The Gatsby Summer of AI.

Back up to the stretch the market started calling the agentic turn, roughly late 2024 through 2025. This is the period when the industry stopped bolting language models onto chat windows and started building machines designed from the ground up to act: Anthropic's Model Context Protocol arriving in November 2024 as the first real wiring standard, Claude Code and the broader coding-agent wave through 2025, the skills-and-tools layer maturing on top. The vocabulary shifted from what the model could say to what the model could do, and that shift is not marketing. It is a different category of machine.

The right analogue is not the sleek roadster. It is the Model T. The Model T was a real automobile, purpose-built, mass-producible, the genuine article in a way the things that came before it were not. And it had a cockpit that actively fought the person trying to drive it. There were three pedals on the floor and not one of them was the accelerator you'd expect: left pedal worked the two-speed planetary transmission, center pedal was reverse, right pedal was the brake, and the throttle lived on a lever on the steering column. You started it by retarding the spark with another lever, then walking around to the front and hand-cranking the engine, which would, with some regularity, kick back hard enough to break the cranker's arm. None of the controls were where a modern driver's hands and feet expect them, because the convention for where controls go had not yet been negotiated. The machine was real. The interface was a negotiation still in progress, and the negotiation was conducted, often, in broken wrists.

That is precisely the state of agentic AI's controls, and the security data says so out loud. The machine is real, the harness is not settled. Consider what happens when you point one of these systems at the actual surface a security team works against, which is an enterprise data warehouse with thousands of columns, not a tidy textbook schema. On Spider 2.0, a text-to-SQL benchmark built from real enterprise databases with 3,000-plus columns and the kind of nested, dialect-specific, business-logic-encrusted schemas that an OCSF-normalized security lakehouse actually resembles, the frontier models solve on the order of 6 to 17 percent of tasks (GPT-4 class near the bottom of that range, o1 near the top; Tier B). That is six to seventeen, not sixty and not eighty, and the toy benchmarks where these systems score in the nineties are the equivalent of a test track with no other cars on it. Put the same engine on a real road with real traffic and real intersections and the controls reveal themselves as what they are: unsettled, unlabeled, and capable of putting you in the ditch with full confidence that it took the correct turn.

Even on the friendlier, more mature benchmarks the ceiling is visible and the gap is not closing. On BIRD, a large text-to-SQL benchmark closer to realistic complexity, the best automated systems cluster around 81 to 82 percent execution accuracy on the test set (Agentar-Scale-SQL at 81.67 percent in May 2026, AskData with GPT-4o at 81.95 percent the prior September) against a 92.96 percent human baseline (BIRD leaderboard and the NeurIPS 2023 paper, Tier A). An eleven-point gap is survivable for a Q&A toy. It is not survivable for a control surface, and the part that matters for anyone deciding whether to wire this into a SOC is that the gap has been stubborn. It has not narrowed the way the demo cadence implies it should. The releases keep coming, the leaderboard keeps inching, and the distance to human reliability on realistic schemas has held roughly where it was, so the machine got faster while the steering did not get more trustworthy at the same rate, and on a control surface the steering is what you are actually buying.

The part of the Model T that maps most exactly onto where we are is the one that looks at first like a footnote. The Model T did not ship finished. Ford built a purpose-built, mass-producible chassis and left a startling amount of the car for someone else to supply, and an enormous aftermarket grew up in the gap. Sears sold pages of Model T accessories. People bought aftermarket ahooga horns, the klaxons that became the car's signature sound, because Ford had not built a real one in. That aftermarket was not the sign of a failed product but of a real chassis whose subassemblies had not been standardized yet, a platform good enough to build an industry of add-ons around and unfinished enough to need one. That is exactly the agentic-AI moment. The chassis is real and the aftermarket is roaring: Model Context Protocol servers, agent frameworks, eval harnesses, guardrail startups, observability layers, a whole ecosystem bolting on the components the platform labs shipped without. And the components being sold aftermarket are, tellingly, the safety ones. The horn was how you warned the world you were coming. Today the warning systems, the evals that measure your confidently-wrong rate, the provenance that reconstructs what an agent touched, the human-review gate, are aftermarket parts you buy or build yourself, because the chassis came without them.

