Agentic SaaS: How Software Is Rebuilt for AI Agents

Agentic SaaS: The Infrastructure Is Real, But Gartner Expects Most Pilots to Fail

Software built to be clicked and software built to be operated by an AI agent are becoming two structurally different products, and the plumbing that separates them already exists. Anthropic's Model Context Protocol — an open standard for connecting AI agents to external tools and data — has reached roughly 97 million monthly SDK downloads and was donated to the Linux Foundation's Agentic AI Foundation in December 2025, with OpenAI, Google, Microsoft, AWS, and Salesforce now building on top of it. That's the real, checkable evidence behind "agentic SaaS." What's less discussed is that Gartner expects more than 40% of the agentic AI projects built on this new plumbing to be canceled by the end of 2027.

The Actual Infrastructure Change: Software Learns to Expose Itself to Agents, Not Just Humans

The phrase "agentic SaaS" gets used loosely to describe almost any product with a chatbot bolted onto it, but the concrete technical shift underneath it has a specific shape: software is being re-architected to expose a structured, machine-readable interface that an AI agent can call directly, alongside — or instead of — the human-facing dashboard. That's what the Model Context Protocol (MCP) actually is. Anthropic released it as an open specification in November 2024 to standardize how an AI model connects to external tools, databases, and services, replacing the old pattern where every AI application needed a custom, one-off integration for every tool it touched.

The adoption curve since then has been unusually fast for an enterprise integration standard. By mid-2026, MCP's official registry listed more than 9,600 published servers, and independent enterprise surveys — including one from Stacklok — found 41% of surveyed software organizations already running MCP servers in limited or broad production. In December 2025, Anthropic donated the protocol to the newly formed Agentic AI Foundation under the Linux Foundation, with OpenAI and Block as co-founding members and AWS, Google, Microsoft, Cloudflare, and Bloomberg joining as platinum members — a governance move that converted MCP from one company's project into shared, vendor-neutral infrastructure that every major AI provider now builds against.

The clearest evidence this isn't just theoretical plumbing comes from a company actually running it in production: observability platform Honeycomb reported that nearly 20% of its monthly interactive queries are now being made by agents rather than humans clicking through its dashboard — a real, present-tense usage number, not a forecast.

What This Looks Like From the Software Side: Agents as a Second User Type

The practical effect for a SaaS product is that it now needs to serve two fundamentally different users: a human who wants a dashboard, and an agent that wants an API it can reason about and call unsupervised. Gartner's own numbers illustrate how fast that second user type is expected to matter — the firm's August 2025 forecast projected that task-specific AI agents will be embedded in 40% of enterprise applications by the end of 2026, up from under 5% in 2025.

That shift is already visible in how major SaaS vendors have restructured their own pricing and product design around agent-initiated work rather than human logins, as covered in our earlier reporting on the collapse of seat-based pricing. Salesforce's Agentforce, Zendesk's automated resolution tiers, and Intercom's Fin agent all bill by the unit of agent-completed work rather than the number of people with a login — which only makes sense as a pricing model if the software genuinely expects a meaningful share of its usage to come from an agent acting autonomously rather than a person clicking through a UI.

Beyond the Dashboard: Agents Are Getting Their Own Commerce Rails

The shift from click-driven to agent-driven software isn't confined to internal enterprise tools — it's extending into how software transacts with other software and with commerce systems entirely outside a human's direct supervision. A parallel stack of "agentic commerce" protocols emerged over the same window as MCP, built specifically so an AI agent can browse a product catalog, add items to a cart, and complete a purchase without a human clicking through a checkout page. OpenAI and Stripe co-developed the Agentic Commerce Protocol (ACP), which now powers Instant Checkout inside ChatGPT for merchants including Etsy and Coach. Google built a competing, more modular standard called the Universal Commerce Protocol (UCP), publicly endorsed by more than 20 companies spanning payments and retail, including Visa, Mastercard, Walmart, Target, and Stripe itself. Mastercard separately launched Agent Pay for Machines in 2026, explicitly designed to let AI agents initiate and settle transactions — including microtransactions worth fractions of a cent — without a checkout screen ever rendering for a human to see.

