The Numbers Tell the Same Story Every Quarter

The July 2026 O’Reilly Radar Trends, published on July 7 by Mike Loukides, frames agents as “team infrastructure” for the first time — not individual developer tools. It’s a meaningful shift in framing. And it lands against a backdrop that multiple surveys describe identically: adoption has outrun control.

A 2026 Forrester survey of 500 enterprises found that 71% lack a formal governance framework for autonomous agents. That same group has 64% planning to increase agent autonomy within the next 12 months. Deloitte’s numbers are similar: 74% of organizations plan to adopt agentic AI; only 21% have a mature governance model. A November 2025 IDC/AWS survey of over 900 organizations found only 3% successfully scaling agentic AI across multiple departments, even as 62% actively experiment.

These aren’t minor gaps. They’re structural — and the July radars explain exactly why they persist.

What the July Radars Are Actually Flagging

O’Reilly’s July radar picks out five software development signals that belong together. Coding agents are gaining team-level features: Devin Desktop, Microsoft Rayfin, and Augment Cosmos all announced shared memory, shared standards, and shared governance features in June 2026. The MCP protocol gained an Enterprise-Managed Authorization extension that lets IT teams manage access policies for MCP servers through existing identity providers. Qodo launched enterprise-scale tooling specifically for governing AI-generated code across multiple repositories.

Loukides’s framing for the development section is precise: “Agents are evolving from solo coding tools to shared team infrastructure: team support, shared standards, governance, and shared context.” That’s the industry catching up with something engineers already knew — a solo agent that writes code nobody else can review is a liability, not an asset.

Microsoft’s bet at Build 2026 made the same argument. Rather than competing on raw model capability, the company positioned Azure Foundry around “governability and reliability.” That’s a vendor reading the same data every enterprise CIO is reading. The separate July Technology Radar flagged a parallel set of concerns: agentic AI governance, agentic AI security, and FinOps for agentic AI all appeared as rising enterprise priorities. LLMOps platforms — Google Vertex AI Evals, Databricks Mosaic AI Agent Eval, Snowflake Cortex AI Observability — have all moved from experimental to production-available in the past quarter.

The Security Picture Is Worse Than the Governance Picture

If the governance data is alarming, the security data is more so. According to the Agentic AI Institute’s 2026 survey, 88.4% of organizations experienced at least one AI agent-related security breach in the past 12 months. The most common incidents were data leakage (50.1%) and manipulation by malicious or untrusted inputs (49.6%).

The O’Reilly radar documents two novel threat patterns that moved from research to active deployment this year. First: malware that embeds references to forbidden topics in its code comments specifically to confuse AI-powered analysis tools. Second: an agent-enabled worm that runs open-weight models on infected machines to generate customized attacks for each new target it finds — effectively giving itself an onboard AI red-teamer.

As we covered in July, shadow agents — AI tools deployed outside IT’s visibility — are already one of the primary vectors for these incidents. The security gap and the governance gap are the same gap, viewed from different angles. Both trace back to the same root cause: agents reaching production before anyone formally owns them.

What the 21% With Mature Governance Are Actually Doing

Deloitte’s finding that only 21% of organizations have a mature governance model is worth focusing on — not as a discouraging statistic, but because it describes a group that is shipping agents that stay in production. The Lovelytics State of AI Agents 2026 report identifies three practices that appear consistently in that group.

First, ownership is named, not implied. Someone is accountable for every agent in production. Not the vendor. Not the platform team. A person, with a name and a Slack handle. Without that, accountability diffuses to nobody.

Second, success criteria are scoped before deployment. Not “improve productivity” but “reduce average time-to-first-response in support tickets by 20%, as measured in Zendesk.” The specificity makes evaluation possible. Without it, agents that drift go undetected until they cause an incident.

Third, automated evaluation runs alongside the agent, not after. Google Vertex AI Evals and Databricks Mosaic AI Agent Eval both exist precisely for this. Organizations using them have a signal when an agent’s behavior drifts. Those that don’t are flying blind through a production system that can take autonomous action on their behalf.

Gartner’s projection that 40% of agentic AI projects will be canceled by 2027 is largely a prediction about organizations that skip this setup. The kills won’t be because the technology failed — they’ll be because there was no clear owner, no measurable goal, and no way to detect that the agent stopped working.

Where to Start if You’re in the 79%

The billing shift the O’Reilly radar flags is worth watching as an organizing mechanism. GitHub Copilot’s move to usage-based pricing — which caused significant pushback from developers in June 2026 — makes agent activity visible in a way that “included” pricing never did. When agent inference shows up on a monthly bill, teams start asking what the agent is actually doing. That question is the starting point for every governance practice that matters.

For teams starting governance from scratch, the MCP Enterprise-Managed Authorization extension is the lowest-friction entry point. It works with existing identity providers and brings agents under the same access control already used for the rest of the stack. That alone closes the most common shadow agent vector: an agent connecting to production systems using credentials no one has reviewed.

The second step is a context lake — a shared store of agent context, decisions, and metadata accessible to the whole team rather than siloed per developer. This is what makes audit trails possible and what turns agent work from an individual artifact into something a team can inspect, inherit, and correct. The tooling for this is early but available; the practices for building it are what most organizations still lack.

The July radars are not pessimistic documents. They describe an industry that has, in the span of roughly eighteen months, moved agents from demos to infrastructure. The governance tooling has followed, with a lag. The question for the second half of 2026 is whether organizations build the processes to use it — before the next round of canceled projects and agent-enabled incidents makes the decision for them.

Further Reading

• O’Reilly Radar Trends to Watch: July 2026 — Mike Loukides’s monthly signal scan; the software development section covers the full breadth of agent infrastructure developments this month.
• State of AI Agents 2026: Governance, Evaluation and Scale — A practical breakdown of what the 21% with mature governance are doing differently from the 79% still catching up.
• Enterprise-Managed Authorization for MCP — The specification for the new protocol extension that brings agent access control under existing enterprise identity systems.