The 99.8% Agentic Claim Is Probably Meaningless — And Still Breaks Your Contracts

A billion users and 99.8% of tokens served inside agentic loops. It is the biggest number of the week and the least verified. The interesting part isn't whether it's true — it's that the arithmetic works out to 99.8% even under assumptions that are far less dramatic than the headline implies. And in either case, every budget line, rate limit, audit trail, and vendor contract your organisation wrote for chat is now describing the wrong product.

What was actually claimed, and by whom

The figure reached us through the Creators' AI weekly digest: OpenAI at one billion users, with 99.8% of tokens served consumed inside agentic loops rather than human chat turns. We have flagged it Unverified for the briefing and we are flagging it again here. There is no primary OpenAI disclosure cited, no methodology, no definition of "agentic," no time window, and no distinction between consumer ChatGPT traffic and platform API traffic.

Note also that this is two claims, not one, and they have very different reliability profiles. The billion-user number is a directional extension of a trajectory that has been publicly narrated for years, and it is the kind of number companies round generously — "users" is not "weekly actives" is not "monthly actives" is not "accounts that paid." It is a marketing denominator.

The 99.8% figure is the extraordinary one, and it is extraordinary in a specific way: it is not a measurement anyone outside OpenAI can reproduce, and its meaning collapses entirely into how one word is defined.

Why "agentic token" is doing all the work

There are at least two defensible definitions, and they produce wildly different pictures of the world.

Narrow definition: tokens consumed inside a multi-step tool-using loop — a Codex run, a deep research task, a browser agent, a scheduled background job — where a single human instruction dispatches an autonomous trajectory that runs for minutes or hours without further human input.

Broad definition: any token that was not typed by a human into a chat box. Under this reading, system prompts count. Retrieved context counts. Tool output fed back into the model counts. Reasoning tokens — generated by the model, billed as output, never shown to the user — count. All API traffic counts, including a bank's overnight document classification job that nobody would call an agent.

Under the broad definition, 99.8% is close to arithmetically inevitable, because token accounting is radically asymmetric. Humans emit tokens at typing speed. Machines consume them at context-window speed.

Inference Here is the illustration that should end the debate about whether the number is impressive. Call a chat exchange one unit: a short question, a paragraph of answer, a few hundred tokens. Call an agent run 500 units: forty tool-calling steps, each re-submitting a growing context, plus reasoning tokens the user never sees. Now assume sessions split evenly — half chat, half agentic. Agentic share of tokens comes out at 500 / 501, or 99.8%. The headline number is consistent with agents being half of sessions. It is also consistent with agents being 5% of sessions if the multiplier is larger, which for long-horizon coding runs it plausibly is.

So the number does not tell you that humans have stopped chatting. It tells you that tokens are a terrible proxy for anything a human would recognise as usage — which is precisely the problem, because tokens are what you are billed for.

This distinction matters commercially, and most boards have not internalised it.

A high agentic token share can mean your organisation has successfully delegated long-horizon work to machines. It can equally mean your agents are inefficient: re-reading the same 200,000-token context on every step, retrying failed tool calls, exploring dead ends, and burning reasoning tokens on trajectories that get discarded. Inference The industry currently reports these identically. There is no widely adopted metric that separates productive agentic tokens from wasted ones, which means "99.8% agentic" is as compatible with a maturity story as with a colossal efficiency problem — and OpenAI has an obvious incentive to narrate it as the former, since agentic framing is what justifies the capex thesis to its own investors.

The unit that actually matters to a buyer is cost per completed task at acceptable quality. Almost nobody measures it. Almost everybody measures seats.

What the chat-era paperwork gets wrong

Assume only the direction is true — that consumption is migrating from human turns to machine loops. That alone breaks four things most enterprises have already signed.

Per-seat licensing. Seat pricing works when consumption has a human ceiling. A person can generate a few thousand tokens an hour; there is a natural bound. An agent has no such bound — one engineer can dispatch twelve parallel runs and go to lunch. The problem isn't the average, it's the variance. Vendors respond in one of two ways: absorb it until margins force a repricing, or introduce consumption tiers mid-contract. Both have happened. Neither is in your budget model.

Rate limits. A limit expressed in requests per minute was designed for human burstiness. It is nearly meaningless when a single business task is 400 requests. Teams discover this the way everyone discovers it: one agent rollout silently exhausts a shared quota and takes down an unrelated production feature that shared the key.

Audit trails. Chat logging captures a prompt and a completion. An agent run produces a trajectory — tool invocations, file writes, third-party API calls, credential use, intermediate reasoning, and the decision points where it chose one path over another. If your compliance evidence is "we retain prompts and completions," you are retaining the two least interesting artefacts of the run. When a regulator asks why the system took an action, the prompt does not contain the answer.

Vendor contracts and data protection. A DPA written around "the user submits a prompt" does not describe a system that reads your document store, calls an external service, and writes to your CRM under delegated credentials. Who is controller when the agent acts on its own initiative? Which sub-processors are in scope when the agent picks the tool? Inference Most enterprise AI agreements signed in 2024–2025 simply do not contemplate the model as an actor, and the gap is legal, not technical.

There is a security corollary the briefing picked up separately: agent and MCP-server security became its own commercial vendor category this week. That is the market pricing the same realisation. Chat has a human validating every turn; agents act with standing, usually over-scoped, credentials. Prompt injection stops being a party trick and becomes a privilege-escalation path.

