Businesses
The Explosion of AI Agents, NVIDIA OpenShell and Why Every Machine Now Needs an ID Passport
16 Oct 2026
The knight wakes up
Around 1495, in the court of Ludovico Sforza in Milan, Leonardo da Vinci sketched a knight in German-Italian armour that could sit up, raise its visor and move its arms, driven by pulleys and cables hidden inside the steel. It was a machine that performed a will that was not its own. For five centuries that was the whole of automation: machines that repeated what we designed them to repeat.
In 2026 the knight woke up.
AI has crossed a threshold that no slide deck fully captures. It perceived, then it generated, then it reasoned, and now it acts. It books, buys, prices, approves, files, codes and pays. At NVIDIA’s GTC conference in March, Jensen Huang said that Claude Code and OpenClaw had sparked an inflection point, carrying AI beyond generation and reasoning into action. He was right. The question of our decade is no longer whether machines can think. It is who stops them when their thinking goes wrong.
This article is a field guide to that question: the scale of the agent explosion, the breakthrough that NVIDIA OpenShell represents, the mathematical signalling layer that my friends at Sheaf are building on top of it, eight industries being rewritten, and the urgent case for giving every agent an ID and a passport. It ends with a playbook. Because the window to act is measured in quarters, not years.
Also check out the AI Agents 101 atlas: https://businessabc.net/page/ai-agents-101-atlas
The explosion in numbers
The agent economy is still small in revenue and already vast in consequence. Three independent forecasters now cluster around the same destination for 2030, which is the strongest signal a young market can give.T
| Forecaster | Base | 2030 forecast | Growth rate |
| Grand View Research | $7.63bn (2025), $10.9bn (2026) | $50.31bn | 45.8% CAGR |
| MarketsandMarkets | $7.84bn (2025) | $52.62bn | 46.3% CAGR |
| BCC Research | $8.0bn (2025) | $48.3bn | 43.3% CAGR |
Adoption is wide but shallow. McKinsey’s 2025 State of AI survey of 1,993 participants in 105 countries found that 62 per cent of organisations are at least experimenting with agents, yet only 23 per cent are scaling them anywhere, and in no single business function have more than 10 per cent scaled. Gartner forecasts that a third of enterprise software will include agentic AI by 2028, up from under 1 per cent in 2024, and that 15 per cent of day-to-day work decisions will be made autonomously.
Then comes the cold water. Gartner also predicts that more than 40 per cent of agentic AI projects will be cancelled by the end of 2027, because of escalating costs, unclear value or inadequate risk controls. It estimates that only about 130 of the thousands of vendors claiming agentic capability are real. The rest is what analysts now call agent-washing: chatbots and robotic process automation in new costume.
Read those numbers together and the shape of the opportunity is clear. Demand is not the constraint. Trust is. The 40 per cent who fail will mostly fail not because agents cannot act, but because no one could prove that they acted correctly.
OpenClaw and OpenShell: the fire and the fireplace
Every civilisation has had to learn the same lesson with fire: the power that warms the house can also burn it down, and the answer was never to abandon fire but to build the hearth.
OpenClaw is the fire. Created by the Austrian developer Peter Steinberger and launched under earlier names, it is a self-hosted personal agent that runs on a user’s own machine, with persistent memory and a marketplace of skills that give it hands: browse, log in, fill forms, send mail. It became the fastest-growing project in GitHub’s history, passing 230,000 stars, and Sam Altman hired its creator into OpenAI. Huang compared its importance to Linux, Kubernetes and HTML.
The fire also burned. In its first five months OpenClaw logged 1,142 security advisories, a rate of 16.6 a day, 99 of them critical. Researchers counted more than 21,000 instances exposed to the public internet. A one-click remote code execution flaw, CVE-2026-25253, was disclosed early in the year. Gartner called its design insecure by default. Token Security found about 22 per cent of employees in its customer base using the agent, often outside IT oversight. Steinberger himself has invoked the “lethal trifecta”, a term first used by the developer Simon Willison for the three conditions that make any agent dangerous when combined: access to private data, exposure to untrusted content and the ability to act outward.
