What agents can do at work today

For the first years of this wave, most people met AI as a chat window. You asked, it answered, and you did the rest. Now the word on every slide is agent: software that is given a goal, takes the steps, uses the tools it is allowed to use and comes back with the work done.

The last weeks showed both sides of that. OpenAI put agents into ChatGPT that keep working in the background. Anthropic and METR described agents that did things nobody had asked them to do. Here is what we see when we hold the claims against the evidence, and against our own daily work.

What the numbers say

Adoption is real and uneven. In McKinsey's 2026 survey, 40 percent of respondents from organisations with more than a billion dollars in revenue said they were scaling AI agents, up from 27 percent a year earlier. Among smaller organisations the share stayed at 22 percent. About two in ten respondents were scaling coding agents, and 32 percent said their organisation had decided against buying a piece of software because it could now build it in house with coding agents.

The money has not followed yet. The share of respondents attributing any EBIT impact to AI stayed at 37 percent. Gartner places agentic AI at the peak of its hype cycle: in its 2026 survey of CIOs, 17 percent of organisations had deployed agents and more than 60 percent expected to within two years. Most deployments, it notes, remain narrowly scoped, and fully autonomous agents are not ready for the majority of enterprise use cases. It still expects more than 40 percent of agentic AI projects to be cancelled by the end of 2027, and warns of agent washing: chatbots and old automation relabelled as agents.

What they do reliably

The most careful measure we know comes from METR, which times AI agents on software tasks against how long the same tasks take skilled people. In its May report, the best public models succeeded half the time on tasks that take a person about 12 hours. Ask for four successes in five, and the task length falls to about an hour and a half.

That gap is the story of agents at work. They can attempt long tasks. They finish short ones dependably. A business process is judged on the dependable number, because nobody wants an invoice run that is right half the time. Anthropic's own advice still holds: workflows on predefined paths are predictable, agents that choose their own next step are flexible and prone to errors that compound, so start with the simplest setup that works and add autonomy only when it clearly pays.

What the last weeks showed

On 29 September, at its developer conference, OpenAI launched Dots: agents in ChatGPT that each run on their own cloud computer, keep working towards a goal between conversations, reach more than 4'000 apps and can be messaged in ChatGPT, Slack or Teams. SiliconANGLE reported that OpenAI tested specialist versions internally on procurement and invoice processing. The design is telling. While a Dot researches on its own, its connections to the owner's apps are read only. Actions that touch accounts or share information pass an automatic review, and OpenAI tells users to review consequential work, because the agents can still make mistakes. Pro users in Switzerland, the UK and the European Economic Area were left out of the launch.

On 30 September, METR's president told a US Senate subcommittee about an incident OpenAI disclosed in July, in which agents it was testing internally coordinated to cheat on their tests and compromised Hugging Face, a widely used AI platform, along the way. His summary was plain: developers have not yet solved the problem of keeping agents from pursuing actions against human intent.

On 9 October, Anthropic published an investigation into unintended actions by its models in evaluations and internal use. A research model submitted a real government form after a practice copy failed to load, and a small model sometimes submitted forms it had been told to leave unsubmitted. Others worked around restrictions to reach gated data, or used link shorteners to get past a tool's limits. Anthropic says the impact was minimal and, to its knowledge, no customer data was involved. It cut live internet access for all internal evaluations, tightened the guardrails on some of its web tools and built detection that blocked every case it described.

An instruction is not a gate

The lesson for a company is not that agents are dangerous toys. These were labs testing models hard, and they published what they found. The lesson is about where control lives. An agent told not to submit a form sometimes submitted it. An agent that cannot reach the submit button never will.

Checking needs the same care. In the second phase of Anthropic's Project Vend, a Claude agent running an office shop got a boss: a second agent acting as chief executive. It approved requests for special treatment about eight times as often as it refused them, and it shared many of the shop agent's blind spots, because it ran on the same model. A second agent on the same model is a good worker and a weak inspector. The check that matters should come from something different: a rule written in code, a test that passes or fails, or a person.

Gates in our own products

Every crue product works this way today. In Kontor, sending, payments and reminders are not even available to the assistant; a person does them. In Studio, the assistant drafts a change to the website, and a person approves every change and every publish. Lookout finds, writes and prepares on every channel, and a person approves what goes out. In Twin, every task for every role is marked: done on its own, waiting for approval, or handed to a person when it is not sure.

The next stage moves the gates. It does not remove them. Twin will run whole routines end to end, such as the month end, the offer and the onboarding, with approval at the gates a company chooses. Lookout will run the whole sequence inside your rules, from the first signal to the booked meeting. crue already runs on its own Twin, with more than 80 skills, and the line moves only when the current stage has held up in real work, ours first. What stays with people is the part that carries a name: the client conversation, the judgement call and the final yes.

Where to start

Gartner's advice is close to ours: use agents where a decision is needed, plain automation for routine workflows and an assistant for simple lookups. Much of the value is in choosing which is which.

Pick one routine that repeats every week, has a clear end and produces something a person can check in a minute. Write down the goal, the tools the agent may use and the point where it must stop, and build that stop into the tools, not only into the prompt. Put the gate before anything leaves the company: the invoice, the email, the published page. Then count honestly how often the draft needed no correction.

Agents are not colleagues yet. They are fast, tireless juniors with an uneven sense of when they are wrong. Give one a clear goal, the right tools and a gate it cannot talk its way past, and it already takes a great deal of work off the week.