Three Moves, One Strategic Signal
The timing was not coincidental. In the span of 48 hours spanning May 21–22, 2026, Salesforce, Anthropic, and NVIDIA each announced infrastructure-level multi-agent capabilities for enterprise customers. Each announcement targets a different layer of the agent stack — orchestration, execution environment, and governance — but together they form a coherent picture: the vendors that own enterprise AI by 2028 will be those that own the full agent stack, not just the model.
Salesforce’s Agentforce Coworker, announced by CEO Marc Benioff on May 21, embeds AI across every Salesforce search bar, CRM workflow, Slack channel, and Teams workspace. The business case is already in the numbers: Agentforce has reached $800 million in annual recurring revenue, up 169% year-over-year, across 29,000 enterprise deals, with 2.4 billion agentic work units delivered. The IRS has automated up to 98% of previously manual activities using Agentforce, reducing case opening time from 10 days to 30 minutes. These are not pilot metrics — they are production outcomes.
Anthropic’s multi-agent play is infrastructure rather than application. MCP tunnels, announced at Code with Claude in London in May 2026, allow Claude Managed Agents to connect to private internal systems — code repositories, databases, internal APIs — without exposing those systems to the public internet. A single lightweight gateway makes an outbound connection with end-to-end encryption and no inbound firewall rules required. Self-hosted sandboxes, now in public beta, allow tool execution to run on customer-controlled infrastructure through validated providers including Cloudflare, Daytona, Modal, and Vercel. Anthropic’s annualised revenue has reached $30 billion, with Q1 2026 usage growing 80x against an internal 10x projection.
NVIDIA’s Verified Agent Skills, launched May 22, address the governance layer that both Salesforce and Anthropic need their customers to solve. Portable agent skill sets are scanned for vulnerabilities and prompt injection risks using SkillSpector, cryptographically signed, and documented via machine-readable skill cards specifying ownership, dependencies, limitations, and verification status. The enterprise setup enforces zero-trust and least-privilege rules: skill manifests confine agents to a pre-approved list of tool and workflow actions, with human review required for sensitive operations.
The Gap Between Deployment and Coordination
The market context makes the infrastructure timing make sense. Gartner projects that 40% of enterprise applications will feature task-specific AI agents by 2026 — but also warns that over 40% of agentic AI projects will be cancelled by 2027 due to governance and ROI failures. Salesforce’s own data reinforces the paradox: organisations currently deploy an average of 12 AI agents, but 50% of those agents operate in isolated silos rather than as coordinated multi-agent systems. Only 27% of 957 enterprise applications are currently integrated. Among deployment barriers, risk management and compliance rank first at 42%, followed by lack of internal AI expertise at 41%.
This is the gap all three vendors are targeting simultaneously. Salesforce’s semantic coordination layer — which enables agent-to-agent communication with shared context and structured task delegation — solves the orchestration problem. Anthropic’s MCP tunnels and sandboxes solve the execution environment problem (agents cannot touch internal systems safely without this infrastructure). NVIDIA’s verified skills solve the governance problem (agents cannot be trusted at scale without cryptographic attestation of their capabilities and limitations).
The result is that enterprise buyers in 2026 no longer face a binary choice between “build your own agent infrastructure” and “buy a SaaS chatbot.” They face a modular stack decision: which orchestration layer, which execution environment, which governance framework, and which underlying model or model-routing strategy.
Advertisement
What Enterprise CTOs and Engineering Leaders Should Do
1. Define Your Agent Boundary Catalogue Before Deploying Any Multi-Agent System
The most common failure mode in multi-agent deployments is not technical — it is boundary ambiguity. When agents can call other agents, the attack surface expands exponentially and the auditability of any given decision degrades. Before deploying multi-agent systems, define and document: which systems each agent class is permitted to read, write, or execute against; which agent actions require human-in-the-loop approval; and which data categories (PII, financial, health, legal) are excluded from autonomous agent access entirely. NVIDIA’s Verified Agent Skills framework provides a useful structural vocabulary for this catalogue — skill manifests, capability attestation, least-privilege scope — even if you are not running on NVIDIA infrastructure. Use the vocabulary regardless of vendor.
