The AI Agent Moat Is Real, but Narrower Than You Think

TLDR; over the past 4 months I’ve gone super deep into AI agents and a question swirling in my head this entire time - where are the opportunities to invest and build in the agent space? That has led me to look deeply at where the moats exist in this sector and this article is my current pov. This space evolves quickly and I reserve the right to change my mind, but if I am looking to invest or build in sustainable agent concepts, this would be my guide.

Manus was the Signal

At the end of 2025, Meta acquired Manus for over $2 billion. Manus had crossed $100M in annualized revenue within eight months of its March 2025 launch, running a single product: an autonomous agent that executed long multi-step tasks on a user’s behalf.

The model behind Manus wasn’t proprietary, and Meta didn’t need Manus’s framework patterns either. Manus’s own chief scientist, Peak Ji, had published a detailed 3,000-word blog post in July 2025 explaining exactly how the harness worked: KV-cache optimization, tool masking, external file-system memory, deliberate error preservation. Open source repos reimplemented the ideas within weeks.

So what did Meta pay 20x ARR for? E.g., what was their moat?

Two things, and only the first one is really a moat. The moat: trajectory data from 147 trillion tokens of real-world execution across 80 million virtual-machine sessions. This is proprietary signal that very few can replicate.

The thing that protects the moat: the engineering work that rewrote the harness five times in a year so it could keep ingesting that data at scale without collapsing.

The harness is the scaffolding. What Meta paid for is what the scaffolding collected.

That distinction is the single cleanest deal signal for how to think about value capture in the AI agent.

The “Harness” Category, In Plain English

An AI agent is software that wraps a large language model in a loop - it calls tools, reads data, holds state across multiple steps, and decides what to do next.

The model is the brain. The harness is everything around the brain: tool definitions, memory system, feedback loops that check the model’s work, guardrails that stop it from doing something stupid, evaluation pipeline that measures whether any of this is actually improving.

Claude Code is a harness and when its source code was accidentally leaked we learned it was 512,000 lines of TypeScript across ~1,900 files. Codex (OpenAI) is a harness. Cursor, Windsurf, and dozens of open-source projects like OpenClaw and Hermes Agent are all harnesses.

What are not harnesses are wrappers. These are typically “GPT plus a specialized prompt plus a nice UI” concepts that many investors poured money into over the past few years, most of which is now underwater.

The Thesis

The moat in AI agents is real, but it lives in what the harness captures and accumulates, not in the harness patterns themselves.

Harness patterns such as tiered context, planner/executor separation, sandboxed tool execution, and KV-cache optimization are real engineering techniques that matter, but they’re often documented in public and copied in weeks. Patterns are not moats.

The data harnesses collect that can be used to train the next iteration of the agent is what makes up the moat.

Where the Moats Actually Are

There are really three and most of the “moats” we’ve seen over the last 18 months are variations of the first one.

1. Proprietary data flywheels (most common angle)

This is one moat with three angles: trajectory data, domain-specific evaluation datasets, and curated context engineering.

They all close the same loop where customer use generates training signal competitors can’t access, but they show up at different layers of the stack.

Trajectory data is the complete record of what an agent did on a task: input, reasoning steps, tool calls and responses, the final output, and whether it worked.

Harvey ($190M ARR, $11B valuation as of March 2026), Sierra ($150M+ ARR), and Cursor ($2B ARR) all compound on the this mechanic.

• Harvey knows every legal query that came in, which documents were retrieved, what draft was produced, which edits the lawyer made.

• Sierra knows every customer support conversation, the issue, what the agent tried, what resolved it, what had to escalate.

• Cursor knows every time a developer accepted or rejected an AI suggestion, what the code looked like before and after, what the developer did next, whether the change got reverted hours later.

Evaluation infrastructure is the same flywheel but one layer down. Evals are the training data for a harness where each case is a signal telling you whether a harness change helped or hurt on real tasks customers care about.

Without evals, product teams are flying blind every time the underlying model updates. Eval tooling is a commodity, the moat is the domain-specific labeled data.

For example: senior partners validating legal contracts, staff engineers labeling code review quality, or physicians editing clinical AI outputs. These data are very expensive to reproduce and become a compounding asset over time.

Context engineering is the same flywheel at the application layer.

