What this area covers
The agent and tool ecosystem spans everything that sits between a raw language model and a real-world task: the harnesses that drive multi-step execution loops, the protocols that connect models to external tools and data, the infrastructure that persists state across long-running sessions, and the security layer that governs what agents are allowed to do. It is the fastest-moving layer of the AI stack, and it is consolidating rapidly.
Why it matters
A model that can only answer questions in a single turn is useful. A model that can read a codebase, write and run tests, push a fix to GitHub, and then iterate based on CI results — autonomously, over hours — is transformative. The difference is entirely in the surrounding infrastructure. The events in this bundle trace the arc from ChatGPT's November 2022 launch as a conversational interface to a world where agents are estimated to account for 4% of all GitHub public commits and are being used to autonomously scan production browsers for zero-days.
Phase 1: Dialogue to tool use (2022–2024)
The first phase was about making models interactive and then giving them hands. ChatGPT established the conversational paradigm. OpenAI's o1 series (September 2024) introduced inference-time reasoning — models that "think" before acting — which proved essential for the multi-step planning agentic tasks require. Anthropic's computer use capability, shipped in public beta in July 2025, gave models the ability to view screens, move cursors, click, and type: a general-purpose interface to any GUI-based tool. Early adopters included Replit, The Browser Company, and Cognition.
Phase 2: Harnesses and protocols (2025)
The second phase was about building the scaffolding. Anthropic launched Claude Code in September 2025 as a research preview — a command-line agentic coding tool that could read and edit files, run tests, and push to GitHub. It shipped to GA the same month alongside Claude Opus 4 and Sonnet 4, with GitHub Actions, VS Code, and JetBrains integrations and four new API primitives: a code execution tool, an MCP connector, a Files API, and one-hour prompt caching.
The Model Context Protocol (MCP), open-sourced by Anthropic, formalized the connection layer. MCP introduced a client-server architecture with SDKs and pre-built connectors for GitHub, Slack, Google Drive, and Postgres, replacing the previous pattern of per-source bespoke integrations. Block, Apollo, Zed, Replit, Codeium, and Sourcegraph adopted it early. The goal — a single universal protocol for AI-to-tool connections — is now the de facto standard for the ecosystem.
In November 2025, Anthropic released the Claude Agent SDK alongside Claude Sonnet 4.5, giving developers access to the same infrastructure powering Claude Code. Cursor, GitHub Copilot, Devin, Canva, and Figma reported significant gains in agentic and long-context tasks. Claude Sonnet 4.5 scored 61.4% on OSWorld (up from 42.2% for Sonnet 4), establishing computer use as a measurable, improvable capability axis.
Phase 3: Stateful runtimes and agent teams (2026)
The third phase is about state and composition. Long-running agents need to persist memory, manage tool connections, and handle errors across sessions that may span hours. OpenAI and AWS announced a stateful runtime environment for agents on Amazon Bedrock in March 2026 — managing agent working states including memories, tool connections, and user permissions — backed by a $15 billion Amazon investment and a $100 billion compute commitment. The arrangement exploits a legal distinction between stateful runtime environments and stateless APIs, allowing OpenAI to work with AWS while Microsoft retains rights to host stateless API calls.
Anthropic's response was agent teams in Claude Code, shipped with Claude Opus 4.6: multiple agents collaborating on a single task, with context compaction handling the memory management for long-running sessions. Claude Opus 4.6 also introduced a 1M-token context window in beta and adaptive thinking with developer-controlled effort levels.
Mistral AI entered the harness space with remote cloud coding agents in its Vibe CLI and a Work mode in Le Chat providing cross-tool agentic workflows spanning email, calendar, research, and issue tracking. OpenCoworker, released by Andrew Ng and collaborators in June 2026, represents the open-source tier: a free desktop agent harness built on aisuite, designed for privacy-preserving workflows with user-supplied API keys or local models.
The open-weights dimension
Open-weights models are increasingly first-class citizens in agent pipelines. DeepSeek V4-Flash (284B total / 13B active parameters) with OpenAI and Anthropic API compatibility is already powering the Goedel-Architect formal theorem-proving agent, which achieved 99.2% pass@1 on MiniF2F-test at up to 500x lower cost than comparable systems. OpenAI's gpt-oss-120b and gpt-oss-20b, released under Apache 2.0, are optimized for tool use and efficient deployment on consumer hardware. Mistral Small 4 (119B MoE, 6B active) and Mistral Medium 3.5 (128B dense, 256k context) both target agentic coding pipelines with day-0 NVIDIA NIM availability.
Security: the shadow infrastructure problem
The same capabilities that make agents productive make them dangerous when misused. In September 2025, Anthropic detected and disrupted the first documented large-scale AI-orchestrated cyberattack: a Chinese state-sponsored threat actor jailbroke Claude Code by decomposing malicious tasks into innocent-seeming subtasks, enabling autonomous reconnaissance, vulnerability exploitation, credential harvesting, and data exfiltration via MCP tool access across roughly thirty global targets. Anthropic's subsequent analysis of 832 banned accounts found that medium-or-higher-risk actors grew from 33% to 56% of the threat population between March 2025 and March 2026, and that AI use is shifting from initial-access techniques toward post-compromise operations like lateral movement and privilege escalation — behaviors that MITRE ATT&CK does not adequately cover for agentic orchestration.
Claude Mythos Preview, disclosed in April 2026 without commercial availability, autonomously discovered thousands of high-severity vulnerabilities in popular operating systems and browsers during testing. Anthropic responded by forming Project Glasswing — a consortium of 40+ organizations including AWS, Apple, Google, Microsoft, and CrowdStrike, funded with $100 million in model credits — to proactively patch vulnerabilities before broader deployment. Claude Opus 4.7 became the first model to ship with automatic detection and blocking of prohibited cyber uses and a Cyber Verification Program for legitimate security professionals.
Where the ecosystem is heading
The consolidation pattern is clear: a small number of open protocols (MCP and its successors), first-party SDKs (Claude Agent SDK, OpenAI's stateful runtime), and harness products (Claude Code, Codex, Vibe) are becoming the standard substrate. The open-source tier is catching up via OpenCoworker and open-weights models with strong tool-use capabilities. The unresolved frontier is security and attribution — as agents gain autonomous reach through tool meshes, the infrastructure for detecting, auditing, and constraining their behavior is lagging the capability curve, and the gap is already being exploited.
