Fifty Startups Coming Next
The models are a gold rush and the applications are a stampede, but the interesting companies of the next two years are neither. They are the infrastructure in between, the parts that turn a clever demo into something that runs on a Tuesday without anyone watching. Here are fifty of them, the ones I expect to see soon because I keep hitting the gap where each one should already exist. Four come with a working demo, because a company you can poke beats one you have to picture. This is not a lone hunch either. The year’s loudest startup requests, from the funds that write the first checks, keep naming these same gaps. The rest are one line each, told in the order the stack gets built.
The cost layer
Start where the money is. A token costs about a tenth of what it did a year ago, and it will fall again, but total spend is climbing because usage climbs faster. That gap, between the collapsing unit price and the exploding bill, is a whole layer of companies. The first one routes each request to the cheapest model that is still good enough.
01contestedThe cost-aware router. Per request, send the work to the cheapest model that clears a quality bar you set, and escalate only when it must. The demo below is the pitch.
Four models, a quality score each, a price each. Set the bar; the router picks the cheapest that meets it, and shows the saving against always calling the frontier.
02earlyToken budget guardrails. Hard spend caps per user and per session, and a loop that gets killed before it runs the bill to four figures overnight.
03wide openSemantic caching. Roughly a third of production queries are near-duplicates. Cache by meaning, not by string, and serve them for free.
04wide openPrompt compression as middleware. Shrink the context two or three times before it hits the meter, losslessly where the structure allows.
05wide openThe inference spot market. Bid for idle GPU capacity across clouds and route latency-tolerant jobs to whoever is cheapest this hour.
06wide openSpeculative decoding you rent. Draft-model acceleration as a service, so you get the speedup without building the machinery.
07earlyA FinOps console for AI. Per-feature, per-customer token profit and loss, so you finally know which feature is losing money on its heaviest users.
Memory that compounds
Run an agent on the same class of task ten times and, with no memory, it makes the same mistake ten times. Every session starts cold. The companies here give an agent a past, so run two is cheaper and better than run one, and run ten barely resembles it.
08contestedAgent memory as infrastructure. A place an agent keeps what it learned, so the work compounds instead of resetting. Watch the two agents diverge below.
Bar height is the error on each run. The no-memory agent repeats itself. The memory agent files what worked and converges.
no memory
with memory
09wide openThe org wiki that maintains itself. Slack threads, meeting transcripts, and docs go in; a live, cross-referenced knowledge base comes out, kept current by the model that nobody wants to update by hand.
10wide openPortable personal memory. A memory you own that follows you across assistants, instead of a fresh amnesiac in every app.
11earlyForgetting as a feature. Retention curves and consolidation tiers, so the store deprioritizes what stopped mattering instead of drowning in it.
12earlyA shared brain for a fleet. When many agents work one codebase, their observations merge into one memory with conflict resolution, not ten private ones.
13earlyContext handles. Mint explicit state from a tool and thread it as an argument the model can see, killing the hidden session state that breaks at scale.
14wide openThe memory audit layer. See exactly what your agent knows about a given customer, and redact it on request, because someone will have to.
Reliability, or CI for agents
We would never ship code without tests, and we ship agent changes on vibes. A new prompt, a swapped model, a new tool, and the way you learn it broke the refund flow is a customer complaint. These companies make agent changes provable before they ship.
15contestedCI for agents. An eval gate that runs every change against a suite of cases and blocks the deploy when one regresses. Flip the switch below and watch it slam shut.
Five checks that matter for this agent. All green, the deploy is allowed. Flip the switch to ship a change that breaks one.
16earlyThe eval-data flywheel. Production traffic becomes the test suite automatically, so the evals write themselves from what users do.
17wide openPer-customer eval suites. Because "works in the demo" and "works on their data behind their SSO" are different claims, and only one of them keeps the account.
18wide openBisect for prompts. Git-bisect for the prompt or model change that shifted behavior, instead of guessing which of forty edits did it.
19earlyGolden-transcript replay. Record real sessions once, replay them on every deploy, and diff the outcomes.
20earlyA judge you can trust. Calibrated, audited LLM judges with known error rates, instead of a second model guessing and calling it a metric.
21wide openCanary rollouts for models. One percent of traffic to the new model, automatic rollback the moment a quality metric dips.
Deployment and the edge
The protocol under agent tools just went stateless, which means an agent server can finally behave like every other web tier: any request lands on any replica, and an idle server can be no server at all. That makes a wave of deployment companies possible.
22earlyTools that scale to zero. Deploy a tool, pay only when it runs, autoscale with traffic, drop to zero and a zero bill when idle. Drag the load below.
Each square is a running replica. At zero traffic there are zero replicas and the bill is zero. Drag the load.
