Salesforce closed its most recent quarter with 7 billion Agentforce Work Units on the board and $1.5 billion in annual recurring revenue attached to them. Two numbers. Presented as proof of momentum. Neither one tells you whether a single agent, on a single customer's tenant, completed a single task correctly.
That is not a rhetorical jab. It is the entire diagnostic. When I pulled the third-party data sitting next to the vendor's numbers, the picture inverted. MIT's NANDA group found that 95% of enterprise GenAI pilots failed to reach expected results. S&P Global, working with MIT, found that 80% of organizations have embedded AI somewhere in their stack but only 31% are running agents in production. Gartner's analyst line was blunter still: most of these deployments are hype-driven, and roughly 40% will be cancelled outright.
So $1.5 billion in ARR and a 95% pilot failure rate are describing the same market at the same moment. That is not a contradiction. It is a metering problem. And metering problems in software are never just accounting problems. They are architectural problems that eventually surface as security problems.
I have watched this exact failure mode play out before. In 2020, TVL was the metric. Every protocol printed it, every aggregator ranked by it, every fund underwrote against it. Then a protocol with $2 billion locked got drained in under four minutes, because nobody had measured the thing that actually determined survival: how fast capital could exit. The number was real. It was just the wrong number.
Context: What an Agent Actually Is, Mechanically
Here is where the industry's measurement instinct fails at the root, before any dashboard is built.
Most decision-makers still model an AI agent as a smarter function call. Input in, answer out, billed by token. That mental model died the moment agents started reaching for tools.
What actually executes at runtime is closer to a state machine with a verifier bolted to the back. The agent proposes an action. It calls a tool — a database write, an API, a payment rail. It observes the result. It compares that observation against an internal success criterion. If the criterion fails, it re-plans and runs the loop again. Architecturally this is the ReAct family of patterns, or Reflexion, or a generator-verifier split. The names vary. The shape does not. Plan, act, observe, critique, retry.
That loop is expensive, and the expense sits nowhere near where the pricing models assume. McKinsey's number is the one that should have stopped the room: roughly 60% of agentic spend goes into iterative response optimization — the checking, correcting, and improving cycles — rather than into the initial generation of an answer. Sixty percent of your budget is being consumed by the agent arguing with itself.
If you have spent real time in smart contract engineering, that number feels familiar in your chest. It has the same shape as gas. The first computation is cheap. It is the reverts, the retries, the fallback branches, the defensive assertions layered at the bottom of the receipt that eat the money. The gas isn't the problem — it's the friction of poor architecture. An agent that needs twelve reflection rounds to schedule a meeting is a contract burning 400,000 gas to move a token balance. The work is trivial. The structure wrapped around the work is not.
This reframes the entire economics of the category. The competitive axis is not model intelligence. It is loop efficiency. Whether an agent lands a correct outcome in one pass or nine — better first-shot reasoning, a stronger verifier model, aggressive reuse of cached context — determines unit cost far more than parameter count ever will.
And yet the accounting the industry invented for this architecture measures none of it. Which brings us to the unit of account itself.
Core: The Unit That Measures Nothing
Let me be precise about what AWU is and is not. It is not tokens. It is not tasks completed. It is not outcomes verified. It is an internal activity counter, and by construction it cannot be compared against Microsoft's numbers, or Google's, or ServiceNow's, because those vendors do not publish in AWU.
Read that as an engineer rather than as an investor. A unit of measurement that cannot be referenced against any other unit of measurement is not a unit. It is a narrative device with a decimal point and a quarterly slide.
The technical justification for a proprietary metric is usually stated as transparency: agent internals are too complex to expose cleanly. That argument has a specific hallucination in it. What is genuinely hard to expose is the reflection loop — the retry count, the verifier failures, the context growth per hop. That is exactly the layer where a vendor's margins live or die. So the metric that gets published measures activity, and the metric that would measure efficiency stays private.
AWU is not the disease. AWU is the symptom of a deeper fact: the agent output is a stochastic process, and classical enterprise KPIs were built for deterministic ones.
