The Machine-Mediated Economy

Non-human traffic passed human traffic on Cloudflare's network in May 2026 — eighteen months earlier than Cloudflare itself expected.

On 3 June 2026 CEO Matthew Prince posted that bots had passed humans online for the first time: "Thought it would be end of 2027, then early 2027, but agentic traffic growing so fast." Cloudflare Radar sees roughly a fifth of the web's sites, which is what makes the reading a large sample rather than a census MEASURED ^[1]. On the 6 August earnings call Prince told investors more than half of Q2 network traffic was not human; CFO Thomas Seifert said he had been "quite surprised" when the crossing arrived in May ^[2].

Seifert then extrapolated: if trends continue, non-human traffic could reach 1,000 times human traffic within five years, making humans "a rounding error on the internet" — with his own caveat attached, "I have called it wrong at every point along the way" FORECAST ^[2]. That is a conditional extrapolation, and it comes from a company that sells mitigation for the traffic it forecasts. It also concerns request volume rather than users, bandwidth or value — a reading I infer from Cloudflare's request-based reporting, not something Seifert said. The interesting quantity was never how many machines are online. It is how many machine actions one human intention sets in motion.

Executive synthesis

Momentum is strong; transactional autonomy is still early.

Three curves are accelerating together — machine traffic, enterprise spending, standardization. A fourth, machines completing transactions, is not moving. The transition is not "more bot traffic" but the conversion of cheaper intelligence into authorized machine action: value migrating from the model call toward context, authority, verification, distribution and completed outcomes. Humans move up to the orchestration layer, where intent, capital, authority and accountability still originate.

• 57.5% Automated share of HTML page requests seen by Cloudflare Radar, vs 42.5% human Cloudflare Radar, 3 Jun 2026 MEASURED
• 16% / 27% Enterprise / startup production deployments qualifying as true agents rather than fixed-sequence workflows Menlo survey, n=495 US enterprise decision-makers, fielded 7–25 Nov 2025 MEASURED survey
• $3.6B Salesforce's agreed price for Fin, the customer-agent company formerly known as Intercom (renamed May 2026) Announced 15 Jun 2026 · pending close, expected Salesforce fiscal Q4 2027, subject to regulatory approval COMPANY CLAIM

Reading note. Traffic datasets are not a census of the internet; they are large but selected networks observed by vendors who sell into what they measure. Every stat card, chart and timeline entry below carries exactly one badge: measured, company claim, forecast, or my inference. Funding and revenue figures in the sector cards are sourced but unbadged — they are public company disclosures, read as such.

Evidence: discovery went machine-mediated a year ago; checkout has not moved

In HUMAN Security's benchmark reading for December 2025, published March 2026, checkout pages were 2.3% of agentic activity against 77% for product and search ^[3]. Four readings across seven months later the ratio has not improved — and I track it monthly precisely because it is the number most hostile to my own thesis.

One June figure deserves more attention than it has had: HUMAN's blocking rate — the share of observed agentic requests that sites refused — rose from 8.9% in May to 21% in June 2026 — roughly tripling, per HUMAN's June post MEASURED ^[4]. The web is starting to refuse agents at scale: a demand signal for the authority layer and a headwind for the execution layer at once.

The mechanism: intent amplification

One human intention now generates a rising number of machine requests. That ratio — machine requests or tool calls per human intent — is the quantity this thesis turns on, and I call it the amplification ratio. Nothing public measures it directly. Its retrieval component is measurable, and the measurement is startling.

Cloudflare publishes a crawl-to-refer ratio per AI platform: HTML pages a platform fetches for every human referral it sends back. Read directly off Cloudflare Radar's live AI Insights chart for the 28 days to 17 August 2026, the five comparable platforms run Google 5.1, Microsoft 39.1, OpenAI 462.8, Perplexity 723.4, Anthropic ~1,200. Median 462.8, geometric mean ≈152 INFERENCE arithmetic mine; ratios read from Radar's live chart on 17 August 2026 ^[7]. So one human arriving from an AI-native platform sits on top of roughly 460 to 1,200 machine page fetches by that platform — the search engines, which still send real referral traffic, are the outliers at 5.1 (Google) and 39.1 (Microsoft), and that gap is itself the story. That is amplification at the retrieval layer alone, before any tool call, database read, payment authorization or verification the agent performs once the human acts. The measurable part is two to three orders of magnitude, and it is the smallest part.

Two caveats: crawl-to-refer is a per-referral proxy, not a per-intent measurement, and the readings vary by an order of magnitude with the window, falling fast from the tens of thousands Cloudflare measured for some platforms in August 2025 — the live chart's own period-over-period swings (Anthropic −47%, Perplexity +227%) make the same point ^[7]. A range is the honest output, and the admission that no dataset measures intent directly is worth more than a decimal place.

