These four advertise time-to-first-audio between 40 and 200 ms, and an independent harness measures their cloud medians at 188 to 313 ms — but the number that breaks a phone call is the spread, not the median, and one vendor's jitter is nearly four times another's. Price moves about 2.5× across the field and predicts neither. The tail is bought with deployment.
These four price a search between $1 and $16 per thousand, and the spread is not margin — it is how far down the retrieval pipeline each one reads. Price a whole research turn instead of a call and the ordering inverts: the cheapest rate card produces a turn costing three times the dearest one.
Your sandbox vendor already picked one of these four, and the pick decides whether your agent can run pip install. Rank them by cold start and you get the exact reverse of ranking them by how much Linux the agent gets — because the boot time is the kernel. Answer one question, does the code install things, and the field collapses.
GEPA's reported margins — up to 20% over GRPO, 13% over MIPROv2 — were all measured where an automatic checker was free and a failed run could be described in words. Two of these four optimizers run on a bare scalar; two need a sentence. What your eval function returns decides which half of the field you can use, so change the metric before you change the optimizer.
The same product has been reported at 49.0% and at 94.4% on a benchmark with the same name, depending on who ran it and when. Scores cannot arbitrate this category. What actually differs between the four — and what you cannot change after adoption — is who decides what gets remembered, who invalidates it, and whether you can get it back out.
All four can express the policy. Only two of them answer without the caller supplying the facts — and when the caller is an agent reading attacker-controlled text, that is the entire security property. The second question is the check budget: an agent makes dozens of authorization calls per task, and filtering a retrieval set makes thousands.
A chat product needs several hundred concurrent users before a dedicated GPU beats per-token pricing; an agent needs about a dozen workers, because it re-sends its whole context every step. That arithmetic — not the price per million tokens — is what should decide which of these four you build on.
Word error rate is close to settled between the four, and a couple of points of it lands on words your intent classifier ignores. The slice that decides whether a voice agent feels human is end-of-turn detection — several times larger than the transcription latency beneath it, and the one thing the four providers genuinely disagree about.
Four agent-payment standards, usually compared on rails. The axis that matters is where the spending cap is stored — a pre-funded wallet, an issuer rule, a one-checkout token, or a mandate the user signed — because that fixes how much a prompt-injected agent can spend before anything else gets a vote.
Four platforms that stand between your agent and a user’s Gmail or Salesforce. The catalog sizes they advertise are counted in four different units and are the part you will outgrow; the token vault none of them market is the part you would hate to build. The decision you cannot retrofit is whose name is on the consent screen.
Two of the four bill the agent loop at about nine cents per vCPU-hour and their prices are 3.6% apart; the other two do not charge for it at all. What each is actually selling is a place to keep the conversation — and AWS closing Bedrock Agents Classic to new customers on 30 July 2026 is the clearest evidence yet about which half of a managed runtime you can afford to rent.
All four speak CDP, so the automation code ports in a day and the SDK comparison decides nothing. The real choice is who holds the logged-in profile, the credentials that recreate it and the exit IP whose reputation you inherit — plus the fact that the latency spread between them is entirely control plane.
The feature grids converged, so the decision is licence and billing meter — and every meter prices the trace archive that becomes your golden set, regression baseline and fine-tuning corpus. Instrument against OpenTelemetry, dual-write the stream somewhere you own, and the platform becomes a swappable backend.
Every identity vendor now sells “auth for AI agents”, and the phrase covers two opposite problems: letting an agent into your app, and letting your agent out to someone else’s API. Pick on direction first — and notice that a token vault holding a user’s full grant has relocated the credential rather than shrunk it.
The top two terminal coding agents are 0.4 points apart on Terminal-Bench 2.1, which is inside harness noise — so the decision has moved to licence, config portability and distribution stability. Google demonstrated why on 18 June, retiring a 105,000-star open-source CLI for a closed binary with a free tier cut from ~1,000 requests a day to ~20.
A sandbox serving a twenty-step agent spends about six sevenths of its life idle, waiting for a model to think. So cold-start milliseconds and per-vCPU-hour rates — the two numbers every comparison leads with — are the two that matter least. What decides your bill is whether idle is billed; what decides your blast radius is the egress default.
Framework comparisons argue about graphs versus crews versus handoffs, but the metaphor stops mattering by week three. What you cannot re-pick eighteen months in is where a run lives, what resume means after a crash, and whether a human can pause a half-finished task — so choose on the state model and the rest of the comparison resolves itself.
A reranker touches no index and holds no state, so swapping one is an afternoon — which finally makes chasing the leaderboard rational, except the leaderboard measures the axis where these four differ least. What differs by more than an order of magnitude is the billing unit and the licence, and both bite hardest at agent scale.
These four are not four alternatives at one layer — TRL is the trainer API, Axolotl and LlamaFactory wrap it, and Unsloth rewrites its source at import time. That single fact predicts the thing you will actually feel: TRL shipped 1.9.2 in July while two of the others still pin the 0.x line. The famous speed table nobody can source is the wrong axis entirely.
