A senior vice president at Meta told a conference audience this week that businesses have roughly twenty months to rebuild their infrastructure for a world where AI agents — not humans — are the main users of their systems. The warning is aimed at large enterprises, but the implications for Irish small and medium businesses are just as significant.
Barak Yagour, Meta’s VP of Data Infrastructure, spoke at VB Transform 2026 wearing a pair of Ray-Ban Meta AI glasses. His message was blunt: “We spent 20 years building infrastructure for humans. We have maybe 20 months to rebuild the whole thing for a world where humans and agents co-create at scale. The window is open, but it won’t stay open for long.”
The scale of the shift
Yagour shared data that illustrates just how fast the change is happening. Agentic queries hitting Meta’s data systems grew 30 times in a single six-month period. Automated traffic overtook human traffic on the internet last year, reaching 51 percent of total traffic. And that machine traffic is growing eight times faster than human traffic.
The key insight Yagour offered is that three assumptions are breaking at once: capacity, identity, and velocity.
On capacity, the old rule was simple: one engineer meant one unit of load. Now one engineer can spawn ten AI agents, each spawning sub-agents, generating the load of 100,000 users practically overnight. An Irish company with a small team could see its systems overwhelmed by AI-driven demand without any increase in human headcount.
What this means for an Irish business owner
You might not manage Meta-sized infrastructure. But if your business runs a website with customer accounts, an online booking system, or any digital service, the same shift will affect you. AI agents are already browsing websites, filling in forms, and interacting with business systems. Some of that traffic is helpful — think of an AI searching for your business hours or services. Some of it is not — automated scraping, credential stuffing, and bot-driven attacks that have grown more sophisticated with AI.
The question is whether your systems can tell the difference. Most small business platforms cannot. They treat every visitor the same, whether human or machine. That worked when machines made up a small fraction of traffic. It stops working when agents become the majority.
Identity and velocity under strain
Yagour pointed out that AI agents do not fit the categories businesses have built their access controls around. An agent is not a human user, but it is not a deployed service either. Yet it makes decisions autonomously. How do you authenticate an AI? How do you track what it did and trace it back to who authorised it?
Velocity is the third pressure point. AI tools like GitHub Copilot now write nearly half of the average developer’s code, Yagour noted. But writing code faster does not make the rest of the pipeline faster. “The agent writes the code in seconds, but your CI/CD pipeline doesn’t get faster just because the machine is the author,” he said.
The same logic applies to any business process. An AI can draft a marketing email in seconds, but if your approval process still takes three days, the bottleneck has simply moved.
What you can actually do about it
The twenty-month timeline might feel abstract for a business focused on surviving this quarter. But Yagour’s talk offers practical signals for small businesses too. The most important is this: start building the habit of treating AI traffic as distinct from human traffic.
For most Irish SMEs, that begins with asking your software vendors whether their systems can distinguish between human users and automated agents. If they cannot, ask when they will. For your own systems — even something as simple as a contact form or booking system — consider rate limits, CAPTCHA alternatives, and logging that can identify automated behaviour.
Meta’s approach inside its own systems is instructive. The company has built “trusted data environments” where AI agents can explore data freely but every output is traced back to its source. Sensitive fields are masked before an agent can reach them. Every access request is evaluated in real time against what the agent is trying to do and whether it is allowed. The principle is simple: explore broadly, release narrowly.
Whether you have twenty months or more, the direction is clear. The infrastructure we built for human-scale traffic is approaching its limits. The businesses that prepare early will be the ones that thrive when the shift arrives.