More than one in four AI tools we cataloged no longer exists

Finding 1: the mortality rate is more than one in four

Of 4,831 tools we cataloged and whose status we could verify, 1,354 no longer respond: dead domain, parked, 404, or DNS that does not resolve. That is 28.0%, more than one in four.

The number is not about startups that shut down: it is about addresses an employee could have opened in a browser and that no longer exist. For anyone who built a routine on one of them, the end came without notice.

Finding 2: in productivity and code generation, the rate is more than four times that of platforms and infrastructure

The rate varies sharply by category, and the variation has a logic. The categories with the highest mortality are those with the lowest barrier to entry: a productivity tool or a coding assistant can be shipped by one person over a weekend.

The ones that endure require expensive, continuous infrastructure. Model providers and orchestration platforms do not vanish because someone lost interest.

Finding 3: the highest-risk tools are precisely the ones that do not vanish

This is the most counterintuitive finding, and the one with the greatest practical consequence for whoever sets AI usage policy.

The honest reading is that critical risk concentrates in categories dominated by established operations (voice cloning, video synthesis, autonomous agents and large language models), while the long tail that disappears is made of moderate-risk tools. We do not claim that being risky makes a tool durable; we claim that, in our catalog, the risky ones are the ones that stay.

The consequence is direct: postponing a decision on the highest-risk tools in the hope that the subject will pass is the worst possible bet. What passes is the moderate-risk long tail. What stays is exactly what requires a written policy.

Finding 4: almost every AI tool in the catalog is foreign

Among the 3,066 active tools with an identified home country, 39 are Brazilian. The other 3,027 (98.7%) are headquartered abroad, spread across 71 countries.

For a Brazilian company this carries a legal consequence that often goes unnoticed: where personal data is involved, practically every AI adoption is an international data transfer, subject to article 33 of the LGPD.

And the deadline has passed. Resolution CD/ANPD No. 19/2024 approved the standard contractual clauses on 23/aug/2024 and granted twelve months of transition, which ended on 23/aug/2025. See the guide on the LGPD and AI tools.

What these numbers change in practice

• An inventory is a film, not a photograph. In our catalog, more than one in four AI tools we track no longer exists; a list compiled once and never reviewed ages the same way, and contains nothing that arrived since.
• Operational dependency is measurable risk. The question “what happens if this tool disappears?” stops being hypothetical when more than one in four AI tools we track no longer exists.
• Blocking by list cannot keep up. A hand-written blocklist ages in both directions: it wastes lines on the dead and misses everything newly born.
• The riskiest ones will not leave on their own. A written policy is the only way through the critical band, because waiting does not solve it.

Methodology

The catalog covers tools detectable as AI usage in a corporate environment: what shows up in a process, a DNS query or the browser history of a workstation. Each entry carries a domain, a category, a risk level and the home country of the vendor.

An entry counts as “no longer exists” when the liveness check finds a dead domain, a parked page, a 404, or DNS that does not resolve. Entries retired after a scope review (personal rather than corporate use) and as cataloging errors on our side (wrong domain, or a domain belonging to another company) are counted separately and excluded from the mortality rate. Since 18/oct/2026 the type of each retirement is recorded in its own catalog field rather than inferred from the text of the reason.

A retired entry is not deleted: it stays in the catalog with its risk frozen, which is what allows mortality to be compared across risk bands without distortion.

Limitations, stated plainly

• This is not a market census. It is the mortality observed in our catalog, whose selection reflects what is detectable as corporate AI usage. Tools we never cataloged are not in the count.
• There is no time series. We record when we retired the entry, not when the tool went offline, so yearly mortality cannot be derived from this data.
• The risk classification is our judgment, based on public documentation. For that reason we left out findings that would merely measure our own criteria, such as the concentration of critical risk by jurisdiction.
• The origin percentages exclude active tools with no identified country.