2. Audit Your MCP Server Exposure Before Adopting Anthropic’s Agent Platform
Anthropic’s MCP tunnels are designed to solve private system access securely, but they require a gateway deployment that becomes a critical path dependency. Before adopting MCP tunnels, audit which internal systems you would connect agents to, whether those systems have audit logging sufficient to capture agent-generated requests, and whether your data residency obligations permit execution in Cloudflare, Daytona, Modal, or Vercel (Anthropic’s current validated sandbox providers). Organisations in regulated industries — banking, healthcare, energy — with strict data residency requirements will need to evaluate the self-hosted sandbox option, which gives control over execution environment but adds operational overhead. This audit should precede the procurement decision, not follow it.
3. Negotiate Agent-Specific SLAs with Vendors — Uptime, Latency, and Rollback
Conventional SaaS SLAs were written for synchronous request-response systems. Multi-agent systems introduce asynchronous task execution, cascade failure modes (one agent’s error propagates to downstream agents), and rollback complexity that conventional SLAs do not address. When negotiating enterprise agreements with Salesforce, Anthropic, or any multi-agent platform vendor, explicitly specify: maximum permitted latency for agent-to-agent handoff; incident response time for agent hallucination or boundary violation events; rollback guarantees for agent-initiated data modifications; and indemnification scope for agent-generated decisions that produce customer-facing errors. Vendors who cannot answer these questions have not yet built their enterprise legal documentation to match their engineering capabilities — a signal worth noting.
The Structural Question: Platform or Infrastructure?
The deeper competition being played out in May 2026 is not between Salesforce, Anthropic, and NVIDIA — it is between two architectural philosophies. The platform model (Salesforce Agentforce) packages orchestration, execution, and governance into an integrated product that enterprise buyers configure rather than build. The infrastructure model (Anthropic MCP tunnels + NVIDIA Verified Skills) provides primitives that enterprise engineering teams assemble into custom agent architectures.
Both models are winning in the current market because the buyer population is split. Large enterprises with existing Salesforce investments are buying Agentforce because it deploys in weeks, not quarters. Sophisticated engineering organisations with multi-cloud architectures and regulatory constraints are buying infrastructure primitives because platforms cannot accommodate their complexity.
The question for enterprise CTOs is not which vendor is winning — all three are — but which model matches their organisation’s capability and risk tolerance. Teams that choose the platform path should negotiate for data portability from day one. Teams that choose the infrastructure path should invest in internal platform engineering before their agent deployment complexity outgrows their governance overhead.
Frequently Asked Questions
What is the difference between Salesforce Agentforce, Anthropic MCP tunnels, and NVIDIA Verified Agent Skills?
Salesforce Agentforce is an application-layer orchestration platform that coordinates agents across CRM workflows, Slack, and Teams. Anthropic’s MCP tunnels are network infrastructure that allows agents to securely connect to private internal systems without public exposure. NVIDIA Verified Agent Skills are a governance framework that cryptographically signs agent capabilities and scans them for security vulnerabilities. They operate at different layers of the agent stack and are not mutually exclusive.
Why did 40% of agentic AI projects fail, according to Gartner?
Gartner projects that over 40% of agentic AI projects started in 2026 will be cancelled by 2027, primarily due to governance failures and inability to demonstrate ROI. The most common causes are boundary ambiguity (agents acting outside intended scope), cascade failures in multi-agent chains (one agent’s error propagates to others), and lack of audit infrastructure for agent-generated decisions. These are not model quality issues — they are deployment architecture issues.
What is an MCP tunnel, and why does it matter for enterprises with strict data residency rules?
An MCP (Model Context Protocol) tunnel is a lightweight gateway that makes a single outbound encrypted connection from an enterprise’s internal network to Anthropic’s agent infrastructure — allowing agents to access internal systems without requiring inbound firewall rules or public API exposure. For enterprises with strict data residency rules, the self-hosted sandbox option allows execution to occur on customer-controlled or partner-controlled infrastructure rather than Anthropic’s cloud, satisfying data sovereignty requirements at the cost of additional operational complexity.
Sources & Further Reading
- Salesforce Announces Agentforce Coworker — Salesforce Ben
- NVIDIA Verified Agent Skills Provide Capability Governance — NVIDIA Technical Blog
- Anthropic Introduces MCP Tunnels for Private Agent Access — InfoQ
- Anthropic Adds Self-Hosted Sandboxes and MCP Tunnels — The Decoder
- AI Agent Adoption in 2026: What the Analysts Data Shows — Joget
- Salesforce Agentforce Enterprise Bet — TechHQ