OpenShell is the fireplace. NVIDIA launched it at GTC 2026 as part of its open-source Agent Toolkit, alongside Nemotron models and the AI-Q research blueprint, under the Apache 2.0 licence. It is a runtime that sits between the agent and your infrastructure. Each agent gets its own sandbox with kernel-level isolation, using Landlock for the filesystem and seccomp for processes. Policies are written in declarative YAML across four domains: filesystem, network, process and inference. Network and inference rules can be reloaded while the agent runs.
The breakthrough is philosophical as much as technical. Until now, most agent safety lived inside the prompt: we asked the model nicely to behave. OpenShell moves the control point outside the agent, where it cannot be argued with. The agent never holds credentials directly, and a compromised agent cannot override a rule it cannot reach. NVIDIA calls it the browser-tab model applied to agents. Seventeen launch partners, from Adobe and Salesforce to SAP, ServiceNow and Siemens, have signed on, and Cisco, CrowdStrike, Google, Microsoft Security and TrendAI are building OpenShell compatibility into their security tools. ServiceNow’s Project Arc already uses it as its secure runtime.
NVIDIA is also honest about the limits. OpenShell enforces boundaries; it does not make a badly designed agent good. And it operates below the level where the content of a tool call lives. It knows the agent may call the lending system. It does not know whether the loan it is about to quote makes sense.
Sheaf: the mathematics of disagreement
If OpenShell is the railway line, the next question is obvious: who works the signals? Disclosure: I serve as an adviser to Sheaf Labs.
Sheaf was founded by Jack Widman, who holds a PhD in mathematics in topology and is an affiliated researcher in the foundations of computer science at Ben-Gurion University, and Phil Grady, the venture builder who founded Castlight Financial, one of the UK’s leading affordability fintechs. Their starting premise is disarmingly simple. One AI model’s answer is a guess delivered with confidence. Ask several strong models the same question and their agreement tells you something one answer never can. So does their disagreement. Asking is easy. Measuring the disagreement is the valuable part.
The measurement comes from sheaf theory, the branch of mathematics designed to join many partial views into one consistent picture and to prove when they cannot be joined. Sheaf turns that into an inconsistency index a computer can calculate. Its key insight is that the most dangerous contradictions are relational. Agent A says x equals y. Agent B says y equals z. Agent C says z does not equal x. No two of them disagree, yet all three cannot be true. Pairwise checks miss this. Sheaf cohomology catches it: a consistent run is H⁰, with a coherence score of 1.00; a hidden contradiction appears as H¹, with a score such as 0.41.
In practice Sheaf sits inside the single connection OpenShell allows, as a proxy between agents and their tools. It has five parts. A fact list, written before the run, names the facts agents may use and the actions that need human consent. A Gate sits in front of every action and stops anything on that list with a plain lookup, no model involved, so it cannot be tricked or talked round. A Warden pauses the work and hands the decision to a person. A Witness sits beside each agent and records its claims. A Reporter checks continuously that all claims fit together and, at the end, issues a signed record.
That record is the product. It is a document a risk officer can sign, a regulator can read and a board can rely on. The first application, Portfolio IQ, uses agents to assess, price and watch a loan book, with every decision checked before it happens. The mathematics is published openly, which matters: a measure you can check beats a claim you must take on trust.
In 1494, a year before Leonardo sketched his knight, his friend and collaborator Luca Pacioli published the first printed account of double-entry bookkeeping, the ledger that made modern commerce trustworthy. The agent century needs its own double entry: a ledger not of money, but of reasoning.