Scarcity migration. Seven new scarcities are usually listed as equals. They are not. Binding hardest through 2027: verified authority-to-act — not "who is this agent" but "on whose behalf, for what purpose, on which resource, under what limits, provable afterwards." Most deployments that stall in pilot stall here. Binding second: proprietary exception and outcome data, the record of what went wrong, what it cost and what fixed it. It is the only asset in the stack a better model makes more valuable, because a more capable agent absorbs the normal path and leaves exceptions as the whole remaining problem. And one false scarcity: bare agent identity, which felt like a category in early 2026 and is becoming a feature of the identity platform you already own — Okta announced 25+ Cross App Access integrations on 23 June 2026, positioning an OAuth extension as an authorization extension for the Model Context Protocol ^[8], and Cisco closed Astrix while SailPoint closed Entro on the same day, 29 June ^[9][10]. If your product is an inventory of non-human identities, your buyer's IAM vendor is shipping it.

The unit of value, and who eats the reversal. Outcome pricing is well established as aspiration, poorly established as practice. Fin charges $0.99 per resolution, HubSpot cut Breeze to $0.50 per resolved conversation on 14 April 2026, Zendesk bills automated resolutions without publishing a rate ^[11][12] — but look at what "resolved" means. Fin: no further help requested. HubSpot: no human handoff within 72 hours, per its product documentation rather than the pricing announcement. Zendesk: no escalation. None prices the reversal of a resolution. That is a liability question, not a pricing one: when a completed case is later reversed, who eats the loss? Until that is contracted, outcome pricing is a billing label rather than a risk transfer.

New gatekeepers. Agent platforms can influence which sources are read, which merchants compared, which tools called and which rails used; the powers of search, app store and payment network may converge in one place for the first time. Meanwhile unit prices keep falling — OpenAI cut GPT-5.6 Luna by 80% and Terra by 20% in July 2026 while leaving the flagship tier (GPT-5.6 Sol, $5/$30 per million tokens) unchanged ^[13]. That is tier compression plus an up-sellable frontier, not uniform deflation: the cheap end gets cheaper, the frontier holds its price, and neither creates a moat for anyone building on top.

Value map: five layers, and how much of each is already annexed

The layers are not alternatives; the strongest companies combine two or more. By August 2026, some of them are no longer available to build in.

• InputCONTESTED

  Goals, budgets, risk appetite, approvals, accountability

  still mostly human and organizational

• ContextCONTESTED

  Current state, business objects, rules, exceptions, source trust

  permission-aware context planes are funded and growing, but hyperscaler bundling is live

• AuthorityCLAIMED

  On whose behalf, for what purpose, on which resource, under what limits

  Cisco/Astrix, SailPoint/Entro, Okta Cross App Access ^[8][9][10]

• ExecutionCLAIMED (basics)

  Cross-system action, exception handling, real-world completion

  AAIF standardization and hyperscaler orchestration removed scarcity from connectivity ^[14]

• EvidenceOPEN

  Expected result, reconciliation, replay, rollback, dispute, audit trail

  the least-covered layer in the stack

The Evidence layer is an insurance market wearing engineering clothes. The industry treats verification as an evals-and-observability problem; that is a category error. Reconciliation, replay, rollback, dispute and underwriting of agent error describe a liability market: someone prices the probability that an authorized machine action was wrong, then stands behind the price. It is economically separable from the execution vendor for the reason auditors are separable from the firms they examine — a verifier paid by the party whose work it verifies is not selling assurance, it is selling a receipt. The buyer of assurance is whoever bears the loss: the merchant, the insurer, the regulated operator. Different budget, different buyer. Signifyd already works this way, assuming chargeback liability on approved orders including shipping and fees, and reporting AI-agent-referral orders up 1,247% year over year as of October 2025 COMPANY CLAIM vendor's own network, vendor sells the protection, and a growth rate off an unstated base is not a level ^[15].

What must a startup own to survive annexation? At least one of three things: proprietary exception data the incumbent cannot regenerate, regulated-workflow liability the incumbent will not accept, or physical fulfilment the incumbent does not perform. Everything else is a feature waiting for a platform product manager to notice it.

Sectors: where the friction is

These matter not because they are "AI sectors" but because they contain economic friction — high labor cost, a clear definition of done, repeat transactions, fragmented data, material error costs. Companies named are publicly documented examples, not endorsements; I hold no position in any of them.

Market structure: what actually closed

Closing status matters more than announcement volume, so every entry states it.

