The Suite Offensive (April–September 2025)

Chapter 8 The Suite Offensive (April–September 2025)

Back in April 2025, a twenty-seven page document landed in the inboxes of a dozen software vendors. It was a Request for Proposal from the procurement office of a global pharmaceutical conglomerate, bearing the subject line “Platform for Enterprise-Grade AI Agent Orchestration and Task Automation.” The technical specifications were thorough, detailing required token-rate limits, multimodal ingestion pipelines, and support for the emerging Model Context Protocol—the same MCP that Anthropic had championed as a tool-level permissioning standard during the consolidation.

But the commercial terms contained the decisive signal. Section 4.2, “Vendor Accountability,” stipulated that the winning platform must provide “a unified support and liability framework covering all components of the agentic workflow, from model inference through tool execution to data persistence.” It demanded “certified integrations with existing identity and access management systems” and “a contractual service-level agreement for task completion accuracy, subject to third-party audit.” Most tellingly, it required that “the prime vendor assume full operational and legal responsibility for all actions taken by autonomous agents deployed through the platform, including those arising from prompt injection, data leakage, or unauthorized tool use.”
This was not an engineering specification.

It was a procurement artifact, drafted by corporate legal departments whose priorities had been irrevocably shaped by the operational disasters of the preceding eighteen months. The “prompt-injection and runaway-cost incidents of 2024” were not academic case studies in this context; they were line items in risk assessments that had escalated to board-level audit committees.

The document translated institutional anxiety into a set of non-negotiable commercial requirements. The harness layer, having coalesced through the platform consolidation of late 2024 into a recognizable set of patterns and tools, now presented itself not as a frontier of innovation but as a vector of liability.

A Fortune 500 company was not buying intelligence; it was buying indemnification. The teams drafting these documents became the unexpected architects of the harness’s next evolution. Their requirements did not spring from first principles of software design, but from the painful, expensive lessons of early adoption.

When an autonomous billing agent at a midwestern utility had misinterpreted a prompt and issued $1.2 million in erroneous customer refunds the prior year, the subsequent post-mortem had fixated not on model hallucination.

It had focused on the absence of a human-in-the-loop checkpoint—the very kind of trust gate that CrewAI had engineered into its handoffs—for financial transactions above a certain threshold, and on the lack of an immutable audit log to reconstruct the agent’s decision chain. When a competitor’s customer-service agent, integrated via an early protocol into a legacy CRM, had been socially engineered through a cleverly formatted user query to expose a database of personal information, the blame was assigned not to the language model’s compliance training but to the harness’s failure to sanitize inputs and enforce permission boundaries.

These were harness failures. They were failures of the loop, the tools, the permissions. And they repriced trust, converting it from a technical concern into a contractual one. The unit of sale was no longer “reasoning steps per second” or “tool-call latency.” It was “compliance coverage.”

This repricing generated a gravitational force that the startup-led harness ecosystem could not counteract. A framework like LangChain, for all its abstractions, could not offer an enterprise-wide service-level agreement backed by corporate liability.

An open-source protocol like MCP, for all its elegant neutrality, could not assume legal responsibility for a runaway agent’s actions. The independent companies that had pioneered orchestration patterns—the ones that had transformed the academic insight of ReAct into commercial platforms—confronted a brutal pivot. They could attempt to build the massive compliance, security, and global support infrastructure demanded by the RFPs, an undertaking requiring hundreds of millions in capital and years of enterprise-sales maturation they did not possess. Or they could become a feature inside someone else’s suite. Microsoft moved first. Its Copilot Studio, which had begun as a low-code tool for stitching together GPT-powered chatbots, had been expanding its scope quietly throughout early 2025. On May 7, the company announced the “Copilot Studio Agents” suite. The official blog post was a masterclass in strategic absorption.

It credited “the pioneering work of the open-source community in agentic patterns” before detailing features that directly mirrored the scaffolding built by LangChain and AutoGen: a visual workflow builder for multi-step agent plans, a built-in “critic” agent for validation, and a state management system for long-running tasks.