"Records processed per hour" works for a batch job because the batch job does the identical thing every run. Point that number at an agent and it becomes decoration. An agent that "processes" 4,000 support tickets and gets 900 of them wrong has a gorgeous activity figure and a negative economic contribution. Nobody looking at the dashboard can see the difference.
Variance is intrinsic here, not noise to be smoothed away. Sampling temperature, tool latency, context contamination, and multi-step error accumulation all push parallel runs apart. Same agent, same prompt, different trajectory. Multiply that variance across a hundred-step workflow and the tail is where your incidents live.
This is why the field has splintered into five metrics measuring five separate stages of one pipeline — adoption rate, task volume, token consumption, deflection rate, satisfaction score — and why none of them reconcile with each other. Each one is compressing a distribution into a scalar, and each is compressing a different slice of it. Code that doesn't survive contact with production variance isn't ready for mainnet reality, and neither is the metric that collapses under the same variance.
Now let me tell you where this stops being an accounting argument.
Core: The Attack Surface Nobody Meters
Earlier this year I integrated an LLM-based agent framework with a privacy-preserving zk-rollup. The objective was unremarkable. Let autonomous agents consume price and event data from an oracle feed and execute conditional on-chain actions against a delegated session key.
The interesting part arrived during adversarial testing, which is the only part of agent development that has ever interested me.
I found a prompt-injection pathway routed through the oracle data feed itself. The agent treated a crafted payload embedded in the feed as instructions rather than as data. Because the agent held signing authority delegated by the user's session, the injected instructions steered transaction outputs toward attacker-controlled addresses. In simulation, total exposure reached $2 million before I terminated the run and filed the mechanism.
The mechanism matters less than the response. When I published the writeup, the first question every product team asked was not "how do we detect this." It was "does this show in our dashboards."
It did not. It could not. Every metric those teams tracked was an activity metric — tokens consumed, calls made, tasks attempted, latency averaged. Not one of them measured whether the agent had been induced to act against its principal's intent. Vulnerabilities aren't captured by throughput numbers. They are captured by adversarial testing and by explicit integrity metrics: input provenance, authorization scope, deviation from declared intent.
The industry's entire measurement apparatus is blind to the one class of failure that moves money.
And look carefully at where the money-moving agents are actually being deployed. The same dataset says the most measurable ROI consistently appears in back-office automation — document handling, invoicing, reconciliation, compliance filing. That is the best-performing scenario and the least glamorous, which is why more than 50% of GenAI budget is chasing sales and marketing instead, where the optics are better and the attribution is mushier.
But back office is precisely where financial authority lives. An agent that reconciles invoices can move funds. An agent that files compliance documents can manufacture legal exposure. The highest-ROI deployment surface and the highest-consequence deployment surface are the same surface. Optimization isn't about shaving cost — it's about respecting the user, and in a system holding signing authority, respecting the user means measuring the failure modes that can hurt them.
McKinsey's own data puts 93% of enterprises over budget on this. That overrun is not waste in the abstract. It is the reflection loop, billed. Sixty percent of spend going into self-correction means the vendor's token-based or activity-based pricing model is transferring the cost of its own architectural inefficiency onto the buyer, while the buyer's dashboards show a healthy number of "tasks processed."
That is the metering vacuum in one sentence. The party that benefits from the ambiguity also controls the instrument.
Core: What On-Chain Systems Already Solved — And What They Didn't
This is the section where my blockchain background stops being a metaphor and starts being a toolbox.
On-chain systems have spent a decade solving exactly the problem agentic AI just rediscovered: how to produce a verifiable, non-self-reported record of what autonomous software actually did. The solutions are specific and they transfer.
Execution attestation first. A trusted execution environment or a zk proof over the inference step yields a receipt that a third party can check without trusting the operator. If an agent claims it produced an outcome, the claim is validated against a signed trace rather than accepted from a vendor's slide. This is the same move as shifting from custody-based accounting to on-chain accounting, and it eliminates the same class of lie.