1. 9 Dec 2025

   Linux Foundation formed the Agentic AI Foundation around Model Context Protocol, AGENTS.md and goose; the 2026-07-28 MCP specification added authorization hardening ^[14]

   CompletedProtocol → common layerCOMPANY CLAIM

2. Oct 2025 → Mar 2026

   Cisco's AI Readiness Index 2025 (survey of 8,000 senior IT and business leaders at organizations with 500+ employees, published 14 October 2025) had already found that only 24% of organizations could control agent actions with guardrails and live monitoring MEASURED survey; base is all surveyed organizations ^[34]. In March 2026 HUMAN reported monthly AI-driven traffic up 187% across Jan–Dec 2025; separately, agentic traffic grew 7,851% year over year from a very small base. Both observed across HUMAN's global customer base — a large observed network, not a census of the internet ^[3]

   PublishedBot → agent

3. 26 Mar 2026

   Zendesk completed its acquisition of Forethought, all cash, terms undisclosed — a per-outcome vendor absorbed by a larger per-outcome vendor ^[35]

   CompletedOutcome → incumbentCOMPANY CLAIM

4. 10 Jun 2026

   Visa and OpenAI announced tokenised credentials and real-time authorization for agent-initiated payments, bound by user-set limits and merchant categories ^[24]

   AnnouncedAuthorization, not railCOMPANY CLAIM

5. 15 Jun 2026

   Salesforce signed a definitive agreement to acquire Fin (ex-Intercom) for approximately $3.6B ^[36]

   Pending close — expected Salesforce fiscal Q4 2027, subject to regulatory approvalOutcome layer pricedCOMPANY CLAIM

6. 29 Jun 2026

   Cisco completed Astrix (announced 4 May) ^[9] and SailPoint completed Entro (announced 15 June) ^[10] on the same day. Reported at ~$400M and ~$200M by Calcalist; neither acquirer disclosed a price

   Completed (dates primary-verified; prices press-reported only)Identity → authorityCOMPANY CLAIM

7. 22 Jul 2026

   Alphabet bundled agent building, cost management and governance into Gemini Enterprise and disclosed roughly 22B model tokens per minute ^[37]. The metric hyperscalers disclose is still throughput, not outcomes — precisely the gap this thesis argues will close

   ReportedBundlingCOMPANY CLAIM

8. 2–7 Aug 2026

   Cloudflare Agents Week 2: agent identity and spend-limited wallets, following the 1 July Monetization Gateway waitlist. What shipped is a handle reservation, with funding and spend controls promised in the coming months — announcements, not shipped products, though flanked by developer primitives (sandboxes, e-mail for agents) that did ship in beta the same week ^[38][39]

   Announced directionAccess → transaction (announced direction)COMPANY CLAIM

9. 16 Aug 2026

   Stripe agreed to acquire OpenRouter — the gateway routing 8M+ users across 400+ models — for a reported $7B+, roughly five times its May 2026 valuation. The payment rail buying the model-routing layer puts routing, metering and settlement of machine work in one company: the Absorption path, running early ^[40]

   Reported — terms not company-confirmedRail → routingCOMPANY CLAIM

Four paths, and the one I hold

Probabilities are my judgement, stated so they can be scored later.

Base — bounded autonomy becomes normal (45%). Agents deploy in selected workflows; human approval, transaction limits, context and evidence standardize. Systems of record remain, systems of action become the operating interface. I hold this path: it is the only one consistent with all four measured series at once — strong traffic, strong spend, weak autonomy, weak checkout. Indicator: Signal 3 climbs while Signal 1 stays flat.

Friction — incidents and weak ROI slow adoption (25%). Security incidents, costly human exceptions and platform bundling suppress general agents; vertical products with measurable savings still work. The blocking rate roughly tripled between May and June 2026, from 8.9% to 21%, per HUMAN's June post — the most concrete early evidence ^[4]. Indicator: Signal 4 stalls at concept papers while blocking rates climb.

Acceleration — reliability improves fast (15%). Agent commerce expands through checkout and post-purchase, outcome pricing grows, authority and machine-commerce platforms become major categories. Indicator: Signal 1 breaks 5%. — necessary but not sufficient: CALL 1 puts that crossing at ~55%, because Base also produces it once the June–August authorization infrastructure runs a shopping season. Acceleration needs the crossing plus outcome pricing and authority platforms scaling with it, which is why the path sits at 15% and the call sits at 55%.

Absorption — the null path (15%). Autonomy stalls at pilot scale on reliability and liability; hyperscalers and infrastructure incumbents absorb context, authority and verification as bundled features, and no layer becomes independently investable at venture scale. This is the path most under-weighted by people who work in venture, including me, and the evidence is already on the board: two of 2026's three authority deals were absorptions. Indicator: Signal 5 stays negative through 2027 with no independent authority vendor passing $100M ARR.