The innovation was not in the patterns themselves, which were by then well-known. It was in their deep integration into the Microsoft operational ecosystem. An agent built in Copilot Studio could, with a single toggle, inherit Azure Active Directory permissions, log every action and token consumption to Azure Monitor, and enforce spending limits via Azure Cost Management. Its ground truth was no longer merely the correctness of a code snippet or the green status of a test; its ground truth was the alignment of every action with the pre-existing policies of the Microsoft cloud.

The harness was being woven directly into the fabric of a trillion-dollar company’s control plane.

The announcement included the acquisition of two small, specialist startups: one focused on agentic security sandboxing, another on visual workflow orchestration.

The terms were not disclosed, but the trajectory was unmistakable. Microsoft was not buying revenue; it was buying implementation speed and specialized engineering talent to close the final gaps between its suite and the procurement requirements now circulating in documents like the pharmaceutical RFP.

The Scaffolding Paradox was playing out on a new, corporate scale. The patterns invented by the independent harness layer—the chains, the planners, the recursive executors—were not being absorbed into a model’s weights this time. They were being absorbed into a software giant’s product catalog.

Salesforce followed three weeks later with “Agentforce.” The launch was framed not as a new product but as a new layer of the existing Salesforce platform. “The customer record of the future is not a static entry,” CEO Marc Benioff declared in his keynote at Dreamforce 2025, “it is an interface for action.” Agentforce embedded a full harness directly into the Salesforce object model.

A service agent could now autonomously traverse from a support case to a customer’s order history, to the inventory database, to the shipping logistics API, crafting a resolution and updating all relevant records without a human clicking between tabs. The permission model was inherited directly from Salesforce profiles and permission sets. The audit trail was the standard Salesforce field history. The ground truth was the sanctity and consistency of the customer record itself.

This represented a profound shift in the Metering of Trust. Enterprise users, already conditioned to trust Salesforce with their most critical business data, were being asked to extend that trust to autonomous agents operating within the same walled garden. The security and compliance apparatus was not a new, unfamiliar harness; it was the same apparatus that already governed every sales rep and system administrator. The harness vanished into the suite’s infrastructure. The commercial proposition was simple: you already trust this platform with your revenue data; now you can trust it with your revenue-generating automation.

For the cloud hyperscalers—AWS, Google Cloud, and Azure beyond Microsoft’s specific Copilot offerings—the strategy was similar but more infrastructural. They launched “Agent Foundries” or “Agent Workbenches,” positioning them as managed services atop their respective model marketplaces and compute layers. Their leverage was not application integration but sheer economic and operational scale. An enterprise could provision a fleet of agents, govern their tool use, monitor their costs, and scale their inference, all through the same console used to manage virtual machines and databases. The harness became another resource type in the cloud catalog, billingable by the hour or the task, wrapped in the hyperscaler’s standard compliance certifications and support agreements.

The effect was a six-month blitz that redrew the commercial map of the harness layer.

By the end of September 2025, a stark bifurcation had crystallized. On one side stood the “suite harnesses”: vertically integrated, compliance-heavy, vendor-locked platforms sold as features of Microsoft 365, Salesforce Enterprise, or AWS Enterprise Support.

On the other side remained the “independent harnesses”: the open-source frameworks, the protocol-based tool ecosystems, and the startups still attempting to sell harness technology as a standalone layer.

This division was more than market segmentation. It was a fundamental schism in the engineering philosophy of the harness. The suite harnesses optimized for control, auditability, and contractual clean-ness, often at the expense of flexibility and innovation velocity. Their tool universes were frequently limited to first-party or pre-vetted third-party APIs. Their agentic loops were simpler, more deterministic, and laden with mandatory human-approval gates for any action flagged as “high-risk” by a configurable policy engine. They metered trust in large, coarse-grained chunks: you trusted the suite, and the suite governed the agent.

The independent tier, by contrast, remained the wild frontier. It was where new, fragile forms of agency continued to be tested, particularly in domains where ground truth was elusive and could not be easily reduced to API contracts.