The measurement you don't have

Here is the uncomfortable test. Your CFO asks what share of your organisation's AI spend went into agentic loops last quarter versus interactive chat, and what a completed agent task costs. Most organisations cannot answer either question, because the instrumentation sits with the vendor and the billing line is a single aggregate token count.

Inference That is the real vulnerability the 99.8% claim exposes — not the number itself, but the fact that you cannot compute your own version of it. OpenAI can measure this about your usage. You cannot. Any negotiation where one party has the telemetry and the other has an invoice ends the same way.

What would falsify this

Be specific about what would change the read, because "watch this space" is not analysis.

Directionally confirming: a primary OpenAI disclosure with a stated definition and window; independent corroboration from a second lab reporting similar ratios; enterprise billing statements showing token growth decoupled from seat growth.

Directionally undermining: the figure quietly disappearing from OpenAI's messaging; a definition that turns out to include all API traffic (which would make it a statement about product mix, not about agents); or evidence that agentic token growth is dominated by retries and context re-sending rather than task throughput.

And one honest caveat in the other direction: this week also produced Microsoft's SkillOpt result, showing optimised agent skills transferring across model scales and between the Codex and Claude Code harnesses, plus a named production agent deployment in Millennium's Claude-based risk analyst. Those are corroborated, verifiable, and point the same way as the unverified number. When the shaky claim and the solid ones agree on direction, plan for the direction and refuse to quote the number.

If you're a CEO

Stop repeating "99.8%" in front of your board. It is unverified, self-reported, and — as shown above — arithmetically compatible with agents being half your traffic. Quoting it costs you credibility the first time someone asks for the source.

What you should treat as decided: the unit of consumption is moving from the seat to the run, and your AI cost line is becoming variable, correlated with output volume, and lumpy. That is a different animal from a SaaS subscription and your CFO should model it as COGS, not as a licence.

The competitive read is narrower than the hype suggests. If your rivals genuinely run agentic workloads, their marginal cost of an additional analysis, contract review, or code change is now capacity-bound rather than headcount-bound. That changes response times to customers, not just internal efficiency. Two things follow: your pricing may need to reflect faster delivery, and your headcount plan for the functions closest to this work is now a forecast, not a commitment.

The regulatory horizon is visible in this week's other stories — pre-emptive controls arriving before commercial scale, and finance adopting AI first for risk because the alternative is a regulator. Assume the same arrives for agent accountability.

The board question you need to answer: what does one completed agent task cost us today, what did it cost last quarter, and can we prove either number from our own systems rather than a vendor invoice?

If you're a CIO/CTO

Three concrete actions this quarter.

Instrument the run, not the call. Adopt trace-level telemetry with one span per tool invocation and per model call, tagged with a run ID, the initiating identity, and token counts split between input, cached input, reasoning, and output. The OpenTelemetry GenAI semantic conventions are the least-regret standard here. Without run-level attribution you cannot allocate cost, debug a failed trajectory, or answer an audit question.

Re-scope credentials before you scale agents. An agent using a service account with broad access is a standing privilege-escalation target via prompt injection — which is why MCP-server and agent security became a vendor category this week. Short-lived, per-run, least-privilege credentials with a human-approval gate on writes to systems of record. Treat any tool the agent can call as part of your attack surface.

Renegotiate on consumption, not seats. Get committed-use pricing with published overage rates, per-key rate limits so one team's agent cannot exhaust another's quota, and contractual access to your own usage telemetry.

On portability: SkillOpt's cross-harness transfer result is the most strategically useful finding of the week. If skill artefacts survive a move between Codex and Claude Code, your scaffolding is a durable asset and your model choice is reversible.

The read: build the harness, the skill library, and the telemetry in-house; rent the model and refuse multi-year exclusivity — with MIT-licensed weights like DeepSeek-V4-Flash-0731 and full Kimi K3 weights now downloadable, your best negotiating position is a credible self-host fallback you have actually tested.

If you lead AI transformation

Your translation job this week is subtraction: talk your leadership team out of the number and into the consequence. The consequence is that your governance framework, written for a human reviewing each model output, no longer describes what your systems do.

Three gaps open immediately. Approval design — chat had implicit human review at every turn; agents need explicit, designed checkpoints, and deciding where they go is a business decision about reversibility, not a technical one. Rule of thumb: gate anything that writes to a system of record or contacts a customer; let read-and-analyse run free. A new role — someone must own agent trajectories the way SRE owns uptime: reviewing failed runs, curating the skill library, retiring skills that drift. This is not a prompt engineer; it is closer to a process owner with observability skills. A training gap — the people you trained to "prompt well" now need to specify stop conditions and done-criteria, which is the same shift this week's Prompting Skill of the Week describes. The skill artefact, not the prompt, is the durable unit.

On procurement governance: add a question to your intake form asking whether a proposed AI system acts autonomously against other systems, and route anything that answers yes through security and legal review of the DPA, not the standard SaaS path.

The experiment to run this month: pick one agentic workflow already in production, instrument it end-to-end for four weeks, and produce a single number — fully loaded cost per successfully completed task, with the failed-run cost included in the numerator. Then compare it to the human baseline you are implicitly claiming to beat. Most organisations discover the number is either five times better than they assumed or three times worse, and either answer is worth more than any figure in this week's headlines.

This post is also published on our Substack newsletter at edge-ai.forum. Subscribe for the weekly roundup direct to your inbox — fresh AI news, executive context, and devices + robotics every Friday morning.

// Related