What others say, and where I differ

Bessemer, "systems of action" (May 2025). The systems-of-record to systems-of-action framing and the argument that agents are priced against labor budgets rather than software budgets originate here; much of section 6 stands on it ^[41]. What it does not cover is the governance and verification economics of systems of action — who underwrites the action, and who pays when it is reversed. That is the gap section 5 tries to price. Foundation Capital's "service-as-software" coinage is theirs and I use it throughout ^[42]. Sequoia's agent-economy pillars (May 2025): their identity-and-trust pillar and my Authority layer are substantially the same claim, dated earlier by them ^[43].

Ben Thompson, "The Agentic Web and Original Sin" (May 2025). The payable, permissioned web argument is his ^[44]. My departure: Thompson's model prices citation and attention, the publisher-side settlement for content an agent read. If 77% of agentic activity is product and search while 2.3% reaches checkout, the binding constraint is not that publishers are unpaid — it is that transactions do not complete. I expect the payable web to be priced on transaction completion: merchant-side authorization, reconciliation and dispute, not publisher-side micropayments. Visa–OpenAI and Shopify sit on my side of that line; TollBit and ProRata sit on his ^{[24][25][28][29]}.

Gartner's machine customers ($30T of purchases influenced by 2030) and McKinsey's agentic commerce ($3–5T by 2030) ^[45][46]. My quarrel is not with either method but with what gets done with the numbers. Set them beside 2.34% of agentic page requests reaching checkout in June 2026: headline TAMs price the destination, the measured series prices the road.

Signal scorecard

Six signals with baselines, named recurring publications, cadences and thresholds in both directions. Scores are mine, −2 to +2, as of 17 August 2026. The net is +2 across six — the honest picture rather than a uniformly positive one: infrastructure and pricing move with the thesis, the consumer-transaction signal does not, and bundling moves against the claim that these layers are independently investable.

CALL 1 — agentic checkout share exceeds 5% of agentic activity by Q2 2027 (HUMAN series). Confidence ~55%. A bet against my own tracked data: the series is flat to down across four readings while total agent volume grew. I make it because the authorization infrastructure announced between June and August 2026 has not yet had a shopping season to run through. If the share is still under 3% by Q2 2027, the consumer-side machine-transaction thesis is behind schedule and section 4's ranking is wrong — authority-to-act would be binding harder and longer than I assume.

CALL 2 — the share of AI builders offering outcome-based pricing as their primary model stays under 30% through end-2027 (ICONIQ series, currently 23%). Confidence ~70%. Unpredictable exception costs push vendors toward hybrid pricing — platform access plus usage, with safeguards — already the pattern ICONIQ observes. The unit is ICONIQ's, not mine: no public series measures the share of contracts signed on outcomes, so the call is stated in the vendor unit that is actually published and will be scored against it. The uncomfortable part, on the record: that series has run 2% to 18% to 23% in four quarters, so the call needs a steep climb to flatten roughly where it stands ^[47]. It is the least comfortable bet here.

Both calls are scored publicly in every subsequent publication, including if they are wrong.

Regional translation

Europe. Europe's edge is not regulation alone but industrial domain knowledge, an enterprise customer base and real demand for trusted deployment; a European Commission-supported study of January 2026 frames safe, scaled agentic deployment as strategic ^[50]. That thesis must survive a fact three weeks old at publication: the Digital Omnibus on AI, Regulation (EU) 2026/1744, in force 27 July 2026, deferred standalone high-risk obligations to 2 December 2027 and product-embedded ones to 2 August 2028 because harmonised standards were not ready, though most Article 50 transparency duties still took effect 2 August 2026 ^[51]. Europe has postponed part of the regulation that creates the assurance demand its edge depends on — a live risk to the argument, not a footnote.

Türkiye · CEE · MENA

I work inside the Türkiye venture ecosystem, so this section names no Türkiye-based fund and no Türkiye-founded company. Depth comes from public aggregates and arithmetic instead — for a structural argument, the better instrument anyway.

The demand shape comes before the cost story. Eurostat's 2025 ICT survey put enterprise AI use at 20.0% across the EU, up from 13.5% in 2024, with Denmark at 42.0% and Romania (5.2%), Poland (8.4%) and Bulgaria (8.5%) at the bottom ^[52]. TÜİK put Türkiye at 7.5% — the Romania-and-Poland band, not the EU average — but at 24.1% among firms with 250+ employees — a segment that behaves nothing like the national aggregate. The comparison that matters is large-firm to large-firm, and Eurostat's 250+ band sits well above both; the honest reading is that Türkiye's adoption gap is a mid-market gap, not a capability gap ^[53] MEASURED both are national-statistics-office surveys of enterprises with 10+ employees, so they are definitionally comparable. The same bulletin measures the blocker this thesis's Evidence layer prices: among Turkish enterprises that considered AI and held back, 62.4% cited legal uncertainty over who bears liability when AI use causes harm ^[53] MEASURED. The constraint is neither talent nor cost: the domestic mid-market is not buying yet. That favours outcomes sold to a few hundred large buyers, and disfavours self-serve seat-based tooling sold to thousands of small ones.

