Second Opinion: Your CRM Was Built for Eyeballs. Your AI Agent Has None

By /

The software you pay per seat for was designed for eyeballs. Your AI agent does not have any. That mismatch, not model quality, is why most “AI in the workflow” pilots die.

Hat-tip to Angus Sewell, who writes as Angus the Nontechnical. His latest post is a war story from a mid-sized B2B advisory firm whose sales team had bolted ChatGPT onto Clay, HubSpot and Instantly, only to find the agent hallucinating, stalling and taking longer than a human. His diagnosis: the off-the-shelf MCP connectors were “miserably context unoptimized”. His fix depends on company size. Solo founders should rip out the SaaS and run on a Postgres database the agent queries directly. Everyone else should build their own narrow, deterministic MCP tools on top of the software they already have. Read it. Then read on, because the story is bigger than one sales team.

First, the jargon

MCP (Model Context Protocol) is the open standard, released by Anthropic in November 2024, that lets an AI model call outside tools: fetch a contact, update a deal, send an email. A “context window” is the model’s working memory for a single task. When a vendor publishes a generic MCP connector, every call dumps a pile of raw JSON into that memory. The agent then has to reason its way through fields, IDs and pagination that a human would never see because the dashboard hides them.

The claim worth checking: context rot is real

Angus argues that a context window can be badly degraded at 40% full. The number is his, but the phenomenon is well documented. Chroma’s Context Rot study tested 18 frontier models, including GPT-4.1, Claude 4 and Gemini 2.5, and found every one of them got less reliable as input length grew, even on trivial retrieval tasks, and long before the advertised limit. A model sold with a 200,000-token window showed meaningful decay at 50,000. Distractors and loosely structured “haystacks” made it worse. That is precisely what a raw CRM export is: a large, loosely structured haystack full of distractors.

So the sales team’s ChatGPT was not stupid. It was being force-fed the digital equivalent of a phone book and asked to find one name.

The bit Angus under-sells: generic connectors are also a security liability

He calls vendor MCP tools “half baked”. The independent research says it is worse than that. Across published audits collected by Practical DevSecOps, 43% of tested MCP servers were vulnerable to command injection, 36.7% of more than 7,000 servers to server-side request forgery, and an AgentSeal scan of 1,808 servers found 66% carried at least one security finding. A peer-reviewed study by Hasan et al. found tool poisoning, where a malicious tool description quietly rewrites the agent’s instructions, in roughly 5.5% of 1,899 servers. The Cloud Security Alliance published its own warning on tool poisoning and auto-execution in July 2026.

Read that against Angus’s solo-founder advice, which starts with “figure out how to get an API key for every piece of software in your stack”. For a one-person shop that is a reasonable risk. For a firm with client data, a compliance officer and a cyber-insurance policy, it is how you end up in a breach disclosure. Angus concedes his own pilot at the advisory firm collapsed under “way too many compliance issues”. That is the lede, not the footnote.

Fat tool, thin LLM: he is right, and so is Anthropic

His strongest idea is what he calls “fat tool thin LLM”: push the hard, repeatable logic into a deterministic tool and leave the model with a small, unambiguous job. Anthropic’s own engineering guidance, Writing effective tools for AI agents, lands in the same place: consolidate multiple API calls into one purpose-built tool, return only the fields the agent needs, and write descriptions for the model, not the developer. A 200-line n8n workflow labelled “pull the Q3 renewal list” will beat a general-purpose HubSpot connector every day of the week, because the agent never has to discover how your pipeline stages are named.

Where I push back: Angus says the easiest path is n8n and that “most people got it pretty quickly”. Maybe. But every custom tool is a piece of internal software with no vendor behind it. He admits they break when upstream APIs change. Multiply that by fifteen tools per team and four teams, and you have built an integration department without hiring one. The honest framing is that you are trading a subscription bill for a maintenance bill, and the maintenance bill is paid in the scarcest currency a small firm has: the attention of the one person who understands the plumbing.

The bigger picture: this is why software stocks fell off a cliff

Angus asks what you are paying monday.com $5,000 a month for if your team lives in a chatbot. Wall Street asked the same question in February. Roughly $285 billion came off global software valuations in about 48 hours after Anthropic released Claude Cowork, and the S&P 500 Software Index dropped 19% that month, according to The SaaS Sentinel, citing Bloomberg. Over the trailing year monday.com fell 72%, HubSpot 57% and Salesforce 29%. Sector price-to-earnings multiples compressed from a peak of 84x to under 23x. Bain and Deloitte both flagged the structural problem in late 2025: per-seat pricing for work an agent can do without a seat.

The cautionary tale on the other side is Klarna. It publicly dropped Salesforce and Workday, cut headcount by around 40% and claimed its chatbot did the work of 700 agents. Then customer satisfaction fell, and, as Fast Company reported, it started hiring humans back. Ripping out the software is easy. Rebuilding the judgement that lived inside the process is not.

What this means

  • Solo or under ten people: Angus’s database-first route is viable. Neon and Supabase both have free tiers; you can be agent-first for the price of a coffee. Budget real time for learning basic data hygiene.
  • Ten to 200 people: Do not touch the CRM. Build three to five fat tools for your highest-volume repetitive tasks, name them in plain English, and log every call. Measure minutes saved per week before you build tool six.
  • Anyone: Treat a vendor’s generic MCP connector as an untrusted plugin. Read the tool descriptions. Scope the credentials. Assume it will be abandoned.
  • Investment read (not investment advice): Bull: incumbents with deep workflow ownership (ServiceNow, Salesforce) sell the orchestration layer and survive the repricing. Bear: single-function, per-seat tools in CRM and project management face structural churn as agents shrink seat counts. Neutral: the repricing is largely done; the question now is which vendors publish agent-grade tools before their customers build them in n8n.
The free stack. One email a week: the AI tools and moves that actually matter, hype filtered out. Subscribe free →

Did you know: aggregate net new ARR across public cloud software fell 29% year on year in Q1 2025, a full year before the February selloff. The market noticed late.

Sources

Get the free weekly stack: the AI tools and moves that matter, hype filtered out.Subscribe free →
Scroll to Top