Outcome settlement second. If the buyer pays per verified outcome, the cost of the reflection loop lands on the party whose architecture generated the extra loops. This is the direct analogue of gas: the executor pays for the computation it consumed. A cost-per-outcome contract is just a metering contract with teeth, and it aligns vendor margin with customer result instead of against it.
Capability confinement third. The exploit I found was not sophisticated. It worked because the agent's signing authority was broader than the task required. Scoped keys, spend ceilings, and allowlisted recipients are the default defensive posture in protocol design and are almost entirely absent from agent deployments. Every refund path, every payment rail, every treasury operation an agent touches should be bounded by construction, not by prompt instruction.
But I am not going to pretend the on-chain toolkit is complete. Verifying a language model's inference is not verifying a hash. zkML is real, and it is expensive — proving cost for a single reflection step can exceed the value of the task being verified. TEEs give you attestation with a hardware-vendor trust assumption baked in, which is a smaller assumption than "trust the dashboard" but emphatically not zero. And none of these tools measure intent. They measure whether the execution matched what was signed. A correctly executed transaction toward the wrong address passes every proof you have.
The honest reading is that cryptographic metering solves the verifiability half and leaves the semantics half untouched. That is still a decade ahead of where enterprise AI accounting currently sits, which is nowhere.
If you can't verify the outcome, you can't price it. And if you can't price it, the only thing left to sell is activity.
That is the trap the entire industry is standing in, and it did not happen by accident.
Contrarian: The Vacuum Is the Product
The consensus framing is that the industry simply hasn't gotten around to standardizing agent metrics yet. That framing is generous to the point of being wrong. The vacuum is not an oversight. It is an asset.
A proprietary unit that cannot be compared to a competitor's number functions as both a migration barrier and a growth-narrative shield. During the window when no shared standard exists, whoever defines "momentum" captures investor mindshare and negotiates pricing on their own terms. That is textbook platform behavior, and it is entirely rational for the vendor. It is also why the loudest calls for standardization tend to come from parties who do not sell the metric.
Which raises the question the coverage almost never asks: who profits from the fog? The analyst shops producing the failure statistics — Gartner, McKinsey, Futurum — are also the institutions selling the framework for interpreting them. Ambiguity is their revenue. Their diagnosis is valuable and their data is the best available, but treat the standardization advocacy as interested, not neutral, the same way you'd treat a gas estimator written by the sequencer.
And the metrics that do exist mask the failures that matter most. Activity counters cannot express error rate. They cannot express overreach. They cannot express whether a delegated signature was used for its declared purpose. There is no accountability standard at all — no shared definition of who is liable when an autonomous agent executes a wrong financial operation in a compliance-sensitive workflow. The cost of the reflection loop has been quietly offloaded to the buyer, and with it the liability.
Measure what is easy to count, and you will eventually be governed by it. That is not a governance problem. It is an engineering one, and engineering answers to adversaries.
The security blind spot sits exactly where the metering blind spot sits. No posted error rate means no attack-rate baseline. No baseline means injected failures look like ordinary variance. Variance is tolerated. That tolerance is the vulnerability.
Takeaway: The Twelve-Month Question
Watch two variables, and watch them on a deadline.
The first is who defines cost-per-outcome. If a credible, auditable outcome standard emerges within twelve to eighteen months, pricing power shifts to buyers and the activity-metric era closes the way TVL did. If it does not, Gartner's 40% cancellation figure stops being a forecast and becomes a self-fulfilling schedule. The second variable is the cost curve of the reflection loop itself. If retry cost does not fall meaningfully — through better verifiers, smaller verification models, or aggressive context reuse — agentic AI stays economically locked to premium, low-volume scenarios and never reaches the middle of the market.
There is a third variable nobody is tracking, and it is the one that will write the incident reports. Not one vendor publishes a verified agent error rate. When that number finally becomes visible — and it will become visible, the way every unmeasured risk eventually does — the industry will discover which of its deployments were assets and which were liabilities.
At Dreamforce this September, count the work units. Then ask what one of them is worth.