AI changed the research half of sales, not the closing half

A sales action now has a list price

Salesforce sells Agentforce capacity in Flex Credits: $500 buys 100,000 credits, and a standard agent action spends 20 of them. That is ten cents per automated action, published on a pricing page (Agentforce pricing).

AI has changed the research, drafting and record-keeping half of sales — the inputs to a conversation — while the conversation itself and anything irreversible still clears a human gate, and the binding constraint is no longer model quality but deliverability enforcement, data-access terms, and per-action cost.

The floor under that ten cents is token pricing. GPT-5 is $1.25 per million input tokens and $10 per million output (OpenAI API pricing). Claude Sonnet 4.5 is $3 and $15 (Anthropic pricing). Vendors mark that up into "actions" and "credits" because an action is a unit a VP of Sales can forecast and a token is not. The markup is the product.

What actually moved, by function

The honest version of "AI is changing sales" is narrow. Three things moved, and they moved for the same reason: they are all reading-and-writing tasks with a tolerant failure mode.

The split is not about intelligence. It is about reversibility. A wrong account brief is deleted. A wrong send cannot be unsent, and the receiving mailbox provider keeps score.

That distinction is the whole design question, and it is the same one that separates workflow automation from agents — two things people say with one phrase, which I have argued should be labelled separately.

The benchmarks measure capability; sales needs consistency

In October 2024, Anthropic reported Claude 3.5 Sonnet scoring 14.9% on OSWorld in the screenshot-only setting (Anthropic, computer use announcement). In September 2025, Claude Sonnet 4.5 was reported at 61.4% on OSWorld-Verified (Anthropic, Sonnet 4.5). Eleven months, four times the score. That part of the hype is real.

Now the part that does not get quoted. τ-bench evaluates agents on tool-and-user interaction in retail and airline domains, and it introduces pass^k: the probability an agent solves the same scenario correctly in all k independent trials. The paper's finding is that pass^8 falls to well under half of pass^1 (τ-bench, arXiv:2406.12045).

pass^k is a harsher metric than an average because it compounds. An agent that is 90% reliable on a single attempt is only about 43% reliable across eight, purely as arithmetic, and that is before accounting for correlated failures — the awkward scenario that breaks the agent once tends to break it the same way every time.

Read that against a sales quota. A rep does not touch an account once. An agent assigned to 400 accounts runs 400 trials, and the metric that matters is the eighth one, not the first.

So "can an agent do sales?" has a boring answer: it can do a sales task once, often, and it cannot do the same task 400 times without supervision. That is why every deployment I would stand behind is scoped to one bounded job with a clear output, which is also the argument for building one bounded agent before building a fleet.

Outbound got harder, not easier

This is where most "AI is transforming sales" writing is wrong about the direction of travel.

From February 2024, Google requires bulk senders — anyone sending more than 5,000 messages a day to Gmail accounts — to authenticate with SPF and DKIM, publish a DMARC record, support one-click unsubscribe, and keep the spam complaint rate reported in Postmaster Tools below 0.3%, with 0.1% named as the target to stay under (Google email sender guidelines). The same guidelines require valid forward and reverse DNS records for sending IPs and unsubscribe requests honoured within two days, which means the compliance surface is infrastructure and process, not copywriting. Yahoo published parallel requirements (Yahoo Sender Hub).

Three complaints per thousand. That is the budget.

Generative models made it trivially cheap to produce 50,000 personalised emails. The mailbox providers made the consequence of 50,000 badly-targeted emails a reputation penalty on your sending domain that takes weeks to recover and cannot be bought back with credits. Volume became the liability at the exact moment volume became free.

Voice is tighter still. In February 2024 the FCC issued a declaratory ruling placing AI-generated voices under the Telephone Consumer Protection Act's artificial-voice restrictions, which means prior express consent, not a clever disclaimer (FCC ruling).

The data supply is closing

Agentic prospecting assumes the open web stays open. It is not staying open.

In July 2025 Cloudflare began blocking AI crawlers by default for new domains on its network and launched pay-per-crawl, which makes access a commercial negotiation rather than a default (Cloudflare). LinkedIn's User Agreement has long prohibited using "software, devices, scripts, robots or any other means" to scrape the service (LinkedIn User Agreement). Any prospecting agent whose moat is "it browses sites other tools do not" is building on a base that is contracting, and it will contract unevenly, which is worse — your coverage degrades silently rather than failing loudly.