The most prominent and problematic of these domains was general computer use—the ambition to create agents that could operate any software by seeing pixels and manipulating cursors, just as a human would. The spring and summer of 2025 witnessed a surge of activity here. Startups and open-source projects released “browser agents” and “desktop agents” that used multimodal models to interpret screen captures and generate corresponding mouse-and-keyboard commands. The promise was immense: an agent that could navigate an airline’s buggy, ancient booking portal, or fill out a convoluted government web form designed in the 1990s.

This was the antithesis of the tightly integrated, API-driven tool use that the suites favored. It was a harness for grappling with the messy, visual, non-deterministic reality of human-computer interaction.

Its failure modes, however, illustrated the Ground-Truth Law with cruel clarity. An agent that writes code has a clear verification mechanism: the code compiles, the tests pass. An agent that clicks through a website has no such definitive signal. Did clicking that button submit the form, or did it trigger a silent JavaScript error?

Did the text that appeared in a new pop-up window confirm a successful booking, or was it an error message styled in green? Pixel-level ground truth was fragile, ambiguous, and easily broken by the slightest change in layout or font. A one-pixel shift in a submit button’s location could cause an agent to click empty space. An unanticipated CAPTCHA or a novel dialogue box brought the entire loop to a grinding halt.

The Metering of Trust for such systems was excruciatingly fine-grained and inefficient. Human operators found themselves unable to look away, compelled to confirm every non-trivial action because the cost of a single mis-click could be a botched $10, 000 purchase or a misrouted customer complaint. The harnesses built for computer use were thus thick with confirmation prompts, screen-recorded rollback capabilities, and elaborate “confidence scoring” for visual interpretations. They sold autonomy in tiny, hesitant increments. Their commercial adoption, outside of highly scripted and sandboxed internal workflows, stalled.

The suites largely avoided this quagmire, focusing instead on agents that interacted with clean, structured APIs—the very APIs the suites themselves often provided or certified.

This divergence highlighted a core tension. The suite offensive succeeded by circumventing the hardest unsolved problems of agency. It delivered a harness that worked reliably by severely constraining the agent’s world to one of predictable digital levers and dials. The independent tier, by trying to solve the harder problem of general computer use, remained mired in fragility.

This was not a failure of the independent engineers; it was a demonstration of the Ground-Truth Law’s power. Agents land first—and commercially—where feedback is verifiable. The suites narrowed the world until it was verifiable. The independents tried to build verification for the wider world, and found the task economically untenable.

Meanwhile, the Scaffolding Paradox advanced on a second front. The independent harness layer’s primary response to suite absorption had been to climb the stack, from frameworks toward open protocols.

The Model Context Protocol (MCP) had aimed to become the USB-C for AI tools—a universal standard any model could use to connect to any tool, preventing vendor lock-in. Throughout the first half of 2025, MCP gained significant momentum in the open-source and startup communities. It promised a counterweight to the suite vendors’ burgeoning proprietary tool ecosystems.

The suite offensive crushed that promise under a different, more sophisticated logic. Microsoft, Salesforce, and Google did not reject MCP outright. Instead, they implemented “MCP-compatible” gateways or adapters. These were protocol translators that sat between the open standard and their internal, proprietary tooling systems. An agent could request a tool via an MCP message, but the gateway would map that request to a pre-approved, vendor-specific implementation. The protocol was embraced, but its core promise of universal tool interoperability and ecosystem neutrality was neutered. The suite vendors controlled the tool runtime, the permission model, and the audit trail. MCP became a convenience feature for onboarding developers, not a liberation from vendor control.

The Protocol Politics of this moment mirrored earlier standards wars in computing: the open standard was adopted not to create a level playing field, but to prevent the emergence of a rival, truly independent playing field altogether. The suites owned the ecosystem not by fighting the protocol, but by subsuming it. By September 2025, the landscape was defined by this stark division. The enterprise tier of the harness layer belonged to the software giants. It was a world of procurement contracts, compliance certifications, and seamless—if deliberately constrained—integration into the machinery of global business.

