Right now, agents have names. They get introduced at keynotes with their own brand identities. Enterprise software companies are marketing them as "AI teammates" you can @mention in a project tracker. One major vendor secured thousands of paid deals within months of launch. Another is folding agent capabilities into baseline subscriptions starting mid-2026, no separate license required. You won't buy the agent. It will just be there, running inside the tools you already pay for.
Underneath the branding, the infrastructure layer is forming. MCP and A2A have been donated to the Linux Foundation's Agentic AI Foundation. NIST launched its AI Agent Standards Initiative in February, targeting an interoperability profile by Q4 2026 and developing SP 800-53 control overlays for agentic systems. The stated goal: agents that "can interoperate smoothly across the digital ecosystem." Once agents operate via shared protocols across any vendor's stack, you stop choosing them. They're just there.
This is what successful technology does. It recedes. Electricity went from Edison's public demonstrations to building codes to something nobody thinks about. HTTPS went from a padlock icon you noticed to a baseline you'd only notice the absence of. The pattern is old and reliable: novel, then visible, then infrastructure, then gone.
Those technologies all share something. They carry things. Power. Data. When a conduit becomes invisible, what disappears is delivery. The lights go out. You call the utility company. The problem has a location, a shape, a boundary. You know it failed, you know what failed, and you know when it's fixed.
Agents synthesize, prioritize, act. When something that exercises judgment becomes invisible, the failure boundary dissolves. You may not know it failed. You may not know what failed. You may not know failure happened at all.
We have one precedent for this. Through the 2000s, trading algorithms gradually absorbed decisions that humans had made on exchange floors. Reg NMS standardized interoperability across exchanges. Interoperability enabled scale. Scale enabled invisibility. By 2010, algorithms were making billions of decisions per day that were structurally invisible to nearly everyone affected by them. Then on May 6, 2010, the Flash Crash wiped nearly a trillion dollars in minutes. No single actor to blame. No single failure to point to. Cascading algorithmic trades overwhelmed traditional safeguards in ways regulators couldn't reconstruct in real time. They later discovered their enforcement capacity had quietly declined since 2005, fragmented along with the markets they were supposed to oversee.
The agent trajectory follows the same structural logic: standardization enables cross-system operation, cross-system operation enables scale, scale enables invisibility. The scope is wider. HFT affected asset prices. Agents are being woven into hiring workflows, procurement decisions, compliance checks, customer service. Domains where the judgment being exercised touches people's lives in ways that aren't priced on an exchange.
Some vendors already sense where this is heading. Observability is being marketed as a feature. Teams can't see what agents are doing, and vendors know it. NIST's own guidance states the principle plainly:
"You cannot govern what you cannot see."
But the interoperability standards that will make agents invisible are on track for this year. The oversight frameworks that would make invisible agents auditable are, generously, in draft. The plumbing is being laid before anyone has agreed on where the shutoff valves go.
And if protocol history tells us anything, that gap doesn't close on its own. The argument for encrypting the web had been around for years before HTTPS became universal. It took the Snowden revelations to make the cost of not encrypting politically unbearable. Governance closes through crisis, or it doesn't close.
We are building technology that will reward us for not watching it. And it will need us to keep watching long after we've lost the instinct to look.
Things to follow up on...
-
Only 9% can intervene: A 2026 Gravitee survey found that just 24.4% of organizations have full visibility into which AI agents are communicating with each other, and fewer still can stop a harmful action before it completes.
-
NIST's voluntary-to-mandatory pipeline: Legal analysts note that NIST's AI Risk Management Framework went from voluntary guide to appearing in executive orders, state laws, and procurement requirements within 18 months, and the Agent Standards Initiative is expected to follow the same trajectory.
-
The agent identity problem: NIST's National Cybersecurity Center of Excellence released a concept paper on authenticating and authorizing AI agents in enterprise environments, with the comment period closing April 2, 2026, making it the most operationally relevant document for security teams navigating the governance gap right now.
-
Agents folded into subscriptions: Microsoft announced that AI agent capabilities will be embedded into baseline M365 subscriptions starting July 2026, eliminating separate licenses and marking the precise moment when agents stop being something you purchase and start being something that just runs.

