At the start of the year, we named agents the defining AI trend of 2026: systems that complete multi-step tasks rather than just answering questions. Agent features are now built into major assistants, browsers, coding tools and office software. So where do they genuinely deliver, and where are they still more demo than dependable?
Updated September 2026: we added sources on the limits of research agents, evidence on coding productivity, how agent performance changes with task length and prompt injection risk.
This is not a scorecard of specific products, which change monthly. It is a framework based on the kinds of work agents are being asked to do.
Where agents are delivering
Research with sources. Deep research features that search many sources and assemble a cited report are among the most widely used agent capabilities. They save hours of initial research. The output still needs checking: OpenAI says its deep research tool can sometimes hallucinate facts and may struggle to tell authoritative information from rumors. The citations make that checking practical.
Coding. Software development is the clearest success, as covered in our coding assistants guide. Code has something most work lacks: automatic checks. Tests, compilers and linters tell the agent, and the developer, whether the work is correct. Speed gains are not automatic, though: in a randomized trial by METR in early 2025, experienced open-source developers took 19% longer on real tasks when allowed to use AI tools, even though they believed the tools had sped them up.
Structured back-office tasks. Extracting data from documents, reconciling records, triaging tickets and preparing drafts work well when inputs are consistent and outputs can be spot-checked. These often look like the workflow automations we have described, with more flexibility.
Bounded web tasks. Filling out forms, comparing information across a handful of sites and gathering details can work well when the steps are clear and a person approves the final action.
Where they still struggle
- Long, open-ended tasks with many steps and no clear checkpoints, where small errors compound; METR’s research on task length found that models’ success drops sharply as tasks get longer
- Messy interfaces, such as unusual websites, pop-ups and logins, that trip up computer-use agents
- Tasks requiring judgment about people, priorities or organizational politics
- Knowing when to stop: agents can loop, over-reach or declare success too early
The pattern behind success
What working agent deployments have in common A clear goal. Access limited to what the task needs. Checkpoints where results can be verified. A human approving anything irreversible. A log showing what the agent actually did.
The difference between a useful agent and a frustrating one is rarely the underlying model alone. It is how well the task is scoped and supervised.
Security is the sleeper issue
Agents that read email, web pages and documents can encounter prompt injection: hidden instructions designed to hijack them. An agent with access to your inbox and the ability to send messages is an attractive target. OWASP ranks prompt injection as the top security risk for applications built on language models. Security researchers regularly demonstrate such attacks, and AI companies are investing in defenses, but no one claims the problem is solved. Limit permissions, require confirmation for sensitive actions and be cautious about connecting agents to accounts containing sensitive data.
What this means for workers
So far, agents look more like capable assistants that need management than autonomous replacements. The skills that matter are shifting toward defining tasks clearly, reviewing work efficiently and knowing when not to delegate. Those are management skills, and more people will need them. As we argued in our reliability column, trust has to be earned task by task.
Where agents stand today
Agents are delivering real value where tasks are well defined and results are checkable, especially in research and software. For open-ended work with real-world consequences, the winning setup remains the same: let the agent do the legwork, and keep a person in charge of decisions.
Sources
- Introducing deep research, OpenAI, February 2025
- Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity, METR, July 2025
- Measuring AI Ability to Complete Long Tasks, METR, March 2025
- LLM01:2025 Prompt Injection, OWASP Gen AI Security Project
