Anthropic's own red-teaming of its browser agent found an 11.2% attack success rate after it added safety mitigations. That number, roughly one in nine prompt injections still landing, is the most useful sentence in the agentic-AI conversation, because the people building the thing published it.
Here is the honest version of what an agent actually is, what it can already do, and what the same documents say it cannot do yet.
A chatbot answers a question. An agent takes a goal, breaks it into steps, uses tools to act on each one, checks what happened, and adjusts (with real, if bounded, independence) until the job is done or it hits a wall.
The team that drew the line first defined it in December 2024. In "Building Effective Agents," Anthropic's engineering group put it this way: a workflow is a system where "LLMs and tools are orchestrated through predefined code paths," while an agent is one where "LLMs dynamically direct their own processes and tool usage, maintaining control over how they accomplish tasks."
What's actually driving this
- Better tool use. Anthropic's October 2024 "computer use" release let Claude look at a screen and click and type like a person, instead of needing purpose-built tools for every task.
- A tight run of agent products from every major lab. Computer use (October 2024), OpenAI's Operator (January 2025), Anthropic's Claude Code (February 2025), OpenAI's Codex (May 2025), and ChatGPT agent (July 2025): five launches in nine months.
- MCP-style standardization. Once tools and models share one standard interface, an agent reaching dozens of real tools stops being an engineering project. Bespoke integrations are the old bottleneck, and the new layer is replacing them.
What's genuinely shipping right now
Coding agents (Claude Code, OpenAI Codex) hand back a working pull request instead of a code suggestion. Browser agents (OpenAI's ChatGPT Atlas, Anthropic's Claude for Chrome, Perplexity's Comet) click and fill forms inside your actual browser tabs. General task agents (ChatGPT agent) handle multi-step work such as building a presentation or planning a trip. None of this is vaporware; every example above is in production and independently verifiable.
What it honestly can't do yet
This is the part most coverage skips, and where the primary sources are unusually candid. Anthropic's guidance warns of "higher costs, and the potential for compounding errors," and recommends deploying agents "only when simpler solutions fall short." OpenAI called Operator, its first agent, still learning and prone to mistakes with slideshows and calendars, and repeated the same caveat seven months later when it shipped the more advanced ChatGPT agent.
Security is measured, not hypothetical
Anthropic's red-teaming of Claude for Chrome found a 23.6% attack success rate under deliberate prompt injection before mitigations. With permission controls added, the rate dropped to 11.2%, roughly one in nine attacks still landing. Every major agent product now ships mandatory human-confirmation checkpoints for consequential actions. Full autonomy is a choice the labs building these tools have not made yet, by their own admission.
What this means for how you actually use one
- Use agents for bounded, correctable tasks first, things like drafting, scheduling, and first-pass research. Do not put them on unsupervised, consequential decisions.
- Keep a human confirmation step before anything public or irreversible. Every major agent vendor already requires this by default.
- Look for that same discipline in the tools you connect. Postey's MCP server lets an agent draft, adapt, and queue posts across platforms from a chat, but publishing still runs through a human review step.
The honest state of agentic AI in 2026: real, useful, and shipping, for bounded, supervised, correctable work. The labs building it say on the record it isn't reliable enough yet to run unsupervised on anything consequential. That candor is worth more than either the hype or the panic.