Swapping your LLM edits a prompt. Swapping your embedding model re-embeds the corpus, rebuilds the index and invalidates every retrieval number you have — vectors from two models are not comparable, so there is no gradual migration. That makes this the one choice in a RAG stack you make under lock-in, and the deciding numbers are bytes per vector and who controls the model lifecycle, not a leaderboard rank.
Three of these four constrain the sampler so invalid output cannot be produced, and the choice between them collapses to one question: do your schemas repeat? The fourth does something categorically different, and it is the only one that can enforce the rules that actually break agents — because a grammar guarantees the enum is one of five values and says nothing about which.
Every comparison of these four opens with tokens per second on a fixed batch — the one number that transfers worst to agent traffic, where the same prompt comes back twenty times with a few hundred tokens appended. What separates them is what the KV cache is keyed on, whether constrained decoding survives a full batch, and how much of your quarter the build step eats.
All three READMEs describe the same job — run cases through a model, score the output, fail the build. But at the level of their core data structure they disagree about what an evaluation is: an attack, an assertion, or an experiment. Pick the wrong noun and the tool will not let you write the test you actually need.
Every document-parser comparison is published as an accuracy leaderboard, and accuracy is the axis that transfers worst to your documents. Two things do transfer: a layout pipeline can drop a number but cannot invent one, and the cost curves of self-hosted and hosted parsing cross at a volume you can compute in five minutes.
Every AI gateway sells the same headline feature: automatic failover to a second provider. That feature is not an availability win — it is an untested deploy that fires only during an incident, onto a model your evals never covered. Choose instead on who operates the hop, because that is the decision you cannot reverse cheaply.
List prices for agent search APIs cluster tightly around $5–8 per thousand queries, which makes the sticker the least interesting number in the comparison. What actually differs by an order of magnitude is how many tokens each one dumps into your context per result — and in an agent loop that re-sends its transcript every step, that is the bill.
Before you pick a local vector store, notice that Claude Code, Cursor and Codex deleted theirs — the leading coding agents retrieve with grep, not embeddings. If your corpus still needs an index, these four are not competing products but four different architectures: a search library with no storage, a SQLite extension, an embedded engine with a write-ahead log, and a columnar format on disk.
A "guardrail" is not one thing. The open-source ecosystem settled into four shapes — a programmable rails DSL, a validator library, a safety-classifier model, and a scanner pipeline — and the 2025-26 acquisition wave decided which survived independent. Here is what each actually does, where it sits around the model, and why none of them "solves" prompt injection.
When there is no API, an agent has to drive the browser itself — and four open-source projects disagree on how it should see the page. browser-use reads the DOM, Skyvern looks at pixels, Stagehand lets you dial between code and AI, and Playwright MCP is not an agent at all but the standard browser-tool layer any model can call. Picking one is really two decisions: Python or TypeScript, and a framework or an MCP server.
Naive agent loops die on minute 29 of a 30-minute job. Durable-execution engines journal every step so the next process can pick up exactly where the previous one died — and 2026 was the year hyperscalers shipped their own. Four engines now compete on the same primitive, with very different architectures and bills.
A 128K-token context window degrades past the first thousand tokens and vanishes the moment the session ends. The agent-memory infrastructure market crossed $6 billion in 2026 because "throw it all in the context" stopped being a strategy — and four frameworks now bet differently on what memory should rank, store, and forget.
Voice is now the interface most agents will spend the most time in — and four platforms have made architecturally opposite bets on how to wire speech, language, and tool-use into one round-trip. The right pick depends less on TTS voice quality than on whether you control the audio path, the model, or just the prompt.
72.5% on OSWorld is the new floor, not a milestone — and three labs have made architecturally opposite bets on where the mouse should live. Pick the wrong one and you fight your sandbox forever; pick the right one and the model does in two minutes what your RPA stack does in two weeks.
Every coding agent leaves a different telemetry trail — JSONL transcripts, a SQLite store, or only a prose log — so the open-source tracker worth installing depends on which trail your agent leaves. Four trackers, four trails, plus the levers that actually cut the bill.
Four RL-for-trading projects, four near-identical feature lists — Gymnasium env, OHLCV ingest, PPO/SAC/A2C/DQN, backtest evaluation. The thing that actually decides which survives a serious research-or-prod loop is invisible there: who controls the simulation contract.
Four vector stores, four nearly identical feature lists — ANN, filters, hybrid search, all of it. The thing that actually decides which one survives the agentic-RAG stack at scale is invisible there: where the index sits relative to your primary data.
All four ship traces, datasets, and evaluators — the feature lists nearly match. What separates them is which feedback loop they were built to close: the dev loop, CI, the production gateway, or model-monitoring drift.
Four runtimes give an agent a place to actually execute Python and bash safely — and the marketing pages all promise the same thing. The thing that decides which one survives production is who owns the sandbox lifecycle.
Four orchestration frameworks let you wire up the same workflow — and the feature lists nearly match. The thing that decides which one survives production is invisible there: where your agent's state actually lives.
Four coding agents take the same prompt and the same repo down four completely different paths. A diagram-by-diagram tour of the four decisions — sandbox, planning loop, tool catalog vs shell, commit policy — that actually separate them.
Three of 2026’s fastest-growing open-source agents look almost identical on a feature list — and behave like completely different species the moment you run them. A diagram-by-diagram tour of where the architectures diverge.