The platform war has begun
In twelve months every major technology company has declared itself the home of the agent. The battlefield is not the model any more. It is the runtime, the protocol and the payment rail.
| Player | Move | Date | What it signals |
| NVIDIA | Agent Toolkit with OpenShell, Nemotron and AI-Q; 17 launch partners | Mar 2026 | The chipmaker wants the trust layer of the stack |
| OpenAI | Frontier, an enterprise platform for “AI co-workers”; HP, Intuit, Oracle, State Farm, Thermo Fisher, Uber | Feb 2026 | Agents as a managed layer over every enterprise system |
| Anthropic | Claude Managed public beta; Notion, Rakuten, Asana, Sentry; $0.08 per session-hour | Apr 2026 | Hosted agents; run-rate revenue passed $30bn |
| Universal Commerce Protocol with Shopify, Etsy, Wayfair, Target, Walmart; AP2 and A2A | Jan 2026 | Open protocols for agent shopping and payment | |
| Meta | Acquired Manus for more than $2bn; automated advertising | Dec 2025 | Agents for billions of users and millions of businesses |
| Mastercard | Agent Pay, Agentic Tokens, Agent Suite, Start Path agentic cohort of 22 start-ups | 2025–2026 | The payment network as identity authority for agents |
| Polsia | $30m at a $250m valuation; about 7,600 businesses; one human | May 2026 | The zero-employee company, and its reliability gap |
The pattern is unmistakable. OpenAI describes Frontier as an operating system for AI at work. Anthropic separates the “brain”, the “hands” and the “session”, and keeps credentials out of the sandbox where generated code runs. Google built UCP to interoperate with AP2, A2A and the Model Context Protocol. Meta bought a working agent business reportedly earning $125 million a year. Mastercard says it participates in all the major agent commerce protocols.
And the start-ups show the edges. Polsia claims about $10 million in annual run-rate within five months, with agents handling coding, outreach, advertising and support. Its public reviews average 2.1 out of five, citing incomplete tasks and credits lost on failed actions. Valuation is running ahead of reliability. That gap is precisely where the next fortunes, and the next scandals, will be made.
Eight industries, rewritten
In every sector the pattern repeats: a dramatic gain in speed, a new category of risk, and a human who must still answer for the outcome.
Banking. Mastercard unveiled Agent Pay in April 2025 with Microsoft, then piloted it with Citi and U.S. Bank. Each transaction carries an Agentic Token bound to a specific agent and policy. On 17 February 2026, at the India AI Impact Summit in New Delhi, Mastercard completed what it called the first fully authenticated agentic transaction on its network. With Backbase it is now taking agentic tools to more than 120 banks. The token proves who may pay. For credit, banks also need proof that the decision was sound, which is the gap Portfolio IQ was built to fill.
Insurance. Allianz built Project Nemo, its first agentic system, in under 100 days. Seven agents handle coverage checks, weather verification, fraud screening and payout calculation for food spoilage claims in Australia, cutting processing time by 80 per cent, while a human adjuster still signs the payment. State Farm is an early adopter of OpenAI Frontier. Claims are where agents will meet regulators first.
SMEs. For small firms the agent is becoming both the employee and the shop window. Google’s Universal Commerce Protocol lets shoppers buy from retailers inside Gemini and AI Mode. Polsia sells an entire autonomous back office. Mastercard’s first agentic Start Path cohort includes Luca AI, which unifies sales, marketing, finance and operations for small businesses. The risk is spending without supervision; the remedy is scoped mandates.
Marketing. Meta aims to let advertisers supply a product image and a budget and leave creative, targeting and spend to AI. Some agencies still refuse to hand over creative control, and the more automated the system, the harder it is to see what works. Brand safety becomes a policy problem, not a review meeting.
Business operations. Frontier, Managed Agents and ServiceNow’s Project Arc turn agents into a governed workforce. The governance features, identity, permissions, audit and session tracing, are now the product as much as the model is.
Education. The evidence is promising and sobering. A Harvard-led randomised trial found a custom AI physics tutor outperformed an active-learning classroom. A Stanford SCALE briefing found that nearly half of students offered an AI tutor simply did not use it. Hybrid models that support human teachers perform best. Under the EU AI Act, education systems are high-risk, with obligations now due from 2 December 2027.
Entertainment and video. Netflix disclosed that about 300 titles used generative AI in 2026. The American Experiment included 17 minutes of AI-enhanced footage produced in half the time and at half the cost. The company acquired InterPositive in March. In micro-drama and vertical video, which my own studio works in daily, agentic production is compressing months into weeks. Provenance and consent are the new currency.