Then the cost arithmetic, because it changes what a product can afford to get wrong. Take a vendor contracting to do the claims-adjudication work of ten US claims-processing FTEs. The US median wage is $49,230 (BLS OEWS, 2025 wage year) ^[54]; loaded at the March 2026 ECEC wage share of 69.9%, that is ≈$70,400/yr ^[55], so the buyer's status quo is $704,000. Price the contract at half, $352,000, machine COGS at 12% of revenue. The exception desk then costs $70,400 per FTE in the US, ≈$26,700 in Romania (Eurostat 2025 labour cost €13.6/hour, EUR/USD 1.156, 16 Aug 2026) ^[56] and ≈$19,000 in Türkiye (TRY 65,000/month gross mid-point, loaded at TÜİK's 85.7% earnings share, USD/TRY 47.9, 15 Aug 2026) ^[57][58].

The counter belongs in the same breath as the number: this is a floor-raiser, not a moat. It is rentable by anyone — a US vendor can hire the same desk tomorrow — and it decays exactly as fast as the models improve, because as the exception rate falls the advantage shrinks toward zero. The arbitrage buys time to build something durable. It is not the durable thing.

What is not rentable is regulatory workflow. Türkiye rebuilt its cross-border data regime in 2024 along GDPR-shaped lines with one operational difference: the standard contractual clauses must be used verbatim, and every signature, amendment or termination must be notified to the Turkish data-protection authority within five business days ^[59]. GDPR clauses are a document you sign and file. Türkiye's are a document you cannot edit and must report on a clock. That is not a legal opinion; it is a workflow with a deadline, an owner and an audit trail — which is to say, a product. The Gulf multiplies it: one UAE enterprise deal can touch three data-protection perimeters (federal, DIFC, ADGM) with a sector regulator overriding all of them on storage location, while Saudi Arabia's PDPL transfer regulation restricts export absent specified safeguards ^[60]. A shipment moving TR→EU→GCC adds an origin determination under a 1996 customs-union text covering industrial goods only, a per-country road-permit regime, and a pre-arrival conformity certificate keyed to a foreign tax record. Duty-free is not paperwork-free: €217.6bn of goods crossed the TR–EU border in 2025 at a zero tariff and a full document ^[61]. None of it is intellectually hard; all of it is operationally hard, it changes, and the exceptions are the proprietary data.

Diaspora mechanics, with the competing reading stated. The 2025 Turkish AI ecosystem census reports 1,188 active AI startups in Türkiye and a median 2025 round of $2.4M for diaspora-founded companies, 24× the Türkiye-based median; both groups are predominantly B2B-focused ^[62]. The absolute Türkiye-based median is not published anywhere I could find — 24× implies roughly $100,000 INFERENCE derived as $2.4M ÷ 24, not a published figure. A 24× gap reads at least as well as structural undercapitalisation of Türkiye-based teams — thin domestic growth-stage capital, small local rounds, lira-denominated valuations — as it does as diaspora advantage. Same number, opposite policy conclusion.

Risk: ecosystem census data published by ecosystem bodies tends to over-count, and "active" carries no disclosed revenue, headcount or filing test; a count of 1,188 without a liveness test is a directory. The 24× is also a ratio of medians across two differently constructed samples, one sitting in higher-priced funding markets.

Three precedents worth naming. UiPath, founded in Bucharest in 2005, reported $1.853bn of ARR and its first positive full-year GAAP operating result for the year ended 31 January 2026 ^[63]: the CEE precedent is not that a regional team can be acquired, it is that one can list and compound. Rossum, founded in Prague in 2017, raised a $100m Series A from General Catalyst in October 2021 — then eastern Europe's largest — and was acquired by Coupa on 12 May 2026, terms undisclosed ^[64] — the region's best document-AI asset annexed into a spend-management system of record. Five years from record round to quiet trade sale is section 8's Absorption path with a CEE passport. Presight AI, ADX-listed and majority-owned by G42, grew FY2025 revenue 36.9% to AED 3.03bn, international revenue up 130% ^[65]: the Gulf's version of this thesis is a sovereign-integrator story with audited financials. Meanwhile MEA technology leaders in IBM's 2026 study expect up to 87% AI-agent growth between 2026 and 2027 against a 38% global average FORECAST stated expectation, not measurement ^[66]. The region with the fastest expected agent growth has the strictest rules about where those agents may run.

Stakeholder lenses

Investors — the test that leads.

