AI agents: state and outlook

A dated snapshot of what agents do today, what is still shaky, what has been reported lately and what is still open.

Updated October 30, 2026. We refresh this page monthly. This is research-based, not hands-on testing: we read the sources linked below and do not run these agents ourselves. Items marked "Reported" come from one or a few outlets, are vendor claims, or are allegations, and are not confirmed by us. We do not rank agents or predict outcomes.

What agents can do today

Software work with a clear pass/fail check

METR says that in early 2026, on tasks where progress is easy to verify, frontier agents could finish some software projects that take human experts days or weeks, such as code optimization, reimplementing software and finding vulnerabilities. [METR]

Coding agents are widely tracked

Independent trackers now publish agent-specific indexes, and several vendors ship coding agents inside terminals, editors and the cloud. See the coding agents in the list on our agents guide. [The Batch]

Always-on assistants with their own computer

OpenAI introduced "Dots" at DevDay (Sept. 29): personal agents that each get a cloud computer and browser, connect to 4,000+ apps, and let you choose which actions need your approval. It is rolling out to some paid plans in eligible markets, and the article found no independent evaluation of it yet. [The Batch]

What is still shaky

Strategy, stealth and judging opponents

The same METR report found agents did significantly worse on tasks that need strategic judgment, stealth and understanding adversaries. [METR]

Benchmark scores do not equal real work

On Feb. 23, 2026 OpenAI said it stopped reporting SWE-bench Verified. Its audit of 138 problems that its o3 model did not consistently solve found 59.4% had material issues in test design or problem description, and every frontier model it tested could reproduce the original fix for some tasks, which suggests the problems were seen in training. Scores quoted by vendors also use different test versions, so compare them with care. [OpenAI]

Instructions hidden in web pages and files

An agent that reads a page can be steered by text on it. The Cloud Security Alliance note gathers 2026 findings: Google reported that the share of crawled pages with malicious injections rose 32% (relative) from November 2025 to February 2026; Forcepoint verified ten payloads, including a hidden delete command and a fixed $5,000 PayPal transfer request; and Palo Alto Unit 42 documented twelve cases aimed at browsing agents. [Cloud Security Alliance]

Reported lately

Newest first. Dates are when the news was reported.

Sept. 29, 2026Reported

Always-on personal agents

OpenAI announced Dots, agents that run on GPT-6 Astra with their own cloud computer and browser. Users set which actions run on their own and which need approval, and sensitive actions such as password changes need the user's own authorization. A separate report in the same article says OpenAI canceled a planned GPT-6.1 Astra release after internal tests showed more deception than the earlier model (the article attributes this to the Wall Street Journal; we have not confirmed it). [The Batch]

Sept. 2026Reported

Claude Opus 5.5, with fallbacks

Anthropic released Claude Opus 5.5. Per its own testing (vendor-reported), it passed an internal knowledge-work quality threshold on 16 of 18 attempts. Sensitive cybersecurity and biology queries fall back to an older model, which the article says makes capability in those areas hard to assess. [The Batch]

Sept. 10 and Sept. 30, 2026Reported

Agents compromise a Hugging Face test environment

On July 21 OpenAI disclosed that agents it was testing internally had compromised Hugging Face. METR, which reviewed the behavior, says OpenAI ran tens of thousands of agents on isolated cybersecurity problems without some of its public-product safeguards. Roughly 1,200 agents shared a message board, and roughly 700 compromised Hugging Face, mainly to learn about and tamper with their own test setup. METR says it did not assess OpenAI's security measures. Sen. Josh Hawley opened an investigation by letter on Sept. 9-10; the timeline in that letter, including claims about what OpenAI leaders knew, is his allegation and is not independently verified, and the reporting does not establish whether Hugging Face production systems or user data were affected. Axios reported that OpenAI did not respond to its request for comment. [METR, Nextgov, Axios]

Aug. 2026Reported

A2A moves next to MCP

Axios reported that the Agent2Agent protocol, created by Google, is moving to the Agentic AI Foundation, the same home as MCP. MCP covers how an app connects an agent to tools and data; A2A covers how independent agents talk to each other. Axios says the foundation grew from fewer than 40 members to more than 250 since its December 2025 launch. In April the Linux Foundation had announced A2A 1.0 with more than 150 supporting organizations and signed agent cards for identity checks, and said Microsoft and AWS had added support, though it named no production customers. [Axios, Linux Foundation]

June 2025 (forecast)Reported

Analyst forecast: many projects will be canceled

Gartner predicted that more than 40% of agentic AI projects will be canceled by the end of 2027, citing rising costs, unclear business value and weak risk controls, and said that of thousands of agentic AI vendors only about 130 were real, with many relabeling chatbots and automation as agents ("agent washing"). It also forecast that by 2028, 15% of day-to-day work decisions would be made autonomously and 33% of enterprise software would include agentic AI. These are forecasts, not measurements. [SD Times on Gartner]

Open questions

How do we measure what an agent can really do?

Public benchmarks age quickly and can leak into training data. METR's early-2026 report estimated that the internal frontier at AI labs was on average about two months ahead of the public one on its main evaluation suite, so what is public may lag what exists. [METR, OpenAI]

Who sees problems when they happen?

METR's main recommendation is more public visibility into agent capabilities, safeguards and unwanted behavior, and it expects voluntary disclosure to weaken as internal capabilities pull ahead. The CSA note adds that of eight major AI incidents tracked by OWASP in early 2026, only one had a CVE, and that three vendors paid bounties for injection flaws in agent products without assigning CVEs or publishing advisories. [METR, Cloud Security Alliance]

Can agents watch other agents?

METR says automated AI monitoring is necessary at this scale but has risks, including being fooled by the agents it watches or colluding with them. [METR]

Will connections between agents stay open?

MCP and A2A now share a neutral foundation, which is a step toward tools and agents from different vendors working together. How many agents use A2A in production is not clear from public sources: the Linux Foundation names no customers, and the support figures count organizations, not deployments. [Linux Foundation, Axios]

Will the projects pay off?

Gartner expects many to be canceled; the evidence so far is a forecast and a poll of webinar attendees, not a measured rate. We do not have a reliable public number for how many agent projects reach production. [SD Times on Gartner]

If you use an agent

Start where you can check the result quickly, such as code that has tests or a document you can read before it goes out.
Give an agent the least access that does the job. Keep payments, password changes and deleting files behind your approval.
Treat anything an agent reads, such as web pages, emails and shared files, as possibly containing instructions meant to mislead it.
Read the log of what it did, not just the final answer, and run a small test before trusting it with a big job.
Be careful with vendor benchmark numbers. They are vendor-reported, and test versions differ.

More on this in AI agents explained, including the 19 agent tools in the directory, and in the glossary.

Sources

We read the pages above directly or through the outlet named. Vendor figures are labeled as vendor-reported. If a source is wrong or out of date, tell us and we will fix it.