Product capabilities in this article are as of 31 August 2026. INVISOM has no commercial relationship with any vendor named. This article was researched and drafted with AI assistance, including tools from one of the vendors discussed, and reviewed for accuracy and balance.
What "agent" actually means
The word "agent" is now attached to almost every AI product, which makes it nearly useless as a buying signal. Gartner has a name for the problem, "agent washing", and estimated in June 2025 that only around 130 of the thousands of vendors claiming agentic products were offering anything genuinely agentic.
The two leading model providers draw the line in a similar place. OpenAI's guide to building agents describes them as systems that independently accomplish tasks on a user's behalf, and says that applications which use a language model without letting it control the workflow are not agents. Anthropic separates workflows, where models and tools are orchestrated through predefined code paths, from agents, where the model dynamically directs its own process and tool use. Both advise starting with the simplest design that works and adding autonomy only where it is needed.
Figure 1
From assistant to autonomous: where value sits today
Autonomy, and with it risk and cost, increases from left to right
Assistant
Answers prompts; no control over the workflow
Not an agent
Copilot
Suggests actions inside an application; a person executes
Label is unreliable
Workflow
Model inside predefined steps set by code
Most value today
Agent
Model chooses tools and steps in a loop, within guardrails
Narrow scope first
Multi-agent
Orchestrator and workers, or agents talking to agents
Highest risk and cost
The distinction matters commercially. Most of the value enterprises are capturing today sits in the middle of this spectrum: workflows with a language model inside predefined steps, and narrowly scoped agents with tight boundaries. Fully autonomous multi-agent systems are real, but they are the exception, and they carry the highest reliability, security and cost risks.
How an agent works, and where it fails
Every agent runs some version of the same loop: take a goal, plan, gather context, choose a tool, act, observe the result, check its own work, and either continue, hand back to a human or stop.
Figure 2
The agent loop, and its three exits
Every step is traced. Escalation to a person is a designed outcome, not a failure.
- 1GoalTask, constraints, budget
- 2PlanBreak into steps
- 3ContextRetrieve documents, memory, data
- 4Tool choiceSelect tool via MCP or API
- 5ActExecute in a sandbox
- 6Observe and checkEvaluate the result
Exit
Continue
Next step in the loop
Exit
Escalate
Failure threshold reached or high-risk action
Exit
Complete
Goal met; result returned
Across every step: agent identity, policy at tool calls, spend and iteration limits, full tracing.
Each step is a place where things go wrong, and the failures compound. Three bodies of evidence are worth knowing before any business case is signed.
Realistic tasks are still hard. In TheAgentCompany, a benchmark built by Carnegie Mellon researchers and others around a simulated software company, the best agent tested completed about 30% of tasks autonomously. On OSWorld, a benchmark of everyday computer tasks, humans succeeded on 72% of tasks at launch in 2024 while the best model managed 12%. Models have improved since, but the gap between demonstrations and dependable work remains.
Consistency is a separate problem from capability. The τ-bench study introduced a measure called pass^k: the chance an agent succeeds on every one of k repeated attempts at the same task. In the original 2024 study, a leading model succeeded on fewer than half of retail customer-service tasks, and on fewer than a quarter when it had to succeed eight times in a row. For an enterprise process that runs thousands of times a day, consistency is what matters.
Errors multiply across steps. If an agent completes each step of a ten-step process correctly 90% of the time, and errors are independent, the whole process succeeds only about 35% of the time.
Figure 3
Capability is rising; consistency is the constraint
Left: task success on realistic benchmarks (%). Right: why per-step reliability decides process success.
On τ-bench (2024), a leading model succeeded on fewer than half of retail tasks, and on fewer than a quarter when required to succeed eight times in a row.
Ten-step process
Share of runs completing all ten steps correctly
The practical conclusion is to design for per-step reliability, not demo success. Steps that must not fail should be deterministic code or workflow, with the model used where judgment adds value. Agent scope should sit well inside what has been shown to work, with human checkpoints at the boundaries.
There is good news on trajectory. METR's research on the length of tasks agents can complete found that it has doubled roughly every seven months over six years. But METR measures the length of task an agent completes with 50% reliability. Enterprise processes need far higher reliability, and at higher reliability thresholds the task lengths are much shorter.
OpenAI and Anthropic: converging stacks, changing products
The two leading model providers have both moved, during 2025 and 2026, from offering APIs and software development kits towards hosted agent runtimes and enterprise controls. Their stacks are increasingly similar in shape.