The experimental tier remained vibrant, wrestling with unsolved problems like robust computer use and pushing the boundaries of multi-agent systems, but its path to the lucrative enterprise market was now blocked by a wall of contractual and operational requirements it could not meet. This bifurcation created a new, intense pressure point. The suite harnesses, by virtue of their deep integration and compliance focus, were inherently conservative. They moved at the speed of enterprise software development cycles, legal review, and regulatory approval.

The pharmaceutical RFP was not an isolated document but a canonical example of a broader procurement trend that swept through Global 2000 companies in the second quarter of 2025. Analysts at firms like Gartner and Forrester began publishing entire research notes on “Vendor Selection Criteria for Agent Orchestration,” formalizing the requirements that had emerged from the ashes of early failures. These criteria invariably prioritized “single pane of glass” management, “end-to-end auditability,” and “contractual recourse.” The language was telling: “orchestration” itself had become a euphemism for “supervision.” The harness was no longer seen as a catalyst for autonomy but as its necessary governor. This shift in perception was the direct outcome of a year in which agentic systems had moved from controlled proofs-of-concept into live, revenue-touching environments. The financial and reputational blowback from incidents had traveled up the corporate ladder, transforming technical debates about chain-of-thought reliability into boardroom discussions about fiduciary duty and directors’ and officers’ liability insurance. Procurement offices, traditionally gatekeepers of cost and compatibility, found themselves newly empowered as the arbiters of algorithmic risk. Their checklists became the de facto design specifications for the commercial harness layer, effectively vetoing architectural choices that prioritized flexibility over accountability.

The urgency behind these requirements was fueled by a hardening regulatory landscape. Data protection authorities in Europe and North America had begun issuing preliminary guidance on “autonomous AI agent compliance,” focusing on explainability, data minimization within agentic workflows, and the assignment of legal responsibility for harmful outcomes. While comprehensive legislation was still years away, the direction was clear: regulators would expect enterprises to demonstrate “reasonable oversight.” An internal framework patched together from open-source components, no matter how elegant, could not provide the documented, vendor-backed guarantees that corporate legal counsel deemed “reasonable.” Thus, the procurement criteria did more than describe a product; they enacted a risk-transfer strategy. The pharmaceutical company, and hundreds like it, sought to bundle the inherent uncertainty of agentic AI into a vendor contract—a familiar corporate maneuver for dealing with complex, novel threats. This outsourcing of risk created a market aperture that only the largest software vendors, with their established legal departments, global support teams, and balance sheets deep enough to underwrite potential liabilities, could fill.

Microsoft’s Copilot Studio expansion was therefore less a technological breakthrough than a strategic colonization of this newly defined market space. Its May announcement was carefully engineered to signal safety and integration above all else. The blog post and accompanying executive interviews repeatedly emphasized “governance,” “policy inheritance,” and “enterprise grade,” terms calibrated to soothe procurement committees. The mention of open-source pioneers was a gracious but calculated nod; it conferred legitimacy while simultaneously framing the independents as inspirations rather than competitors. The actual mechanics of the offering revealed the core of the suite strategy: binding the harness to the pre-existing control infrastructure. By making Azure Active Directory the source of truth for permissions, Microsoft ensured that an agent’s access rights could never exceed those of a human employee, and could be revoked instantly through the same HR-driven workflows. By funneling logs into Azure Monitor, it guaranteed that every action could be reconstructed for compliance audits or post-incident reviews using tools already licensed and trusted by enterprise IT departments. The harness disappeared into the administrative background. This was a profound psychological and operational win: it asked nothing new of the customer’s security team. The suite vendor’s existing trust capital was leveraged to cover the new, frightening territory of agentic automation.

The acquisitions of the sandboxing and orchestration startups were essential steps in this process. They were not talent acquisitions in the traditional Silicon Valley sense, but capability acquisitions aimed at closing specific gaps in the compliance narrative. The sandboxing startup’s technology, which isolated tool execution in secure containers, directly addressed the “unauthorized tool use” clause now appearing in RFPs. The visual workflow company provided a low-code interface that allowed business analysts—not just AI engineers—to design and, crucially, to document agentic processes, satisfying the audit requirement for a human-readable “process map.” Microsoft was assembling, piece by piece, a complete evidentiary and control apparatus around the core orchestration patterns. This was the suite offensive in microcosm: a methodical enclosure of innovative, independent capabilities within a fortress of pre-existing enterprise trust, policy, and procedure.

