At the start of the year, we named agents the defining AI trend of 2026: systems that complete multi-step tasks rather than just answering questions. Agent features are now built into major assistants, browsers, coding tools and office software. So where do they deliver, and where are they still more demo than dependable?
This is not a scorecard of specific products, which change monthly. It is a framework based on the kinds of work agents are being asked to do.
Where agents are delivering
Deep research features, which search many sources and assemble a cited report, are among the most widely used agent capabilities, and they save hours of initial research. The output still needs checking. OpenAI says its deep research tool can sometimes hallucinate facts and may struggle to tell authoritative information from rumors, and the citations are what make checking practical.
Software development is the clearest success, as covered in our coding assistants guide. Code has something most work lacks: automatic checks. Tests, compilers and linters tell the agent, and the developer, whether the work is correct. Speed gains aren’t automatic, though. In a randomized trial by METR in early 2025, experienced open-source developers took 19% longer on real tasks when allowed to use AI tools, even though they believed the tools had sped them up.
Structured back-office work goes well too. Extracting data from documents, reconciling records, triaging tickets and preparing drafts all work when inputs are consistent and outputs can be spot-checked. These jobs often look like the workflow automations we’ve described, with more flexibility.
On the web, agents handle bounded tasks reasonably well: filling out forms, comparing information across a handful of sites and gathering details. That works when the steps are clear and a person approves the final action.
Where they still struggle
Long, open-ended tasks with many steps and no clear checkpoints are still hard, because small errors compound. METR’s research on task length found that models’ success drops sharply as tasks get longer. Messy interfaces, such as unusual websites, pop-ups and logins, trip up computer-use agents. Agents also struggle with judgment about people, priorities or office politics, and with knowing when to stop: they can loop, overreach or declare success too early.
The pattern behind success
What working agent deployments have in common A clear goal. Access limited to what the task needs. Checkpoints where results can be verified. A human approving anything irreversible. A log showing what the agent actually did.
The difference between a useful agent and a frustrating one is rarely the underlying model alone. It is how well the task is scoped and supervised.
Security is the sleeper issue
Agents that read email, web pages and documents can encounter prompt injection: hidden instructions designed to hijack them. An agent with access to your inbox and the ability to send messages is an attractive target. OWASP ranks prompt injection as the top security risk for applications built on language models. Security researchers regularly demonstrate such attacks, and AI companies are investing in defenses, but no one claims the problem is solved. Limit permissions, require confirmation for sensitive actions and be cautious about connecting agents to accounts containing sensitive data.
What this means for workers
So far, agents look more like capable assistants that need management than autonomous replacements. The skills that matter are shifting toward defining tasks clearly, reviewing work efficiently and knowing when not to delegate. Those are management skills, and more people will need them. As we argued in our reliability column, trust has to be earned task by task.
Where agents stand today
Agents are delivering value where tasks are well defined and results are checkable, especially in research and software. For open-ended work with real-world consequences, the winning setup remains the same: let the agent do the legwork, and keep a person in charge of decisions.
Sources
- Introducing deep research, OpenAI, February 2025
- Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity, METR, July 2025
- Measuring AI Ability to Complete Long Tasks, METR, March 2025
- LLM01:2025 Prompt Injection, OWASP Gen AI Security Project
Related reading: how US AI rules apply to agent deployments.