Figure 4
OpenAI and Anthropic agent stacks have converged in shape
Both moved from APIs and kits towards hosted runtimes and enterprise controls during 2025–2026
- Core APIOpenAIResponses API with built-in tools; Assistants API retired Aug 2026AnthropicMessages API with tool use and MCP connectors
- Developer kitOpenAIAgents SDK (open source, 2025; sandbox added Apr 2026)AnthropicClaude Agent SDK (the harness behind Claude Code)
- Hosted runtimeOpenAIManaged execution through Frontier (limited availability)AnthropicClaude Managed Agents (public beta, Apr 2026)
- No-code builderOpenAIAgent Builder deprecated; shuts down 30 Nov 2026AnthropicNo standalone visual builder
- End-user agentsOpenAIChatGPT agent; Workspace Agents (Apr 2026)AnthropicClaude Cowork (Apr 2026); Claude Code
- Open standard contributedOpenAIAGENTS.md (to the Agentic AI Foundation)AnthropicModel Context Protocol (to the Agentic AI Foundation)
Two observations matter more than any feature comparison.
Product half-life is short. According to OpenAI's deprecations page, the Assistants API was retired on 26 August 2026, a year after its deprecation was announced. On 3 June 2026, OpenAI announced the deprecation of Agent Builder, launched in October 2025, and of its Evals platform, with both shutting down on 30 November 2026; it points developers to the Agents SDK and ChatGPT Workspace Agents instead. Anthropic's agent tooling has also changed shape, with the developer kit behind Claude Code now offered as the Claude Agent SDK, and Claude Managed Agents, a hosted agent runtime priced at token rates plus a per-session-hour charge, entering public beta in April 2026. None of this is unusual for a young market, but it means agent definitions, evaluations and business logic should not live only inside a vendor's builder.
Open protocols are becoming the stable layer. The Model Context Protocol (MCP), introduced by Anthropic in 2024 to connect models to tools and data, was donated in December 2025 to the Agentic AI Foundation, a new Linux Foundation fund co-founded by Anthropic, Block and OpenAI, with AWS, Google and Microsoft among its platinum members. Google's Agent2Agent protocol (A2A), for communication between agents, moved to the Linux Foundation in 2025 and reached version 1.0 in March 2026. Building on these protocols, and on open telemetry standards for tracing, reduces exposure to any single product's lifecycle.
The enterprise platforms
Beyond the model providers, every major cloud and enterprise software vendor now sells an agent platform. They fall into two broad groups.
| Group | Examples (as of August 2026) | Strength | Watch for |
|---|---|---|---|
| Agent runtimes and builders | Amazon Bedrock AgentCore; Google Gemini Enterprise Agent Platform; Microsoft Foundry Agent Service; OpenAI Agents SDK; Claude Managed Agents and Agent SDK | Flexibility, any model or framework, engineering control | You build the business logic and the governance around it |
| Suite agents inside systems of record | Salesforce Agentforce; ServiceNow AI Agents; Microsoft Copilot Studio; UiPath agentic automation | Data context and processes already in place | Pricing per seat, action or credit; strongest inside one vendor's system |
These categories increasingly overlap with model choice. Microsoft's Foundry agent service is built on OpenAI's Responses API, Google's platform serves Anthropic's Claude models alongside Gemini, AWS AgentCore runs agents built with several frameworks, and UiPath supports models from multiple providers. Choosing the platform and choosing the model are now separate decisions.
In the Gulf, HUMAIN in Saudi Arabia unveiled HUMAIN ONE in October 2025, describing it as an agentic operating system for back-office work built on its Arabic-first ALLaM models. Regional options will matter for organizations whose data must stay in-country, a subject covered in our guide to RAG, fine-tuning and custom models.
The control plane comes first
The most important 2026 development is not a new agent builder. It is the arrival of control planes that claim to govern agents across vendors. Microsoft Agent 365, generally available since May 2026, provides a registry, agent identities in Entra and security controls, and inventories agents running on other clouds. ServiceNow extended its AI Control Tower in May 2026 to discover and govern AI across non-ServiceNow systems. Google's agent platform includes agent identity, a registry and a gateway. OpenAI announced an enterprise agent platform, Frontier, in February 2026, in limited availability. Identity providers such as Okta now issue identities to agents.
The lesson for enterprises running mixed estates is to pick one system of record for agent identity, inventory and policy before scaling builders. Otherwise agent sprawl will repeat the history of shadow IT, with higher stakes because agents act.