The glamour creeps in right here, at the top of this stretch. By late 2025 the capability genuinely turned sleek. The coding agents got good enough that experienced engineers started restructuring their workflows around them, the multi-step tool use started actually completing multi-step tasks, and the whole thing acquired the seductive sheen of a technology that has crossed from "interesting" to "I can't work without it." This is the roaring-twenties part of the story, the part where the car stops being a curiosity that scares the horses and becomes the object of desire, the thing you are judged by for owning, and the seduction is what does the damage. A Model T with the spark-advance lever and the arm-breaking crank does not seduce anyone, since you respect it or you fear it but you watch it, whereas a fast, beautiful machine invites you to stop watching, and that invitation, extended before the restraints exist, is the road to the pool.

Back up one more time, all the way to the start, to 2023 and the chat-era euphoria. GPT-4 in March. The DevDay reveals in November. Search Wars, the great Bing-versus-Google moment, the sense that everything was about to be rewritten. This was the most exciting stretch of the whole story and it was, in machine terms, the most primitive. What we actually had in 2023 was the horseless carriage: a genuinely new engine, dropped into the chassis of the thing it was about to replace, and we were amazed it rolled at all.

The horseless carriage is the literal first form of the automobile, and the name tells you everything about how its makers understood it. It was a carriage, the familiar object, the buggy you already knew, with the horse removed and an engine put where the horse used to be. The body, the wheels, the seating, the entire mental model came straight from the thing it descended from. Nobody had yet asked what a vehicle should look like if it were designed around the engine instead of around the horse. They asked the smaller question, the bolt-on question: how do I put this new power source into the vehicle I already have?

That is exactly what AI-augmented 2023 was, and it is what most of what still ships under the "AI" label remains. A language model welded to a chat window. A model welded to a search box. A model welded to a dashboard as a little sparkle-icon assistant in the corner that summarizes the thing you were already looking at. New power, same vehicle. The SIEM with a chat sidebar bolted on is a horseless carriage. The dashboard with a "summarize this" button is a horseless carriage. They are genuinely useful, the way the first horseless carriages were genuinely useful, and they are limited in exactly the way a carriage is limited: the form constrains the engine, because the form was designed for a different power source and nobody has yet rebuilt around the new one. The dazzle of 2023 was the dazzle of seeing the carriage move without a horse. It was real. It was also the most rudimentary thing this technology will ever be, and we have spent the years since climbing off of it.

So I'll end where the security work actually lives, with the boring infrastructure that the speed has outrun. Early automobiles got fast a long time before they got seatbelts, traffic law, driver licensing, and a liability regime that put the cost of recklessness on the reckless. The cars came in the 1900s. The three-point seatbelt that actually works is a 1959 Volvo patent. The gap was half a century, and it was paid in bodies. The translation to security operations is not subtle. The seatbelt is provenance, knowing which rows the agent read and which it wrote and being able to reconstruct the chain after the fact. The traffic law is a human kept on the adversary's tail, not on the assistant's output, with the model drafting and the analyst deciding, the 4-percent-trust behavior treated as a design constraint rather than a problem to market past. The licensing is measured outcomes, the discipline to run the NL2KQL-style evaluation on your own telemetry and know your own confidently-wrong rate before you wire the thing into a closing action. And the liability regime is accountability, a named owner for what the agent does when it acts, so the cost of the wrong action lands on the party who deployed it rather than on the bystander downstream.

There is a fifth piece, and it is the one we have not started on. Every road sign is a lesson learned in blood. The curve is marked because someone took it too fast and did not come back; the limit is a specific number because that number is where the data said people begin to die. A sign is memory, posted at the exact spot the lesson is needed, so the next driver does not pay for it again. We are not putting up signs, so team after team wiring an agent into production hits the same curves, the silently-wrong query, the confident wrong action, the eval nobody ran, and crashes in private, and the lesson dies in the postmortem instead of getting posted at the bend for the next team.

Build those before you go fast, or at least before you let the car take actions you can't reconstruct. Remember the dazzling summer. It ended with the man who threw the parties floating in his pool, the water gone pink around a few fresh perforations, shot by a stranger acting on a wrong belief about who was driving the car. He had not done the thing he died for; he took the blame for someone else's recklessness, and the someone else drove off untouched into the rest of her careless life. In a SOC, the bystander is the analyst who inherits the silently-wrong query, the on-call who chases the agent's confident dead end while the real intrusion walks, the customer in the breach notification that opens with a clean-looking empty result set. The car is real and it is fast and it is genuinely the best machine we have ever built for this. The seatbelts you can install yourself, today, on your own car. The signs are the harder work and the more important, because a sign is a lesson somebody already paid for in full, posted so nobody has to pay it twice. Road signs are written in blood. Start putting them up.