Does the moat strengthen if models become ten times better and ten times cheaper? If not, nothing else matters. Then: which labor, BPO, loss or delay budget is displaced, and by how much? Ask for the human-exception rate and deployment time as numbers, not adjectives. The public benchmarks are less flattering than the decks: AI-product gross margins run 45% in 2025, revised to ~53% projected for 2026 and 59% for 2027 across ICONIQ's ~300-company panel ^[47], while Bessemer's fastest-growing AI cohort sits near 25% and its more disciplined cohort near 60% ^[48] — against the 75–80% that defined the last decade of cloud software, my read of the standard SaaS benchmark range rather than a figure from either panel. A company showing SaaS-era margins here is either exceptional or counting differently, and diligence is deciding which.

Founders — own economic work, not an interface.

Start narrow, costly, repeatable, with a clear definition of done. Move from copilot to bounded autopilot, from dashboard to action layer. Measure the human-exception rate and full COGS from day one: that ratio is your gross margin in disguise. Build the learning loop from outcome, exception and recovery data — the one asset a better model makes more valuable.

Companies — treat the machine surface as a product.

Websites, APIs, data access and agent actions are one commercial and risk architecture, not four teams. Identify which journeys third-party agents will mediate, measure human, bot and authorized-agent traffic separately, and move toward cost per outcome. Do not surrender the direct customer relationship to an agent platform without knowing the price.

M&A — the strategic assets have changed.

Recent deals favour products that own a workflow end to end; non-human identity, delegation and runtime enforcement; proprietary outcome and exception data with an industry ontology; and implementation capability that turns a legacy product into a system of action. The 2026 pattern: acquirers were incumbents defending a control point, not platforms buying growth.

Careers — domain knowledge plus process plus policy.

The valuable profiles will not merely use models; they will make real work computable and governable: workflow architecture and process compilation, agent product and operations, assurance and evaluation, identity and authorization, cost-to-outcome economics, industrial AI and power systems.

Method, sources and disclosure

Evidence window: Q4 2025 to 17 August 2026. Every figure was re-checked against the linked primary source on 17 August 2026. The sources that gate automated access — HUMAN's reports, Cloudflare Radar's live charts, TÜİK's and BLS's data portals — were re-read directly in a standard browser on the same date. Where a full report itself sits behind a registration form, the source note says so. Source priority: primary company disclosures, official statistics and large observed datasets first; investor research read with its methodology and incentives in mind; forward-looking conclusions are my analysis and badged as such.

Incentives, named. Most datasets here are published by firms that sell into the trend they measure. Cloudflare and HUMAN sell bot and agent detection and monetization; Cisco had just acquired a non-human-identity vendor when its index is cited; Menlo Ventures invests in the application layer its survey sizes and backed Astrix, one of the acquisitions used as evidence; Signifyd sells the chargeback protection whose growth rate it publishes. Vendor numbers are treated as directional, not neutral.

Evidence classes. MEASURED — an observed count or survey result with its population stated. COMPANY CLAIM — a figure a company publishes about itself, unaudited by anyone else. FORECAST — a projection by a named forecaster, with its base year. INFERENCE — my own arithmetic or judgement, inputs shown. Every stat card, chart and timeline entry carries exactly one.

Vocabulary. This thesis uses established industry vocabulary — services-as-software, systems of record vs. systems of action, copilot-to-autopilot — from prior work by others, credited in section 9. The five-layer map, the amplification ratio and the signal scorecard are mine.

Disclosure. This analysis is written in a personal capacity and reflects only public sources. The author works within the Türkiye venture ecosystem; to avoid conflicts of interest, no Türkiye-based fund or startup is named or evaluated in this thesis. The author holds no positions in, and has no client relationship with, any company named.

This is Thesis 01

First thesis in a recurring series. Theses are numbered across topics and published when they are ready, not on a calendar; each carries its own signal scorecard, and a bi-monthly Scorecard re-scores every live scorecard and grades the dated calls in public — including the misses, which are the only ones that teach anything. First Scorecard: October 2026.

The Agents & Margins briefing (English) is launching — until then, follow on LinkedIn