Atlassian’s Rovo Dev runs across 1,900+ repositories and cut PR cycle times by 30.8% while reducing human-written review comments by 35.6%.

The flywheel: Atlassian engineers using Rovo generate 50,000+ labeled comments, which Atlassian uses to fine-tune a quality-gate classifier, which filters the next generation of Rovo comments. No competitor has that dogfooding loop.

The common angle is that the customers’ use of the product generates the signal that makes the product better for the next customer.

2. Integration depth with systems-of-record (emerging)

This is a different moat from data flywheels and a wedge that enterprise software has always sought - getting so integrated in your customers data environment that it becomes too hard to rip out once it’s wired in.

Stripe’s internal agent “Minions” now merges more than 1,300 pull requests per week in production. It works because it’s wired into Stripe’s unique technical environment and the transaction data surrounding over $1 trillion in annual payment volume.

This isn’t a product Stripe bought, it’s infrastructure they built specifically because no vendor could reach that depth of integration. The companies whose agentic products achieve this depth into customer systems of record are the ones with the hardest-to-break moats because they sit so close to customer data, and that data capture is what enables agents to be improved over time.

3. The emerging platform / control-plane layer (emerging)

Enterprises are staffing internal teams to build agent infrastructure. Ramp’s Project Glass, Coinbase’s Agentic AI “Tiger Team”, and Spotify’s Backstage are internal builds where an enterprise could have bought a commercial equivalent if one existed.

Most companies would prefer to buy vs build so the opportunity is for startups to offer the control plane that allow enterprises to deploy end-to-end agent solutions.

The key here is proximity to emerging standards (MCP, x402, OpenTelemetry for agent traces) AND the platform must have a data-capture mechanism that compounds across customers.

Standards themselves don’t make moats. The moat is the data that flows through the standard, and whether your position in the flow lets you capture and use it.

Where the Moats Are NOT

Framework elegance and developer ergonomics. When Claude Code’s source accidentally leaked, a Python reimplementation called claw-code written in a single morning using Codex hit 50,000 GitHub stars in two hours. The fastest-growing repo in GitHub’s history. If your thesis is “we have a good framework,” that framework is reimplementable overnight now.

Generic memory storage. A plain filesystem with a sensible retrieval policy beats most dedicated vector database products on the LoCoMo memory benchmark. The moat is the accumulated data, not the storage technology.

MCP servers. There are over 10,000. Table stakes, not differentiation.

Benchmark leadership without revenue. Much more important that topping scoreboards and public evals is turning early users into data flywheels.

The Counter-Argument

The strongest case against everything above goes like this: “Trajectory data moats get erased every time the base model jumps. What you trained on Claude 3.5 is worthless when Opus 4.6 drops. So there is no moat, just a treadmill.”

Fair point, but I’d argue that not all moats erase on model upgrades.

• Integration depth compounds through model shifts - hard to remove regardless of model upgrades

• Evaluation datasets compound through model shifts - the labeled legal validations Harvey has accumulated stay valuable even when the underlying model changes

• Customer account footprint compounds through model shifts - Cursor is in 50%+ of the Fortune 500 now; a better base model doesn’t evict them from those seats

What does get erased on model jumps is the scaffolding. The clever prompt chains, custom data retrieval pipelines, bespoke planning logic. Those become counter to moats and turn into technical debt.

The investable question is whether the company has built flywheels and integration depth that survive the model treadmill, or whether they’ve built scaffolding that it will flatten.

What Builders Should Do

First: find your angle to capture trajectory data as early as possible. Specifically, design every customer interaction so that acceptance, rejection, edits, and downstream outcomes are captured as structured training signal from day one.

Second: pick the integration depth you’re willing to eat early on. This means you likely need forward-deployed engineers to help integrate into customer systems and plan for this in your economic model. Harvey and Sierra both do this. It’s unglamorous, but it’s the part of the work that can’t be copied.

Third: don’t over-scaffold. If your harness is getting more complex while the underlying models are improving, you’re building something that the next frontier model will likely make obsolete.

The Asymmetry

My current view is that the agent category will reward discipline. The moats will compound on a different clock than the model releases, meaning the generic patterns commoditize quickly but the proprietary data accumulation, integration depth into systems of record, and achieving platform status compound on multi-year arcs.

The gap between these two clocks is a good place to find the investable asymmetry.