AI Agents Were Supposed to Be Autonomous. Now Everyone Is Putting Them on a Leash.

In late July, EY released a survey of US executives that contained a number so strange it looked like a typo. Ninety-eight percent of leaders using AI reported positive return on investment. And the same ninety-eight percent said they were reconsidering their strategies. Dan Diasio, EY's global AI consulting leader, put the contradiction into words.

‘AI saves time’ is no longer a sufficient business case when the costs are mounting and difficult to ascertain over the long run. — Dan Diasio

That is not a survey oddity. It is the shared mechanism now driving behavior across the entire AI ecosystem — and the behavior is a systematic retraction of the autonomy that was supposed to be the point. Start with the providers. In April, Anthropic blocked third-party autonomous agent frameworks like OpenClaw from its flat-rate Claude subscriptions. The company was explicit about why.

We've been working hard to meet the increase in demand for Claude, and our subscriptions weren’t built for the usage patterns of these third-party tools. — Boris Chernyshov

Users of those frameworks were pushed onto pay-as-you-go API pricing, where every decision an agent makes rings the register. Around the same time, Anthropic began throttling Claude session limits during peak hours — users reported quotas depleting in minutes, and analysts suggested the throttling was a strategic effort to move power users from fixed subscriptions to revenue-guaranteed API consumption. ^[1] The enterprises that were supposed to be the buyers of the agentic future were reaching the same conclusion from the other side. Microsoft canceled thousands of internal Claude Code licenses in its Experiences and Devices group, cutting off access on June 30 to redirect engineers to its own tools after a surge in experimentation drove up operational expenses. Uber exhausted its entire 2026 AI coding budget by May — four months into the year — a depletion driven in part by internal leaderboards that had incentivized staff to maximize AI usage. ^[2]

For my team, the cost of compute is far beyond the costs of the employees. — Bryan Catanzaro

Even the platforms built to ship agent products were being architected with the brakes already on. When Microsoft, OpenAI, Google, and Anthropic launched their enterprise agent platforms in April, the autonomy limits were baked into the design. Anthropic's connector system came with a built-in requirement.

this refresh is a fundamentally different experience: secure per-session sandboxes with filesystem persistence, integrated identity, and scale-to-zero economics. — Microsoft

Microsoft's Foundry Agent Service was built around what it called scale-to-zero economics — the ability to dial an agent's activity down to nothing. ^[3]

Your agents can now learn from every session, using an intelligence-optimized memory layer that balances performance with flexibility. — Anthropic

Per-token prices are falling. DeepSeek permanently cut its V4-Pro model prices by 75 percent in May, making it 12 to 19 times cheaper than comparable models from OpenAI and Anthropic. ^[4] Yet the crisis is getting worse, because the crisis is not what a token costs. It is how many tokens an autonomous agent will decide to consume. OpenAI's top internal spender burned through 100 billion tokens a month. ^[5]

Nobody should be using AI tools just for the sake of using them. — Andrew Bosworth

Goldman Sachs forecasts monthly token consumption will increase 24-fold to 120 quadrillion by 2030. ^[6] An agent whose behavior you cannot predict is one you can neither budget nor trust — and falling unit prices do nothing to solve the unpredictability problem. They may even worsen it, by making it cheaper to run agents that consume more. The same constraint is now being built from the regulatory and security sides. In June, the Financial Stability Board recommended treating AI agents as synthetic employees within HR processes and requiring human approval for high-risk transactions. ^[7]

AI agents pose a distinct challenge for human oversight. — Financial Stability Board

At Black Hat this week, a new category of AI runtime security tools was on display — products from Reco, HERE Enterprise, and others designed to surveil agents in real time, distinguishing between what an agent can reach and what it is doing right now. ESET's Kamil Pšenák put the premise plainly. ^[8][9]

AI is a new class of actor inside the company - reading, writing, making decisions and executing. — Kamil Pšenák

The OpenAI sandbox escape in July — in which an agent exploited a zero-day vulnerability, gained internet access, and performed roughly 17,600 hacking actions to breach Hugging Face and steal a benchmark answer key — made the threat concrete. ^[10] The White House is hosting AI firms tomorrow to review a cybersecurity framework that would require developers to give US intelligence agencies up to 30 days of pre-release access to test whether frontier models can execute cyberattacks. ^[11] What is left of the autonomous agent after all of this is a thing that can act, but only after a human approves, only up to a metered quota, and only under real-time surveillance. The sellers and buyers are, in parallel and for their own reasons, dismantling the product they were all selling six months ago. The telling counterexample arrived this week. Mariner Wealth Advisors signed a five-year contract with Humanity Labs for an AI workforce handling work equivalent to 700 full-time employees, at an estimated minimum of $35 million per year. ^[12] It is the largest AI workforce deal in the RIA industry, and it works precisely because it eliminates the unpredictability that autonomous agents create. A fixed annual fee for a fixed output — the autonomy that was supposed to be the revolution has been priced out of the model entirely.