Sources

1. 1.Cloudflare Radar — automated vs human share of HTML page requests (57.5% / 42.5%), reading dated 3 June 2026, and Matthew Prince's public post the same day. searchengineland.com workos.com
2. 2.Cloudflare — Q2 2026 earnings call, 6 August 2026 (Matthew Prince, Thomas Seifert). Quotation verified against the third-party earnings-call transcript; Cloudflare has not published a written transcript. theregister.com
3. 3.HUMAN Security — 2026 State of AI Traffic & Cyberthreat Benchmark Report, March 2026. Observed across HUMAN's global customer base; a large observed network, not a census of the internet. press release
4. 4.HUMAN Security — State of Agentic Traffic, June 2026 edition, published 6 July 2026 (Aviad Kaiserman, Satori Threat Intelligence Team), with the April and May 2026 editions. No July 2026 edition had been published as of 17 August 2026.
5. 5.Menlo Ventures — 2025: The State of Generative AI in the Enterprise, 9 December 2025. Survey of 495 US enterprise decision-makers fielded 7–25 November 2025.
6. 6.Gartner — worldwide AI-optimized IaaS spending forecast, press release 10 August 2026.
7. 7.Cloudflare — crawl-to-refer ratio (Radar metric definition and explainer) and AI crawler traffic by purpose and industry, 28 August 2025; current ratios read directly off Radar's live AI Insights chart (28 days to 17 August 2026). blog.cloudflare.com radar.cloudflare.com
8. 8.Okta — Cross App Access partner announcement, 23 June 2026, and XAA developer documentation. developer.okta.com
9. 9.Cisco — intent to acquire Astrix Security announced 4 May 2026; completion recorded on the same page, 29 June 2026. Price not disclosed by Cisco; approximately $400M reported by Calcalist. calcalistech.com
10. 10.SailPoint — intent to acquire Entro Security announced 15 June 2026; completed 29 June 2026. Price not disclosed; approximately $200M reported. securityweek.com
11. 11.Fin — AI Agent pricing: $0.99 per resolution, $9.99 per qualification, 50-outcome monthly minimum.
12. 12.HubSpot — Breeze Customer Agent and Prospecting Agent outcome pricing effective 14 April 2026 ($0.50 per resolved conversation; $1.00 per recommended lead); the 72-hour no-handoff definition of a resolved conversation comes from HubSpot's Breeze product documentation, not this announcement. Zendesk — Automated Resolutions pricing model, published without a list rate. zendesk.com knowledge.hubspot.com
13. 13.OpenAI — Advancing the price-performance frontier with GPT-5.6, 30 July 2026.
14. 14.Linux Foundation — formation of the Agentic AI Foundation, 9 December 2025; Model Context Protocol specification 2026-07-28. blog.modelcontextprotocol.io
15. 15.Signifyd — agentic commerce data (AI-agent-referral orders +1,247% year over year as of October 2025), post dated 18 May 2026; guaranteed chargeback protection. signifyd.com
16. 16.Sierra — $950M raise at a reported $15.8B, 4 May 2026; Outcomemaxxing, 3 June 2026. Sierra publishes an outcome-pricing policy, not a list price. techcrunch.com
17. 17.Harvey — $200M at an $11B valuation, March 2026.
18. 18.Abridge — Series E, 24 June 2025; platform release connecting care delivery, payment and evidence, 11 June 2026. abridge.com
19. 19.Basis — $100M Series B at a $1.15B valuation, 24 February 2026.
20. 20.Neo (Neo Security, Inc.) — launched from stealth with $100M led by Andreessen Horowitz and Bessemer Venture Partners, 20 July 2026.
21. 21.Glean — ARR crossing $300M, reported by TechCrunch, 28 May 2026.
22. 22.Arcade.dev — $60M Series A, 15 June 2026; authored the MCP authorization specification. businesswire.com
23. 23.Browserbase — $40M Series B, June 2025.
24. 24.Visa — partnership with OpenAI for agent-initiated payments, announced 10 June 2026.
25. 25.Shopify — Spring '26 Edition: Catalog, Agentic Storefronts and the Universal Commerce Protocol. shopify.dev
26. 26.Sardine — $25M Series C extension led by National Bank of Canada, May 2026.
27. 27.Cloudflare — Content Independence Day, one year on, 1 July 2026; pay per crawl (HTTP 402). blog.cloudflare.com
28. 28.TollBit — $24M Series A, 22 October 2024.
29. 29.ProRata.ai — $40M Series B and launch of Gist Answers, 5 September 2025.
30. 30.Crusoe — $1.375B Series E at over $10B, 24 October 2025.
31. 31.Groq — $650M raise announced 22 June 2026.
32. 32.Emerald AI — approximately $25M round with NVIDIA participation, reported March 2026; Silicon Valley Power pilot, April 2026. emeraldai.co
33. 33.Sereact — $110M Series B announced 26–27 April 2026; company-stated intervention rate of roughly 1 in 53,000 requests.
34. 34.Cisco — AI Readiness Index 2025, survey of 8,000 senior IT and business leaders at organizations with 500+ employees, released 14 October 2025. The 24% figure is measured across all surveyed organizations (vs 84% of Cisco's 'Pacesetter' cohort).
