Thoughtworks urges tighter controls as AI agents spread

Thoughtworks has published the latest edition of its Technology Radar, focusing on the controls organisations need as they expand their use of AI agents.

The consultancy argues that the hardest engineering problems now lie beyond the model itself, in the systems around it. These include securing the environments where agents operate, limiting what they can access, maintaining human oversight and managing the cost of running them.

Volume 35 of the twice-yearly report places 11 practices and technologies in its Adopt ring, reserved for the strongest recommendations. According to Thoughtworks, those selections, including agent sandboxing and threat modelling, reflect the growing importance of safeguards for running AI systems in production.

Earlier editions tracked the rise of AI in software engineering and the risks of deploying it at scale. The latest shifts attention to how companies manage those risks as use spreads across development teams and operational settings.

Shift in focus

The report says AI agents are being assigned larger, longer-running tasks, changing the challenge for engineering teams. Organisations now need to treat an agent's surrounding setup, including prompts, tools, memory, guardrails and feedback loops, as a managed system with owners, versions and dependencies.

That theme runs through the report's four main areas. One examines what Thoughtworks calls the engineering harness around the model, arguing that it needs ongoing evaluation, security controls, access management and maintenance as the ecosystem of supporting tools and plugins grows.

Another looks at the use of multiple agents in parallel and for longer-running jobs, such as unattended overnight builds. Thoughtworks warns this can strain human review and software delivery pipelines, increasing the risk that checks become procedural rather than substantive.

The report describes this as "human in the loop theater" and says teams should assess their review capacity before increasing the number of agent-driven tasks. Without meaningful scrutiny, it argues, scaling AI use could undermine confidence in the output.

Model choices

The report also argues that proprietary frontier models are no longer the automatic choice for every workload. It says open-weight models have narrowed the gap for many tasks and can give organisations more deployment options, including running models within their own infrastructure.

That means companies should make more deliberate choices based on each task's requirements, as well as cost, privacy and operational factors. The argument reflects a broader market reassessment of whether the most advanced commercial models are always necessary for day-to-day business use.

Cost is another central issue. Thoughtworks says the economics of AI at scale extend beyond the price of a model to include routing, batching, storage, networking and scheduling.

Many of the changes needed to make AI use sustainable will sit deeper in the technology stack, where models, graphics processing units, storage and networks are managed through a common platform layer, the report says. That places part of the challenge with infrastructure and platform teams, not only software developers or data scientists.

Rachel Laycock, Chief Technology Officer at Thoughtworks, said discussions with clients have changed as AI tools have matured. "Not long ago, the question we heard from clients was how fast agents could write code. Now it's whether anyone can trust, review and afford what they produce," Laycock said.

Her comments reflect a wider shift among companies experimenting with AI-assisted software development, where early interest in speed and automation is being tested against practical concerns over governance, reliability and spending. "Models will keep improving, but lasting value will go to the organisations that invest in the engineering and oversight around them," Laycock said.