The sanctioned path is tool access with credentials. The Model Context Protocol's 2025-06-18 revision specifies servers as OAuth 2.1 resource servers, which means an agent reaching your CRM, your data vendor or your warehouse does it with a scoped token that an admin can see and revoke (MCP specification). Revocability is the part that matters operationally: a scoped token gives you a kill switch and an audit trail per agent, where a shared login gives you neither.

That is a less exciting architecture than a browser-driving agent like Operator. It is also the correct one when an API exists. Driving a UI is a fallback for systems that refuse to expose anything else — I have called computer use a last resort, and fine as one.

What one account brief costs

Take the job AI is unambiguously good at: read the CRM record, pull recent filings and job posts, produce a one-page brief before a first call.

A tool-using loop like that runs twelve turns. Context accumulates, so average input per turn lands near 18,000 tokens once you include the system prompt, tool schemas and retrieved text. Output is short — 900 tokens a turn, because most turns are tool calls rather than prose.

At Claude Sonnet 4.5's published $3 / $15 per million, that is 216,000 input tokens at $0.65 plus 10,800 output tokens at $0.16 — $0.81 per brief. Run it across 2,000 target accounts a quarter and you are at $1,620. Cheaper than one SDR week.

Change the model and the arithmetic moves by a factor of three in either direction. Turn on prompt caching and the input line drops hard, because the system prompt and tool schemas are identical on every turn — OpenAI prices cached input at a tenth of fresh input (OpenAI API pricing). Caching only pays, though, when the cached prefix is genuinely stable: edit the system prompt or reorder a tool schema between runs and you are paying to write a cache that nothing reads.

Two things that calculator will not show you, and that I would insist on knowing before signing a contract: retries and dead ends. Every failed tool call, every reparse of malformed JSON, every loop that wanders for four turns before giving up is billed at full price and produces nothing. Budget on attempted runs, not successful ones.

If you are reselling any of this, the margin question comes before the pricing page, not after — which is the case for building a margin meter first.

Where the human gate belongs

The architecture that holds up in production is not "agent with guardrails in the prompt." It is a loop whose step count is capped in code, with reversible actions running free and irreversible ones queued for approval.

Unbounded loops are the most common production failure in agent systems. The fix is a hard step cap enforced outside the model, because the model cannot be asked to limit itself — the thing you are limiting is its judgement about whether to continue.

The gate is a queue. Somebody owns it. In practice that is a rep reviewing 40 drafted sequences in the morning instead of writing four — a real productivity change, and not the same thing as replacing the rep.

The failure mode of a gate is approval fatigue. A queue that nobody can clear inside a working day becomes a queue somebody rubber-stamps, at which point you have the cost of review and none of the safety. Size the queue to the reviewer, and track edit and rejection rates — if nothing is ever rejected, the gate has stopped functioning and you should know that before an incident tells you.

1. 1
   Put a hard step cap in the orchestration code, not the system prompt. If the loop exceeds it, kill the run and log the state.
2. 2
   Classify every tool the agent can call as reversible or irreversible. Writing a CRM note is reversible. send_email, apply_discount and anything that charges money are not.
3. 3
   Route irreversible calls to an approval queue with the full agent reasoning attached, so the approver is reviewing a decision and not just a draft.
4. 4
   Give the agent a separate sending subdomain with its own SPF, DKIM and DMARC records, and watch its spam rate in Postmaster Tools against the 0.3% ceiling.
5. 5
   Meter cost per attempted run, including failed runs and retries, before you promise anyone a per-account price.

What I would not use

I would not give an agent autonomous send authority on cold outbound. Not because the copy is bad — the copy is often better than what a junior rep writes at 4pm — but because the penalty for being wrong sits with the mailbox provider's complaint threshold, and three complaints per thousand is not a budget you hand to a system whose pass^8 reliability is unmeasured in your domain.

I would not point a computer-use agent at a system that publishes an API. The browser path is slower, costs more tokens per unit of work, and breaks on a CSS change that nobody announced. Use it where there is no alternative, and expect to rebuild it. The one-file version is worth writing yourself first so you understand what you are signing up for (a working computer-use agent loop in one Python file).

I would not delegate spend authority. Automated budget pacing and bid management have been standard practice in paid media for years, so the objection here is not squeamishness about automation in general — it is that a spend decision is irreversible in exactly the way a draft is not, and the failure is denominated in dollars rather than in a wasted five minutes.

And I would not buy a product whose pitch is replacing the sales team. What has changed is that the preparation layer of selling got cheap and fast, which raises the floor on every call a human still takes. The closing half of the job has not moved, and nothing in the benchmark record from October 2024 to September 2025 suggests it moved quietly while we were reading press releases.