That both Stripe and its card-network competitors are building overlapping infrastructure for the same underlying problem — a computer, not a person, deciding to pay for something — is itself evidence this isn't a single vendor's marketing narrative. It's genuinely contested infrastructure that multiple well-capitalized companies believe is worth building in parallel.

The Part Most Coverage Skips: Gartner Expects Most of This to Fail

The genuine counterpoint to the infrastructure narrative above is that building the plumbing for agentic software and actually deploying it successfully are two very different achievements, and the gap between them is currently wide. Gartner predicted in June 2025 that more than 40% of agentic AI projects will be canceled by the end of 2027, citing escalating costs, unclear business value, and inadequate risk controls — and reiterated the same forecast in its 2026 Hype Cycle for Agentic AI, which places the category at the peak of inflated expectations. The firm's own polling found that as of early 2025, only 19% of organizations had made significant investment in agentic AI, while a much larger share were still in wait-and-see mode, even as vendor marketing around the category accelerated sharply.

Part of that gap comes from what Gartner has called "agent washing" — the rebranding of existing chatbots, robotic process automation tools, and simple AI assistants as "agentic" without any of the underlying autonomous, multi-step capability the term implies. Gartner analysts have estimated that of the thousands of vendors marketing agentic AI products, only around 130 are building something that genuinely deserves the label. That distinction matters directly for anyone evaluating a SaaS purchase in 2026: a vendor claiming "agentic" capability and a vendor whose software can actually plan, execute, and recover from a multi-step task without supervision are not reliably the same thing, and the marketing language currently makes no distinction between them.

There's a second, more technical counterpoint specific to the infrastructure itself. Independent security research on the MCP ecosystem has found that a majority of publicly available MCP servers carry exploitable security risk, with only a small fraction implementing OAuth authentication by default — meaning the same standard making it easier for agents to act on software without a human in the loop is, in its current state, also making it easier for a poorly secured integration to be exploited without a human noticing. NIST's AI Agent Standards Initiative, launched in February 2026, is expected to publish an interoperability and security profile addressing exactly this gap by the end of the year, which suggests the industry itself views the current security posture as unfinished.

Even the Commerce Layer Is Pulling Back in Places

The agentic commerce stack has shown its own signs of overcorrection. Reporting in early 2026 indicated OpenAI was stepping back from fully native, in-chat checkout inside ChatGPT, shifting more purchases toward merchant-controlled apps and experiences rather than completing transactions entirely inside the chat interface. That doesn't undercut the broader infrastructure buildout — Stripe, Visa, and Mastercard all continued expanding their own agentic payment rails in the same period, including a live, regulated AI-agent payment demonstration between Mastercard and Santander in Europe — but it's a concrete signal that even the companies building this future are still adjusting how much of the transaction they're comfortable letting an agent complete without a human confirming somewhere along the way.

What This Actually Means for a Team Evaluating SaaS Right Now

"Agentic" is a claim to verify, not a feature to assume. With Gartner estimating only a small fraction of vendors marketing agentic capability are building genuinely autonomous multi-step systems, ask a vendor specifically what happens when their agent encounters an ambiguous or partially failed step — that answer distinguishes real agentic architecture from a chatbot with a new name.

MCP support is becoming a real technical signal, not a checkbox. A SaaS product that exposes a genuine MCP server means an agent can interact with it directly and predictably; a product that only offers a proprietary, closed integration means every agent workflow touching it has to be custom-built and maintained separately.

Security review needs to include the agent-facing layer specifically, not just the human-facing application. Independent research has found most public MCP servers carry exploitable risk, and a poorly secured agent integration can take autonomous action on a system, which carries different consequences than a human clicking the wrong button.

Expect a real cancellation wave, not universal failure. Gartner's 40%-plus prediction is specifically about early-stage, poorly scoped pilots rather than agentic technology broadly — the practical takeaway is to scope a pilot with a defined success metric and a fixed evaluation window before treating any agentic deployment as production-ready.