By late 2022 it seemed possible that the direction of travel for AI was towards the personal agent. Specifically, an adaptive, persistent companion that would travel with you across applications, devices and organisations. Your context, your memory, your preferences, working for you everywhere. I bought into that vision, and I still do. But look at what actually shipped.
Siri has been rebuilt as a systemwide agent. Copilot sits at OS level. Gemini runs personal agents in the cloud, working away in the background around the clock. The capability arrived. The interoperability protocols arrived. The multi-step autonomy arrived.
The ownership never did.
Your agent belongs to your ecosystem, not to you. Live in one vendor's productivity suite and you get their agent. Buy a particular phone and another comes bundled with the hardware. Each one knows you deeply inside its own walls and not at all beyond them. Your context, the thing that was supposed to be yours, is an asset on someone else's balance sheet.
This is not the personal agent we were promised. This is agent feudalism. You are not the owner of your agent. You are a tenant. And the rent is your data.
The demand was never the fantasy
If anyone still doubted that people genuinely want a user-owned agent, this year settled it.
The open-source world got tired of waiting and built one. OpenClaw: a self-hosted, persistent agent that follows you across your messaging apps, remembers everything, and acts on your behalf across your files, email, calendar and browser.
It became one of the fastest-growing projects in GitHub history. Not because of marketing. Because it was the thing the platforms kept promising and kept keeping for themselves.
The demonstration nobody ordered
It also became the first major AI agent security crisis of 2026.
Hundreds of vulnerabilities surfaced within weeks. Tens of thousands of instances sat exposed to the open internet. A skills marketplace got seeded with malicious plugins. Prompt injection turned the user's own agent into the attacker's hands. The project's own documentation concedes there is no perfectly secure setup.
I want to be careful here, because none of this is a criticism of the builders. They shipped the capability everyone wanted, faster than anyone expected, and the security lessons of a decade got compressed into a few weeks. If anything they did the industry a favour, because what the episode proved is that the capability was never the hard part.
Everyone built the agent. Nobody built the contract.
Give an agent persistence, memory and the authority to act, and you have created something that can be manipulated, poisoned, or simply confidently wrong, at machine speed, with your credentials. I've spent enough decades watching systems fail to know that this is not a hypothetical; it is a certainty waiting for a date.
The platforms know this. Their answer is to keep the agent locked inside their walls, where they control what it touches. But that is control, not governance. It solves their liability problem, not your ownership problem. Feudalism is not a security model; it is a business model that happens to contain one.
The open-source answer skipped the question entirely and handed us a live demonstration of why it cannot be skipped.
What neither side has shipped is the layer that actually matters. The one that decides what an agent may do, evidences what it did, and fails safely when the answer is no. Not a wrapper. Not a policy PDF. A runtime contract between the user, the agent, and everything the agent can reach.
Where this goes
The models are converging into commodity. The agents are converging into commodity even faster, as this year has made obvious. The moat was never the model, and it turns out it was never the agent either.
The durable layer is the contract. Whoever builds it credibly gets to answer the two questions the industry has spent three years avoiding.
Who owns the agent? And who governs it?
Right now the honest answers are "not you" and "nobody". Neither is a foundation you should build on, whether you are an enterprise deploying agents or a person handing one the keys to your digital life.
The vendors will tell you this is the year of the agent. It might be. But the year that matters is the one when someone ships the contract.