Tokens are the wrong yardstick for AI agents, says JFrog’s Sunny Rao

Sunny Rao, SVP of APAC at JFrog, argues that AI agents should not be judged based on how quickly they complete tasks. He warns that Southeast Asia risks repeating past mistakes by focusing on automation's speed rather than its productivity. An agent that accomplishes a task faster could create additional review, remediation, or security work later on.

Rao suggests that the real readiness test for autonomous agents is not whether they can run without oversight, but whether organizations can detect and control unintended actions before they become business risks. The issue lies in control, not capability.

Currently, companies measure AI spend in terms of seats or tokens, but Rao believes the true measure should be cost per successful, production-ready outcome. A cheaper agent that requires frequent corrections or produces unusable results may end up costing more than a pricier one that performs optimally from the start.

Furthermore, Rao points out that most companies focus on access and permissions when it comes to AI agent consumption, neglecting the components these agents pull in, such as open-source packages, MCP servers, skills, and plugins. These components could introduce vulnerabilities or malicious code into enterprise systems without detection.

JFrog, founded by Rao, offers solutions to address these control issues, including the MCP Registry, AI Catalog, and Agent Guard. However, this approach raises concerns about transparency and pricing, as JFrog does not publicly disclose the costs of these features. Nevertheless, Rao emphasizes that verifying what agents consume, limiting their permissions, and maintaining an audit trail of software builds and approvals is essential for managing risk, especially for regulated industries.