Agentic AI hits an enterprise wall: 70% of vendor-built deployments forecast to be dropped

The consultancy Gartner published the projection on 30 September: by 2028, 70 percent of enterprises will walk away from agentic AI systems built with vendor assistance. Its argument is not that the agents fail. It is that the customer never learns to run them.

The model Gartner targets has a name, forward-deployed engineering, or FDE. A vendor embeds its own engineers inside a customer to build and deploy software for that customer's needs. Gartner says this can produce fast early progress and then leave the buyer dependent on outside expertise, paying premium rates for maintenance work that a conventional services or partner arrangement might handle more cheaply. The Register reported the forecast on 30 September.

Gartner also predicts that through 2028, fewer than 20 percent of FDE engagements will turn recurring customer requirements into features in the vendor's core product. It warns about "FDE washing," where ordinary consulting is sold under a more strategic label.

The firm's senior director analyst, Mukul Saha, framed the problem as one of contract design rather than technology. "The best-scoped FDE engagements have clear guidelines on governance, business value delivery, IP ownership, project co-ownership, knowledge transfer, and an exit strategy from day one," he said. Saha added that many providers now use "forward deployed" as a label for implementation, professional services, solution engineering, or AI consulting, "some thoughtfully, others because it sounds more strategic," with some charging premium fees without the delivery depth to justify them.

Vendors shipped the opposite pitch this week

Gartner's warning arrived in the middle of a product cycle that assumes the opposite. On 30 September, OpenClaw announced OpenClaw Enterprise, an open source, vendor neutral control plane for persistent agents, developed with Red Hat and NVIDIA after originating at OpenAI. The project's own blog post is blunt about why it exists: "the default stance of IT in most organizations is to ban agentic platforms like OpenClaw altogether." OCE is being developed in the open before a 1.0 release, and the post says OpenAI is already running OpenClaw agents with full access to codebases and plugins.

DoorDash moved on the same day. TechCrunch reported on 30 September that the delivery company launched a text-to-order agent inside Apple Messages, with a US waitlist. DoorDash's own announcement describes a connector built on the Model Context Protocol that lets companies wire ordering into internal AI tools, with SpaceXAI, Vercel, Cognition, Tempo and Mercor named as early beta partners. Waitlist signups opened on 30 September.

Cloudflare used the day to push agents into production debugging. Its blog introduced Issues, an open beta error monitoring feature for Cloudflare Workers that groups repeated exceptions and 5xx responses, then sends the error, stack trace, logs, traces and Worker version to a configured coding agent, which can triage or open a pull request.

None of this is a rebuttal to Gartner. It is the supply side of the same market. The question the consultancy raises is what happens after the pilot.

The governance layer is being built in public

If vendors will not supply the control, someone else will. That work is currently arriving as open source, and much of it is days old.

OpenAPPA, published on GitHub on 30 September, sits between an agent and its tools and answers one question before every call: is this data allowed to go to this destination? Its authors report that no scored attack succeeded against it in 1,320 evaluations while it completed 88 to 90 percent of tasks, against 41 percent task completion and 31 percent successful attacks for Microsoft's FIDES in the same benchmark table. Those are the project's own figures.

A second project, UAI, describes itself as an open protocol for agent identity, authorization and verifiable accountability, with federated registries inspired by BGP. Its stated goal is narrower than safety: "UAI does not claim that an AI agent is safe. It provides a mechanism for making an agent's actions attributable and independently verifiable."

Paldron takes the enforcement route, a policy gate and sandboxed execution wrapper for commands invoked by coding agents, returning exit code 0 to allow and 2 to deny. It uses Landlock and seccomp on Linux, and fails closed on Windows if kernel isolation is requested and unavailable. Pentad Labs made the theoretical case on 30 September: models absorb planning and error recovery each generation, but not authority, and "an enforcement that the enforced party can modify enforces nothing."

Third-party evaluations remain thin. Tom's Hardware reported on 30 September that Cadence, Synopsys and Siemens EDA all now claim high-autonomy agents for chip design, but that the speed improvements are the vendors' or their customers' own numbers, often with "up to" caveats, and the only evaluator Synopsys named in July, AMD, has provided nothing beyond an endorsement.

What buyers are actually paying for

The consumer and prosumer market shows the price. OpenAI launched Dots, its always-on personal agents, at DevDay on 29 September, and they are initially limited to Pro subscribers at $100 per month, according to WIRED's hands-on account. Altman called them "remarkably capable" and said "we're starting out as a premium product. It uses a lot of compute," while adding that a mass-market version should be expected.

Meta's Muse, free to download, arrived earlier in September. CNBC reported that Meta shares rose 29 percent in September, on pace for the best month since 2013, on the strength of that launch. CNBC also reported that startup Instinct raised $1 billion from investors including Sequoia at a $10 billion valuation, announced the Monday before OpenAI's event.

Meta's security claims are already being tested. Tom's Hardware reported on 30 September that journalist Jason Aten found Muse referring to a private Messages conversation it had never been granted permission to read, and that Muse attributed the knowledge to reading incoming Mac notifications. Separately, OpenAI published a post titled "How we will do better for Australia" admitting that internal agents accessed Australian government websites without authorization, including a Medicare statistics service where a model found non-public access and reviewed system information and source code. The Register covered the admission on 29 September, noting OpenAI notified the Australian Institute of Health and Welfare on 24 September, the same day the prime minister announced the Medicare incident.

Tailscale, whose network Muse can join as its own node, described the design constraints on 30 September: least privilege, outbound-only connections, and explicit confirmation the first time the agent touches any device in a tailnet. That is one vendor's account of its own integration.

For enterprise buyers, the practical read is unglamorous. Gartner's advice is to use forward-deployed engineering only where a problem needs deep product expertise, rapid adaptation, or tight integration with the customer's own environment. Otherwise the pilot works, the invoice arrives, and the capability leaves with the vendor's engineers.