35. 35.Zendesk — acquisition of Forethought announced 11 March 2026, completed 26 March 2026.
36. 36.Salesforce — definitive agreement to acquire Fin, announced 15 June 2026; expected to close in Salesforce fiscal Q4 2027, subject to regulatory approval.
37. 37.Alphabet — Q2 2026 earnings call, 22 July 2026. transcript
38. 38.Cloudflare — Cloudflare gives AI agents an identity and a wallet, press release 4 August 2026 (Agents Week 2, 2–7 August 2026).
39. 39.Cloudflare — Monetization Gateway, 1 July 2026.
40. 40.Bloomberg — Stripe agreement to acquire OpenRouter for more than $7B, reported 16 August 2026; corroborated the same day by TechCrunch and Fortune. Neither company had published terms as of 17 August 2026. techcrunch.com
41. 41.Bessemer Venture Partners — systems-of-action roadmap, May 2025.
42. 42.Foundation Capital — Service-as-software.
43. 43.Sequoia Capital — agent-economy pillars, May 2025.
44. 44.Ben Thompson, Stratechery — The Agentic Web and Original Sin, May 2025.
45. 45.Gartner — machine customers to influence or participate in $30 trillion of purchases by 2030.
46. 46.McKinsey — AI agents could mediate $3–5 trillion of global consumer commerce by 2030, October 2025.
47. 47.ICONIQ — State of AI: Bi-Annual Snapshot — The Execution Era of AI, January 2026 (N=269 for margins, N=297 for pricing), and 2026 State of AI Report: The Builder's Economy, July 2026 (~300 executives). iconiq.com
48. 48.Bessemer Venture Partners — The State of AI 2025, 13 August 2025.
49. 49.NIST NCCoE — concept paper, Accelerating the Adoption of Software and AI Agent Identity and Authorization, posted 5 February 2026; comments closed 2 April 2026.
50. 50.StepUp StartUps Consortium (EU-funded initiative) — Agentic AI: Leveraging European AI Talent and Regulatory Assets to Scale Adoption, 23 January 2026.
51. 51.Digital Omnibus on AI, Regulation (EU) 2026/1744 — published in the Official Journal 24 July 2026, in force 27 July 2026; Annex III high-risk obligations deferred to 2 December 2027 and Annex I to 2 August 2028; most Article 50 transparency obligations effective 2 August 2026.
52. 52.Eurostat — Use of artificial intelligence in enterprises, published 11 December 2025 (2025 ICT usage survey, enterprises with 10+ employees).
53. 53.TÜİK — Artificial Intelligence Statistics 2025 (bulletin no. 57945, published 1 October 2025), from the Enterprise ICT Usage Survey. veriportali.tuik.gov.tr
54. 54.US Bureau of Labor Statistics — Occupational Employment and Wage Statistics, May 2025 national table (Insurance Claims and Policy Processing Clerks, SOC 43-9041: median $49,230, mean $52,920).
55. 55.US Bureau of Labor Statistics — Employer Costs for Employee Compensation, March 2026: private-industry wages and salaries were 69.9% of total compensation cost.
56. 56.Eurostat — Labour cost levels 2025, published 31 March 2026 (Romania €13.6/hour, EU average €34.9). EUR/USD ≈ 1.156 as of 16 August 2026.
57. 57.TÜİK — Labour Cost Statistics 2024, bulletin no. 54011, released 25 December 2025: average monthly labour cost TRY 45,777, gross earnings 85.7% of labour cost.
58. 58.EY Türkiye — 2026 statutory minimum wage and employer-cost parameters, 24 December 2025. USD/TRY ≈ 47.9 as of 15 August 2026.
59. 59.KVKK — Standard Contract for the Transfer of Personal Data Abroad; Law 7499 of 12 March 2024 and the Regulation on Cross-Border Transfer of Personal Data, 10 July 2024 (verbatim clauses, five-business-day notification). cms.law
60. 60.SDAIA — Regulation on Personal Data Transfer Outside the Kingdom, August 2024, under the Saudi PDPL; UAE Federal Decree-Law No. 45 of 2021, with DIFC and ADGM operating separate regimes.
61. 61.European Commission — EU–Türkiye trade relationship: customs union covering industrial goods (final phase 1 January 1996); bilateral goods trade €217.6bn in 2025.
62. 62.Yapay Zekâ Fabrikası, with Startups.watch and Endeavor Türkiye — 2025 Türk Yapay Zekâ Ekosistemi ve Global Etki Raporu (summary published January–February 2026). The landing page carries no publication date and the full report sits behind a registration form; census figures here come from consistent press coverage of the summary.
63. 63.UiPath — fourth-quarter and full-year fiscal 2026 results, reported 11 March 2026 (fiscal year ended 31 January 2026).
64. 64.Coupa — acquisition of Rossum announced 12 May 2026; terms not disclosed.
65. 65.Presight AI Holding PLC (ADX: PRESIGHT) — FY2025 results published 12 February 2026.
66. 66.IBM Institute for Business Value — 2026 Tech Leader Study, survey of 2,000 CIOs and CTOs across 33 geographies; MEA figures as reported by Middle East AI News, 10 June 2026.