Salesforce’s Agentforce, announced in late May, pursued the same end through a different, equally powerful legacy asset: the customer relationship itself. For decades, Salesforce had sold its platform as the “single source of truth” for customer data. Its security model, auditing, and permissioning were designed to protect that truth. Agentforce’s genius was in positioning autonomous agents not as external tools accessing this truth, but as native actors operating within it. The keynote demonstration was revelatory: an agent, invoked from a service case, autonomously navigated through a maze of related objects—contacts, contracts, assets, orders—making updates and decisions while maintaining full audit trails within standard Salesforce fields. The message was unambiguous: the agent’s actions were as natural, traceable, and governable as those of a human salesperson using the platform. This approach brilliantly sidestepped the daunting task of building a new security and compliance model for AI. Instead, it inherited a model that was already baked into the daily operations of millions of users and validated by thousands of compliance audits. The “Metering of Trust” became trivial: if you trusted Salesforce with your customer data, you could trust an Agentforce agent with your customer processes. The commercial bundling was equally seamless; Agentforce was not a separate SKU but a premium feature tier, making adoption a simple checkbox upgrade for existing enterprise clients.

The hyperscalers—AWS with its Bedrock Agent suite, Google Cloud with Vertex AI Agent Builder—played a slightly different but complementary role. Their value proposition was infrastructural omnipotence. They offered not deep integration with business applications like Salesforce, but deep integration with the cloud’s fundamental plumbing: compute, storage, networking, and identity. An AWS Bedrock agent could be provisioned, scaled, monitored, and budgeted using the exact same tools and consoles as an EC2 instance or an S3 bucket. For CIOs and CTOs whose primary mandate was to consolidate spend and simplify operations onto one or two cloud platforms, this was a compelling argument. The hyperscalers’ harnesses promised to turn AI agents into just another managed, billable cloud resource, governed by the same FinOps policies and security frameworks already governing the rest of the IT estate. This approach appealed to the central technology functions of large organizations, further marginalizing the standalone harness vendor who could only offer a point solution in a landscape demanding integrated suites.

This six-month consolidation reshuffled the entire ecosystem of tooling and development around agents. Third-party tool providers—companies offering specialized APIs for data analysis, document processing, or niche business functions—now faced a critical choice. They could seek “certification” or “preferred partner” status within the Microsoft, Salesforce, or AWS marketplaces, accepting the suites’ terms, royalty structures, and review processes. This path promised immediate access to a vast, qualified enterprise audience but came with the constraints of vendor-specific implementations and the risk of being marginalized as a commodity plugin. Alternatively, they could remain in the open ecosystem, betting on the independent protocol layer and the long-tail of startups and developers. This path preserved flexibility but forfeited the lucrative, procurement-driven enterprise channel that was rapidly being locked down by the suites. Many toolmakers, particularly those in regulated sectors like finance or healthcare, pragmatically chose the former, further enriching the suite vendors’ walled gardens and starving the open ecosystem of high-value capabilities.

The independent harness layer, now largely confined to the startup and developer community, was forced to specialize in problems the suites deliberately avoided. General computer use—the pixel-and-cursor automation of arbitrary software—became its most visible, and most agonizing, frontier. The technical challenge was monumental. An agent interacting with a browser via screenshots and simulated clicks operates in a ground-truth desert. The visual confirmation of a successful form submission is probabilistic, based on pixel patterns that can change with a font update or a zoom level. The absence of a machine-readable success signal forces the harness to implement layers of fallback checks, confidence scoring, and human-in-the-loop confirmations that obliterate any efficiency gains. Startups like Adept and open-source projects like SmartCrawl valiantly built increasingly sophisticated computer-use agents throughout the summer of 2025, demonstrating impressive feats on staged tasks. Yet in commercial deployments, the “Metering of Trust” proved fatal. Human supervisors, unable to tolerate the risk of an erroneous click in a live financial or customer system, would revert to requiring approval for nearly every non-trivial action, reducing the agent to a semi-automatic macro tool. The economic case for these fragile, high-maintenance systems collapsed when compared to the reliable, if limited, API-driven agents offered by the suites for tasks within their domains.

