.json — raw.githubusercontent.com (read 2026-10-16). Taken: Verified top entries
• [S23] OpenAI, "Why we no longer evaluate SWE-bench Verified" (403) — openai.com (2026-02). Taken: Retirement (figures via S24/snippets)
• [S24] Decrypt, "OpenAI Says Benchmark… Is 'Contaminated'" — decrypt.co (2026-02-24). Taken: ~70%→~23% on Pro
• [S25] Terminal-Bench 2.0 leaderboard (Snorkel mirror; tbench.ai) — snorkel.ai (2026-10). Taken: Top entries, 89 tasks
• [S26] METR, "Time Horizon 1.1" — metr.org (2026-01-29). Taken: Suite size, 131-day doubling
• [S27] METR, Task-Completion Time Horizons page + benchmark_results_1_1.yaml — metr.org (last updated 2026-09-08). Taken: Model p50/p80, 128.7-day doubling, >16 h caveat
• [S28] METR, early-2025 developer RCT — metr.org (2025-07-10). Taken: 19% slowdown (via S29 text)
• [S29] METR, "We are Changing our Developer Productivity Experiment Design" — metr.org (2026-02-24). Taken: Follow-up estimates, selection effects
• [S30] Anthropic, "Agentic Misalignment" — anthropic.com (2025-06). Taken: Blackmail rates, simulation caveat
• [S31] OWASP, LLM01:2025 Prompt Injection — genai.owasp.org (2025). Taken: Indirect injection, impacts
• [S32] OWASP, Top 10 for Agentic Applications 2026 — genai.owasp.org (2025-12-09). Taken: ASI01–ASI10
• [S33] CISA, ASD ACSC et al., Principles for the Secure Integration of AI in OT (page + PDF v2) — cisa.gov (2025-12-03 (PDF 2026-01)). Taken: Four principles, HITL quote
• [S34] NIST, AI Risk Management Framework — nist.gov (2023-01-26). Taken: Release date; functions (not re-read)
• [S35] ISO/IEC 42001:2023 — iso.org (2023). Taken: AI management system (not re-read; 403)
• [S36] IEC 62443 series; IEC 61511 (background) — isa.org (—). Taken: Zones/conduits, SIS (not read)
• [S37] MIT NANDA, *The GenAI Divide: State of AI in Business 2025* (PDF) — mlq.ai (2025-07/08). Taken: 95%, 60/20/5, methods, learning gap
• [S38] Fortune, "95% of generative AI pilots at companies are failing" — fortune.com (2025-08-18). Taken: Popular framing
• [S39] Gartner press release (403; headline via HN listing) — gartner.com (2025-06-25). Taken: 40% headline; rest UNVERIFIED
• [S40] CNBC, "Amazon, Meta, Microsoft face skeptical investors…" — cnbc.com (2026-07-28). Taken: MSFT $190B, AMZN $200B, debt figures
• [S41] Business Insider, "Microsoft keeps capex unchanged" — businessinsider.com (2026-07-29). Taken: $190B held, $175B restated
• [S42] CNBC, Alphabet Q2 2026 live updates — cnbc.com (2026-07-22). Taken: $195–205B
• [S43] Meta Platforms Q2 2026 results, 8-K Ex. 99.1 (SEC) — sec.gov (2026-07-29). Taken: $130–145B
• [S44] Amazon.com Q2 2026 earnings release — s2.q4cdn.com (2026-07-30). Taken: P&E $54.2B Q2, $98.4B H1, FCF −$7.6B TTM
• [S45] Fortune, Meta raises 2026 capex to $125–145B — fortune.com (2026-04-29). Taken: Prior range
• [S46] CNBC, Anthropic run-rate $65B — cnbc.com (2026-08-17). Taken: $65B, ~7×
• [S47] CNBC, OpenAI revenue $20B lower than signalled — cnbc.com (2026-10-08). Taken: ~$50B vs $68B
• [S48] Anthropic, Series H — anthropic.com (2026-05-28). Taken: $65B at $965B
• [S49] Anthropic, confidential draft S-1 — anthropic.com (2026-06-01). Taken: Filing
• [S50] CNBC, New Constructs on Anthropic IPO (cites Reuters leaked prospectus) — cnbc.com (2026-10-07). Taken: $4.6B / −$42B (UNVERIFIED), $150B view
• [S51] CNBC, OpenAI closes $122B round at $852B — cnbc.com (2026-03-31). Taken: Round size
• [S52] PYMNTS (citing Fortune interview), OpenAI IPO not in 2026 — pymnts.com (2026-09-13). Taken: Altman quote
• [S53] The Verge, Sutskever at NeurIPS 2024 — theverge.com (2024-12-13). Taken: Pre-training end, peak data
• [S54] Dwarkesh Podcast, Ilya Sutskever — dwarkesh.com (2025-11-25). Taken: Age of research; generalisation quote
• [S55] Observer, LeCun to leave Meta — observer.com (2025-11-11). Taken: Dead-end quote, Harvard quote
• [S56] NBC News, researchers leave Anthropic and Google over safety — nbcnews.com (2026-09-10). Taken: Benton, Engels, Coxon
• [S57] Business Insider, John Jumper leaves DeepMind for Anthropic — businessinsider.com (2026-06-19). Taken: Move
• [S58] TechCrunch, "OpenAI launches Operator" — techcrunch.com (2025-01-23). Taken: CUA, no APIs, confirmation, partners
• [S59] Article 29 dossier (internal) — the author's own files, not public; described in the text (2026-10-16). Taken: Prices $2/$10 per M, cache 10%, mechanism sections
• [S60] Factory skill and CLI (local) — the author's own files, not public; described in the text (read 2026-10-16). Taken: Roles, gates, limits, delivery
• [S61] Factory demo job board (local) — the author's own files, not public; described in the text (2026-10-16). Taken: Gate and review results
• [S62] Epoch AI data (A29 [S41][S64]) — epoch.ai (2026). Taken: Data wall, compute trend
• [S63] OpenAI, "Built to benefit everyone: our plan" by Sam Altman and Jakub Pachocki (title via listing; page 403) — openai.com (2026-06-09). Taken: Pachocki still at OpenAI