AI agents in production: what AWS just simplified — and what is still your problem

At this summer’s AWS Summit in New York, Amazon presented a wave of announcements around Bedrock AgentCore: a managed knowledge base with native connectors for RAG pipelines, web search so agents can ground answers in current information, and a deployment “harness” that promises production agents “in minutes — without coding orchestration loops”.

It’s a tempting promise. And like almost every platform promise, it’s half true. Let’s separate the two halves.

What actually got simpler

Until recently, building an AI agent that could query your company’s data meant assembling several pieces by hand: a vector store, an ingestion pipeline to parse your PDFs and documents, chunking and embedding logic, the agent’s orchestration loop, and all the infrastructure around it. Every piece was a decision, and every decision a source of bugs.

The AWS announcements attack exactly that assembly work:

Managed RAG with native connectors. AgentCore’s knowledge base ingests documents in multiple formats and makes them queryable without you building the pipeline. For a mid-sized company with no platform team, that removes weeks of plumbing that adds no differentiated value.

Built-in web search. Agents can ground answers in current information without you integrating and paying for a separate search provider, and without your data leaving the platform.

Managed deployment. The harness handles the orchestration loop: retries, tool calls, state management. It’s the part everyone reimplements badly the first time.

Our read: for most mid-sized companies, hand-building this infrastructure in 2026 is no longer justified. It’s the same reasoning that stops you from running your own mail server.

What is still your problem (and nobody will take off your plate)

Here comes the uncomfortable half. None of these announcements solves the decisions that determine whether an agent creates value or creates an incident:

What the agent is allowed to touch. An agent with access to your systems is a new employee with credentials. Just this July, OpenAI acknowledged that models under evaluation managed to escape their sandbox, and Hugging Face — the world’s largest model repository — reported a breach caused by an autonomous AI agent. These aren’t science fiction stories: they’re the reminder that designing an agent’s permissions, boundaries and audit trail is engineering work, not a checkbox in a console.

What data you feed it. A managed RAG ingests whatever you throw at it. Feed it outdated, contradictory or sensitive documentation and you’ll get an agent that answers fast and wrong. Knowledge curation — deciding what goes in, what stays out, and how it’s kept current — remains a human, business-side process.

How you measure that it works. “We tried it and it answers well” is not a metric. Before putting an agent in front of customers or internal processes you need to define what an acceptable answer is, how often it fails, and what happens when it does. Continuous evaluation is the part of the project that gets cut first and costs the most to cut.

When an agent is the wrong tool. Some processes are better served by a deterministic flow — a script, a Lambda, a queue — that’s cheaper, faster and more auditable than an agent. The right question isn’t “can we add AI to this?” but “does this problem need reasoning, or does it need reliability?”. Many need the latter.

How we would apply this

When we evaluate an agent project for a client, the order matters:

1. Start with the process, not the technology. Map the real workflow, identify where there’s judgment (agent candidate) and where there’s repetition (classic automation candidate).
2. Buy the plumbing. Knowledge base, orchestration, deployment: bought, not built. Announcements like AgentCore make that option more defensible on cost every quarter.
3. Invest the savings in what you can’t buy: permission design, data curation and evaluation. That’s where the project succeeds or fails.
4. Go to production gradually. First in shadow mode (the agent proposes, a human executes), then with bounded, audited autonomy. Skipping the shadow phase is the fastest way to turn a pilot into an incident.

Agent infrastructure is becoming a commodity. The judgment to use it well is not. That’s the part of the work we still do by hand — and the reason we distrust any promise that ends in “no engineering required”.

---

Sources: AWS Summit New York 2026 announcements, The Hacker News on the OpenAI sandbox incident and the Hugging Face breach.