The struggle over protocols, particularly the Model Context Protocol (MCP), further illustrated the suites’ sophisticated dominance. Their embrace of “MCP compatibility” was a classic embrace-extend-extinguish maneuver in standards warfare. By implementing MCP gateways, they gave developers the comfort and convenience of a familiar protocol, easing adoption. Yet these gateways were not neutral bridges; they were control valves. They could filter which tool requests were allowed, translate them into proprietary internal calls, and impose suite-specific authentication and logging. The protocol’s promise of a universal, vendor-neutral tool ecosystem was subverted. It became merely an onboarding ramp into each suite’s walled garden. For the independent protocol movement, this was a devastating outcome. Their standard had been adopted, but its revolutionary potential for preventing lock-in had been defanged. The suites, by supporting the letter of the protocol, undermined its spirit and secured their control over the tooling layer. Independent framework companies that had bet their futures on MCP as a differentiator found themselves offering a feature that their giant competitors now provided as a convenient inclusion.

By the close of September 2025, the harness layer’s fate within the enterprise was sealed. The suite offensive had not been a pitched battle of technological superiority, but a systemic takeover driven by the non-technical imperatives of risk, liability, and operational integration. The victorious suite vendors—Microsoft, Salesforce, and the hyperscalers—had won not by building better orchestration code, but by offering a more complete commercial proposition: a harness wrapped in a guarantee, embedded in a trusted platform, and backed by a corporate entity large enough to accept blame. This left the original, innovative harness ecosystem in a precarious but creatively vital position. It became the research and development arm of the agentic world, exploring the hard, unsolved problems at the edges of agency, from general computer use to complex multi-agent societies. Its playground was the open-source community, the academic lab, and the venture-backed moonshot. Its path to the enterprise revenue that had suddenly defined the market, however, was now barricaded by a wall of procurement requirements and vendor certifications it could never hope to scale. The division was absolute. One hemisphere was governed by lawyers and accountants, selling safety and integration. The other was governed by engineers and researchers, selling possibility and peril. They were two different industries now, speaking different languages, serving different masters, and operating on profoundly different timelines.

The large language models they employed, however, were evolving at the relentless, disruptive pace of the AI labs. With each new model release from OpenAI, Anthropic, or Google DeepMind, new native capabilities emerged that encroached directly on the harness’s territory. Native multimodality improved, eating away at the need for separate vision models and complex coordination in browser agents. Models demonstrated better intrinsic planning and self-correction, internalizing loops that once required external scaffolding. The Scaffolding Paradox was not dormant; it was accelerating. The suite vendors, having spent capital and political weight to acquire and integrate harness technology, now faced a latent threat from their own suppliers: the model labs. The very companies whose models they relied upon were, with each iterative release, absorbing more of the scaffolding into the model itself. The harness layer’s economic premise within the suites—selling control, safety, and integration—remained solid for the moment. But its technical premise—that essential, indispensable intelligence resided in the orchestration around the model—was under perpetual, mounting erosion from below.

The division of the harness layer was now complete, a fact cemented not by technology but by procurement. One tier was a compliant, monetized, and heavily governed feature of the inherited software stack, secure in its enterprise stronghold. The other was an innovative, precarious, and open research frontier. The border between them was defined by liability agreements and certification badges, not by GitHub stars or technical elegance. The suites had won the enterprise. But in doing so, they had built their kingdom atop a foundation—the raw, accelerating, and inherently unpredictable intelligence of the large language models—that they did not fully command, and that was evolving on a timeline they could not control. The pressure inherent in that arrangement was quiet, but it was structural. It would not manifest as a competitor’s product launch. It would manifest as a quiet, persistent narrowing of the gap between what the model could do alone and what the harness was sold to provide. The fortress was secure, but the ground beneath it was steadily shifting.