Agentic AI is the label for software that does not simply answer a question but decides what to do next and then does it. A model is given a goal, chooses an action, calls a tool, reads the result and goes round again until the job is done or a limit stops it. In 2026 that one description stretches from a coding assistant editing a repository to a service system issuing refunds, which is part of the difficulty: the term is carrying a lot of weight, and vendors keep stretching it.
Updated September 2026. This area is moving quickly, so check the linked sources for the current position.
What the term actually means
Anthropic’s engineering guidance draws the line that matters. In a workflow, a developer writes the path in advance and the model fills in the steps. In an agent, the model directs its own process, choosing tools and their order and deciding when it has finished. Plenty of products sold as autonomous are workflows, which is not an insult: a fixed path is usually cheaper, easier to test and easier to explain when it goes wrong.
Public bodies have settled on a similar reading. When the Center for AI Standards and Innovation at NIST announced its AI Agent Standards Initiative on 17 February 2026, it described agents as systems capable of autonomous action that can work for hours at a time, writing and debugging code, managing email and calendars and shopping for goods. The initiative has three strands: industry-led standards, open-source protocol work, and research into agent security and identity.
Gartner is blunter about the marketing. In a June 2025 release it warned of “agent washing”, the rebranding of assistants, chatbots and robotic process automation as something autonomous, and estimated that only about 130 of the thousands of vendors making agentic claims were genuine. If you are buying rather than building, that is the first thing to test. Our explainer on what an AI agent is sets out the parts a real one needs.
How an agentic AI system is put together
Under the branding, almost every system has the same four pieces, plus a fifth that decides how much damage a mistake can do.
- A model and a loop. The model plans, acts, observes the result and plans again. Stopping rules, such as a step budget or a time limit, decide when the loop ends.
- Tools. Search, a browser, a code runner, a database, a calendar. Without tools the system can only produce text.
- Context and memory. Instructions, earlier results, retrieved documents and sometimes notes carried between sessions. Managing that budget well is its own discipline, covered in our guide to context engineering.
- Permissions. Which accounts, files and spending the system may touch, and which actions need a human to approve them first.
Two open protocols now connect these parts. The Model Context Protocol standardises how a model reaches tools and data, and was donated to the Agentic AI Foundation, a directed fund of the Linux Foundation, on 9 December 2025. The Agent2Agent protocol standardises how separate agents talk to each other; the Linux Foundation reported on 9 April 2026 that it had passed 150 supporting organisations and reached version 1.0 in January 2026. On the framework side, Microsoft merged Semantic Kernel and AutoGen into the Microsoft Agent Framework, which its documentation describes as the direct successor to both. If you want the plumbing, read our piece on what an MCP server is.
Where agentic AI goes wrong
The failure rate is the part the demonstrations skip. Gartner predicted in June 2025 that more than 40 percent of agentic projects would be cancelled by the end of 2027, blaming rising costs, unclear business value and inadequate risk controls. Its more optimistic forecasts for 2028, that a third of enterprise software would include such features and that 15 percent of day-to-day work decisions could be automated, sit alongside that warning rather than replacing it.
Academic work points at design rather than model quality. A Berkeley-led paper, “Why Do Multi-Agent LLM Systems Fail?”, built a taxonomy of 14 distinct failure modes from traces across seven frameworks, grouped into specification problems, misalignment between agents, and weak verification of the result. Most of those are engineering faults, not model faults.
Security is the other half. The OWASP GenAI Security Project published its Top 10 for Agentic Applications on 9 December 2025. Its categories are a useful checklist in their own right:
- Agent goal hijack, where instructions hidden in a page, file or message redirect the system. This is prompt injection aimed at something that can act.
- Tool misuse and identity or privilege abuse, where a legitimate tool or credential is used in a way nobody intended.
- Memory and context poisoning, where bad information saved now steers decisions later.
- Cascading failures and rogue agents, where one bad step spreads through connected systems or an unmonitored process keeps running.
What agentic AI costs in effort
Budget for more than a licence. Anthropic’s published figures give a sense of the gap: agents use roughly four times the tokens of an ordinary chat, and multi-agent setups around fifteen times. On top of that sit evaluation harnesses, logging you can actually read, permission plumbing, and the human time to review what the system did. Teams that treat those as optional are the ones who supply Gartner’s cancellation statistics.
7 checks to make before you commit
Run these against any proposal, whether it comes from a vendor or from your own team. They follow the risk categories OWASP published and the failure patterns in the research above.
- Is it actually autonomous? Ask what the system decides that a scripted workflow could not. If the answer is nothing, buy the workflow.
- What is the stopping rule? Every loop needs a step budget, a time limit and a clear definition of done.
- Which credentials does it hold, how long do they live, and what is the smallest set that would still do the job?
- Which actions require a human? Payments, deletions, outbound messages and permission changes should not be automatic on day one.
- How is it evaluated? Ask for the test set and the pass rate, not a demonstration. Non-deterministic systems need repeated runs to say anything.
- What does the log show? You should be able to read every tool call and its input in plain language after the fact.
- How do you switch it off? Know where the pause button is and how to revoke access before you need either.
If you are using one rather than building one
Most people will meet this technology as a feature inside a product they already use. Start with read-only access, keep approval for anything irreversible, and be careful about letting an assistant act on content from strangers. Our guides to using AI browser agents safely and what to allow an agent to do with your email cover the settings worth changing, and how to check an AI answer covers the habit worth keeping.
Common questions
What is agentic AI in simple terms? It is software built around a language model that pursues a goal by itself: planning steps, calling tools such as a browser or a database, reading the results and repeating until the task is finished or a limit stops it.
What is the difference between agentic AI and generative AI? Generative systems produce text, images or code when asked. Agentic ones use a generative model as the decision maker inside a loop that also takes actions in other systems, which is what raises the stakes.
Is agentic AI actually being used in production? Yes, most visibly in software engineering, research and customer operations, but adoption claims and deployment reality differ widely by source. Gartner expects more than 40 percent of projects to be cancelled by the end of 2027.
What are the main security risks? OWASP lists goal hijacking through hidden instructions, tool misuse, privilege abuse, poisoned memory, insecure communication between agents, cascading failures and unmonitored rogue processes.
Do I need MCP or A2A to build one? No, but they save work. MCP standardises how a model reaches tools and data, and A2A standardises how separate agents talk to each other. Both are now hosted by the Linux Foundation.
Sources and further reading
Where the figures and rules above come from, so you can check them:
- Building effective agents, on workflows versus agents: Anthropic
- Announcing the AI Agent Standards Initiative (17 February 2026): NIST CAISI
- Agent washing, vendor counts and the 2027 cancellation forecast (June 2025): Gartner, reported by Consumer Goods Technology
- Top 10 for Agentic Applications (9 December 2025): OWASP GenAI Security Project
- Why Do Multi-Agent LLM Systems Fail? (MAST taxonomy): Cemri et al., arXiv
- Formation of the Agentic AI Foundation (9 December 2025): Linux Foundation
- A2A protocol passes 150 organisations (9 April 2026): Linux Foundation
- Agent Framework overview and its Semantic Kernel and AutoGen lineage: Microsoft Learn
Photo credits: Mecanum Wheel Robot with an Arm by Anani A. George, CC0, via Wikimedia Commons. VLTI Control Room (esopia-control-room-7959) by ESO/H.H.Heyer, CC BY 4.0, via Wikimedia Commons.
Not every step needs a frontier model. Our guide to the small language model explains where smaller ones fit.
Join the discussion