Healthcare. Epic unveiled Agent Factory at HIMSS 2026, a no-code builder for agents inside the electronic health record. More than 85 per cent of Epic customers already use Epic AI. ECU Health reports saving about 20 hours of chart review a week with its first agents. In medicine, the agent proposes and the clinician disposes.
Every agent needs an ID and a passport
Identity is the new perimeter, and machines have already outnumbered us inside it. Palo Alto Networks’ 2026 Identity Security Landscape, drawn from 2,930 security leaders, puts the ratio at 109 machine identities for every human, up from 82 a year earlier, with roughly 79 of those being AI agents. Agents are expected to grow by 85 per cent this year. Nine in ten organisations suffered a successful identity-related breach in the past twelve months. The Cloud Security Alliance cites research that 78 per cent of organisations have no documented policy for creating or removing an agent’s identity.
An agent without identity is an anonymous insider holding your keys. That is why the payment networks moved first. Visa’s Trusted Agent Protocol gives agents a cryptographic way to prove identity and authorisation to a merchant. Mastercard binds Agentic Tokens to a specific agent and offers Agent Sign-Up for registering agents. Google’s AP2 creates evidence of what a user actually authorised. The industry has a name for the whole effort: Know Your Agent, the machine-age sibling of Know Your Customer.
Yet these pieces answer different questions. Identity answers which software acted. Authorisation answers what it was allowed to do. Verification answers who stands behind it. None of them, on its own, answers whether the decision was sound. A complete agent passport needs seven pages:
- Identity: a cryptographic identifier for the agent and its version.
- Operator: the accountable legal entity behind it.
- Principal: the person or company it acts for, with a signed mandate.
- Scope: what it may reach and spend, enforced by a runtime such as OpenShell.
- Provenance: the model, tools and skills it runs and where they came from.
- Record: a signed log of decisions and whether its reasoning held together, as Sheaf produces.
- Revocation: one switch to withdraw everything, everywhere, at once.
And the humans who supervise agents need a passport of their own. That is the thinking behind the AI ID Passport we created at Businessabc : verified AI literacy for the people who will clear the red signals. Two passports, one for the machine and one for the person who answers for it.
What to do now
Sun Tzu taught that victorious armies win first and then go to war. In the agent economy, winning first means building trust before you scale.
Investors. The capital of the last cycle went to models; the capital of this one should follow trust. Back runtimes, identity, verification and observability, the layers that let a bank, an insurer or a hospital say yes. Apply Gartner’s test to every pitch: real autonomy and measurable return, or agent-washing? Ask for production completion rates and the cost of an error, not demos. Watch reliability signals such as customer reviews as closely as annual recurring revenue.
Developers. Put the control point outside the agent. A prompt is a request; a kernel policy is a law. Run agents in a sandbox such as OpenShell, never hand them raw credentials, and write policy as code across filesystem, network, process and inference. Log every tool call as a security event. Scan skills and plugins before installing them, as Cisco’s scanner did when it found nine issues in OpenClaw. Test what single-agent benchmarks miss: agents that each look correct and together cannot all be right.
Start-ups. Pick the vertical where being wrong is most expensive, because that is where buyers pay for proof. Build on open protocols, MCP, A2A, AP2 and UCP, rather than private plumbing. Ship with a human gate on binding actions from day one. Use the rails the incumbents have opened, from Mastercard Start Path to the NVIDIA partner ecosystem. Treat identity and audit as features you sell.
Enterprises, banks and insurers. On Monday morning, count your agents. Inventory every agent and non-human identity, assign an owner, apply least privilege and expiry to every credential. Require a signed decision record for any agent that touches money, health, credit or employment. Map your obligations: the EU AI Act’s transparency duties have applied since 2 August 2026, and the high-risk obligations, deferred by the Digital Omnibus, arrive on 2 December 2027. Finally, train the supervisors. An agent strategy without AI-literate humans is an exposure, not a strategy.