23earlyThe stateless-tool host. A place to ship an agent tool that runs at the edge with no session store to manage, the way the new spec finally allows.
24earlyOne-click agent deploy. From a repo to a running, observable agent in under a minute, because the current path is a weekend.
25contestedThe tool gateway. Auth, rate limiting, and routing for tools across providers from one endpoint, so the client sees one stable surface while the back end churns.
26contestedEphemeral sandboxes. A fresh microVM per task that gets thrown away, so an agent running arbitrary code cannot poison the next job.
27earlyEdge model serving. Small models on the CDN, physically close to the user, powering the cheap tier at single-digit-millisecond latency.
28wide openAgent load testing. Simulate ten thousand concurrent agent sessions before you ship. Their traffic is bursty and recursive, and to a database or rate-limiter built for human pace it looks like a denial-of-service attack, which is exactly why it has to be found before your users find it.
Agents that go to work
The last mile of AI is not a demo, it is a deployment, and it runs inside someone else's systems. The companies here send an agent into the building, or into the vertical, where a generic API cannot follow.
29earlyForward-deployed agents for a vertical. The embedded-engineer model pointed at one regulated industry, where an agent that runs in the customer's systems beats anything behind an API.
30earlyThe agent that reads the codebase first. Onboarding as a product: before it touches anything, it maps the workflow nobody documented and the data source people trust.
31earlyCompliance agents that cite the rule. For finance and health, an agent that knows the regulation, applies it, and shows its citation, so the answer survives an audit.
32wide openThe migration agent. Legacy-to-modern ports as a supervised background loop with real proof at each step, and the smaller version that never sleeps: when a vendor ships a breaking change, the agent scans the codebase, finds every affected call, and opens the pull request that fixes it. Not a version bump, a behavior bump, reviewed before it lands.
33wide openOps agents with bounded authority. Scoped, revocable, audited access to production, so the cheap and reversible actions stay fast and the consequential ones stay gated.
34wide openThe multiplayer agent session. Anyone on the team drops into the same live agent run to watch it work, redirect it mid-task, and hand it off, the way two engineers share one terminal. Solo agents are the demo; shared ones are how teams will run them.
35earlySales-engineering in a box. The forward-deployed playbook productized for small vendors who cannot yet hire a field team.
36earlyThe research agent that keeps a wiki. It reads for weeks and files what it learns into a living, cited knowledge base, so the work accumulates instead of scrolling away.
Data, privacy, and staying local
Not every workload can send its data to someone else's cloud, and the ones that cannot are often the most valuable. These companies keep the model close to the data instead of the other way around.
37wide openThe local-first appliance. A box that runs a strong open model on-prem, so regulated data never leaves the building. The hardware fits today; the packaging does not exist.
38earlyPrivacy-preserving inference. Run on encrypted data or inside a trusted enclave, and be able to prove nothing leaked.
39contestedThe synthetic-data foundry. Generate eval and fine-tuning data for your exact domain, so you stop being blocked on real data you cannot share.
40wide openLeast-privilege data brokers. Scoped, audited reads into internal systems, so an agent sees exactly what a task needs and nothing more.
41earlyOn-device agents. A capable model in your pocket, offline and private by default, for the growing share of tasks that should never round-trip.
42earlyThe PII firewall. Strip and tokenize sensitive fields before they touch a model and restore them after, so the model never sees a name.
43wide openProvenance for training data. Know and prove what your model learned from, because the questions about that are coming and the answers had better exist.
Trust, safety, and the strange edge
The last act is the layer that keeps the rest honest, plus a few bets that sound early until they are obvious. When agents act on your behalf, the boring safety layer becomes the interesting company.
44contestedObservability built for loops. Traces designed for the plan-act-check cycle, with cost attributed per decision, because request-response dashboards cannot see an agent.
45wide openA tool registry with a spine. Signed, versioned, permissioned tools, so installing one is not a supply-chain gamble you take blind.
46contestedPrompt-injection firewalls. Treat every tool result as hostile input and sandbox the approver from the content, so a poisoned document cannot steer the agent.
47contestedIdentity and auth for agents. Who is this agent, what may it do, and on whose behalf, answered with the same rigor we give human access.
48wide openThe kill switch layer. Pause, rewind, and revoke a running fleet from one place, because eventually you will need to and you will not have time to improvise.
49contestedRed-team-as-a-service. Adversarial evals that try to break your agent on a schedule, so the failure is found by you and not by the internet.
50earlyThe interoperability layer. One surface over every model, tool, and framework, precisely because the protocol churns twice a year and nobody wants to re-integrate each time.
Fifty is a round number, not a limit. The gaps move every quarter as the models get cheaper and the spec churns, and this list moves with them. If you are building one of these, or the one I missed, the four demos above are the bar: not a deck, a thing that runs. Find me on X.