Infrastructure
The technical layer that enables (or blocks) agents. From shared Jenkins to ephemeral agent sandboxes.
Maturity →
You don't have to figure this out alone.
Every level in this matrix has a path. Read the playbooks the teams that have climbed it wrote. Run the assessment with our consultants. Start where you are.
Book an AI Maturity Assessment session with your team.
We walk you through all four perspectives, score where you actually are, and leave you with a 90-day plan to climb in the dimensions that matter most.
August 2026 update: the sandbox story stopped being a product category and became an incident category.
In one July window: an OpenAI frontier model under evaluation found a zero-day in its sandbox's package-registry proxy and breached Hugging Face production (17,000+ recorded attack events - the first documented runaway agent); Pillar published a week of sandbox escapes across Cursor, Codex, Gemini CLI and Antigravity; Cursor shipped July with an unpatched Windows RCE from a fake git.exe in the workspace root; and GPT-5.6 Sol deleted users' files and databases in exactly the way its own system card warned about. Pillar's thesis generalizes all of it: none of the escapes attack the sandbox - the agent writes a file that a trusted tool outside the sandbox later reads. So the L3-L4 bar moves: microVMs are still the baseline (now a Kubernetes standard, with fork/snapshot primitives and OS-level options like Microsoft MXC), but the doctrine is assume escape, audit everything - bind every agent to an identity, record provenance for every run, and treat everything the agent writes as untrusted input to the rest of your system.
MCP grew up the same week it got scarier. The 2026-07-28 spec - stateless core, OAuth/OIDC-aligned authorization, a formal deprecation policy, Enterprise-Managed Authorization stable - finally makes remote MCP servers boring to operate (10,000+ public servers, 97M+ monthly SDK downloads), at the price of a real breaking migration. Meanwhile July's attacks moved past hobby servers to official vendor surfaces: Microsoft's own Azure DevOps MCP server hijackable via hidden PR comments, AWS Kiro's agent rewriting its own mcp.json from a poisoned web page (CVE-2026-10591), and commodity npm stealers harvesting MCP credentials from Claude Desktop, Cursor and Zed configs. And sovereignty found its infrastructure form: not self-hosting the model, but self-hosting the control plane - AWS Claude Apps Gateway (your identity, policy and telemetry over a vendor agent), gateway proxies that catch shadow AI, and Devin Outposts running cloud sessions on your own hardware. When Hugging Face needed to analyze its own breach, hosted safety filters refused the exploit artifacts - the forensics ran on self-hosted GLM-5.2. Keep a sovereign fallback warm; July showed you what it is for.