The human in the loop
In 1818 Mary Shelley gave us a creature that was not evil, only abandoned: brought to life by a brilliant maker who then refused to answer for it. In 1920 Karel Čapek gave us the word “robot” in R.U.R., from the Czech for forced labour. Both stories end in catastrophe for the same reason. The makers built the power and forgot the responsibility.
We do not have to repeat that ending. OpenShell shows that power can be housed. Sheaf shows that reasoning can be measured. The payment networks show that identity can be bound to action. What remains is the hardest part, and it is human.
Physics offers an image for it. Break a hologram and each fragment still holds the entire picture, only at lower resolution. Each human being is that fragment of humanity: complete, irreducible, carrying the whole. When a person in a bank, a hospital or a newsroom clears a red signal that an agent cannot clear for itself, the full judgement of our species passes through that one decision. A hundred machines may stand beside each of us. Not one of them can stand in for us.
The knight Leonardo drew could only raise its visor. Ours can sign contracts. The question is no longer whether the machines will act. They already do. The question is whether we will build, this quarter, the lines, the signals and the passports that let them act in our name and still keep the world worthy of our trust.
Sources
- Sheaf: About and leadership · How Sheaf works with OpenShell
- NVIDIA OpenShell documentation · NVIDIA developer blog · ADTmag: Agent Toolkit partners · The New Stack: ServiceNow Project Arc · Unimon: OpenShell protection domains
- The Next Platform: Huang on OpenClaw · StartupDefense: OpenClaw advisories · eSecurity Planet: exposed agents · TechBullion: stars and CVE · Dark Reading: shadow IT
- Gartner press release, June 2025 · McKinsey: The state of AI in 2025 · BCC Research · RaftLabs: Grand View figures · Toolradar: MarketsandMarkets figures
- OpenAI: Introducing Frontier · Outlook Business: Frontier · AI Business: Managed Agents · Unite.AI: Managed Agents architecture
- Thurrott: Google UCP · TechRadar: Meta and Manus · The Decoder: Manus revenue · Pulse 2.0: Polsia · AI Weekly: Polsia reviews
- Mastercard Agent Pay launch · Banking Exchange: Citi and U.S. Bank · Stellagent: New Delhi transaction · Fintech Global: Mastercard and Backbase · The Paypers: Start Path cohort · Paz.ai: Agent Pay and protocols
- Visa Trusted Agent Protocol · Didit: identity layer for agentic commerce · Palo Alto Networks: Identity Security Landscape · ITWeb: 79 agents per human · WorkClaw: CSA figures
- Coverager: Allianz Nemo · HLTH: Epic and ECU Health · RevelEMD: HIMSS 2026 · Social Samosa: Meta ads · Tribune: Netflix · AI tutoring evidence, 2026 · Process Excellence Network: EU AI Act
Literature:
- Leonardo da Vinci, mechanical knight studies (c. 1495)
- Luca Pacioli, Summa de arithmetica (1494)
- Mary Shelley, Frankenstein (1818)
- Karel Čapek, R.U.R. (1920)
- Sun Tzu, The Art of War
- Dinis Guarda, 4IR and AI for Business.
Share
Dinis Guarda
Dinis Guarda is an author, entrepreneur, founder CEO of ztudium, Businessabc, citiesabc.com and Wisdomia.ai. Dinis is an AI leader, researcher and creator who has been building proprietary solutions based on technologies like digital twins, 3D, spatial computing, AR/VR/MR. Dinis is also an author of multiple books, including "4IR AI Blockchain Fintech IoT Reinventing a Nation" and others. Dinis has been collaborating with the likes of UN / UNITAR, UNESCO, European Space Agency, IBM, Siemens, Mastercard, and governments like USAID, and Malaysia Government to mention a few. He has been a guest lecturer at business schools such as Copenhagen Business School. Dinis is ranked as one of the most influential people and thought leaders in Thinkers360 / Rise Global’s The Artificial Intelligence Power 100, Top 10 Thought leaders in AI, smart cities, metaverse, blockchain, fintech.
