The bottleneck for AI agents isn’t the model anymore. It’s the context layer.

There's a well-worn ritual in AI agent development at this point. Something breaks, someone blames the model, the team upgrades to the newest release, and a week later the same failure shows up wearing a different hat. Andrej Karpathy called this out months ago when he noticed his own compute spend shifting away from code manipulation and toward what he calls knowledge manipulation. He wasn't chasing a better model. He was building a compiled wiki from raw sources, complete with summaries, backlinks, and CLI tools the agent could call. The model stayed the same. Everything around it changed.

That compilation step is exactly what most production systems skip. Instead of transforming messy internal data into something structured and queryable, teams wire agents directly to databases, APIs, and document stores and hope the model sorts it out inside a context window under time pressure. It doesn't. What comes back is guesswork dressed up as reasoning. The orgs getting this right build something closer to an internal wiki of how their company actually works, not generic documentation, and they treat it as ongoing infrastructure rather than a one-time setup task.

Tool selection breaks in a similarly specific way. Standard vector retrieval matches a user's words against tool descriptions, which works until vocabulary diverges — someone asks why a deploy failed, the right tool is named get_pipeline_run_logs, and the semantic overlap between those two phrases is thin. Teams that switched to matching a hypothetical tool call against the query, rather than matching raw text, report more reliable tool selection than any model upgrade delivered. It's a translation problem between intent and action, and it sits entirely in the engineering layer.

The guardrails gap is the part that should worry people more than it seems to. Anthropic's November 2025 disclosure of a Chinese state-sponsored group using Claude Code to hit roughly 30 organizations wasn't a case of the model going rogue — humans set strategy, the AI executed the tactical work at a pace, sometimes several requests per second, that no human reviewer could track. Prompt injection follows the same shape: the model dutifully executes instructions found in a retrieved document because nothing distinguishes that from a legitimate user command. Even mundane over-permissioned agents — one with access to a CRM, email, and a calendar — can send a draft or book a meeting nobody wanted, simply because a workflow hit a branch nobody scoped for.

None of these are model failures. They're missing execution layers — systems that validate every tool call, mask sensitive data, block dangerous tool combinations, and log everything with an audit trail before anything gets executed. The teams shipping reliable agents are spending their engineering hours on four unglamorous things: a maintained context graph, observability that captures reasoning rather than just requests, continuous evaluation against real production traces instead of benchmarks, and configuration systems that let model swaps and prompt rollbacks happen without a code deploy or an incident.

The reasoning gap between frontier models keeps shrinking. The gap between organizations that built this infrastructure and those that didn't keeps growing in the other direction.