Figure 5
The control plane every agent program needs
Each layer mapped to the risks it mitigates
- IdentityA unique identity per agent; least-privilege, short-lived credentialsMitigates: Identity and privilege abuse
- Gateway and policyPolicy enforced at every tool call; tool allowlists; pinned tool versionsMitigates: Tool misuse; supply chain
- RuntimeSandboxed execution; network egress allowlistsMitigates: Unexpected code execution
- Human approvalRequired for irreversible or high-value actionsMitigates: Goal hijack; trust exploitation
- ObservabilityTraces of plans, tool calls and results; audit retentionMitigates: Rogue agents; cascading failures
- BudgetSpend caps, iteration limits, cost per completed taskMitigates: Cost overruns
The security case is concrete. NIST's evaluation of agent hijacking, where malicious instructions hidden in content an agent reads redirect its behavior, found that new red-team attacks succeeded 81% of the time against an agent that resisted known attacks, and that allowing 25 attempts instead of one raised average success across tasks from 57% to 80%. The OWASP Top 10 for Agentic Applications, published in December 2025, lists goal hijack, tool misuse, identity and privilege abuse, supply-chain vulnerabilities and memory poisoning among its leading risks. The common root cause is that agents do not reliably separate instructions from data, so every document, web page, email and tool description an agent reads must be treated as untrusted input.
Controls that work regardless of model or vendor:
- A unique identity for every agent, with least-privilege, short-lived credentials scoped to the task.
- Policy enforced at the tool call, not only in the prompt, through a gateway that can block actions.
- Human approval for irreversible or high-value actions, such as payments, deletions, external communications and production changes.
- Sandboxed execution and egress allowlists for anything that runs code or browses.
- Full tracing of plans, tool calls and results, retained as an audit record.
- Spend caps and iteration limits set as policy.
Cost: architecture beats price per token
Agents consume far more compute than chat. Anthropic reported that in its own systems agents used about four times the tokens of chat interactions, and multi-agent systems about fifteen times. Each loop re-sends a growing context, and unreliable steps trigger retries.
That changes procurement. Price per token matters less than cost per completed task, including retries, human review and failures. Gartner's June 2025 prediction that over 40% of agentic AI projects will be canceled by the end of 2027 cited escalating costs, unclear business value and inadequate risk controls, the same issues that undo AI pilots generally, as described in From AI Experimentation to Enterprise Value. Ask vendors to report cost per completed task on your workload, and set budgets per agent from the start.
The Gulf: mandates are moving faster than rules
The Gulf is notable for the speed of public-sector adoption. The UAE government's framework targets agentic AI in 50% of government sectors, services and operations by 2028. In March 2025, AIQ, a joint venture of ADNOC and G42, announced a US$340 million contract to deploy its agentic platform across ADNOC operations.
As of August 2026, we found no binding agent-specific regulation in either Saudi Arabia or the UAE. Existing data protection, cybersecurity and sector rules apply to agents as to any system, along with national AI ethics guidance. For multinational groups, the EU AI Act also matters: following the 2026 amendments, its main high-risk obligations now apply from December 2027 for most stand-alone systems, while its transparency obligations applied from August 2026.
In practice, the binding constraint for most Gulf organizations in 2026 and 2027 will be internal governance capacity, not regulation.
Build, buy, or both
Figure 6
Build, buy, or both
Work down the questions. Every answer still needs identity, approval rules and a cost cap.
- 1
Can the task be expressed as fixed steps?
If yes: Use a deterministic workflow or RPA, with a model only where judgment is needed. - 2
Does the work live inside one system of record, such as CRM or IT service management?
If yes: Start with that vendor's suite agents; check per-action pricing. - 3
Must data and processing stay in-country?
If yes: Favor self-hosted or in-region runtimes and models; verify where inference runs. - 4
Do you have engineering capacity to own business logic?
If yes: Build with an SDK on a managed runtime, keeping logic in your own code and open protocols.
What to do in the next 90 days
- Inventory every agent and agent-like feature already in use, including those embedded in SaaS products and developer tools.
- Choose the control plane: one system of record for agent identity, inventory and policy.
- Classify use cases on the autonomy spectrum and start with workflows and narrow agents in high-volume, verifiable tasks. The selection method in How to Select Enterprise AI Use Cases applies directly.
- Write the guardrail baseline: identities, tool-call policy, approval rules for irreversible actions, sandboxing, tracing and spend limits.
- Measure pass^k and cost per completed task in pilots, not single-run success.
- Keep logic portable: business rules and evaluations in your own code or open standards, with export rights in contracts.
- Apply the operating model: agents are governed AI systems, with decision rights and risk tiers as described in The Enterprise AI Operating Model.
Frequently asked questions
What is the difference between an AI agent and a workflow?
In a workflow, a language model works inside predefined steps set by code. In an agent, the model decides which steps and tools to use. Most enterprise value today comes from workflows and narrowly scoped agents, which are easier to test and govern.
How reliable are AI agents in 2026?
They are improving fast but remain inconsistent on complex, multi-step work. Benchmarks of realistic tasks show many failures, and success across repeated runs is lower than single-run success. Design processes so that critical steps are deterministic and humans approve irreversible actions.
What is the Model Context Protocol?
MCP is an open protocol for connecting AI models and agents to tools and data. Introduced by Anthropic in 2024, it was donated to the Linux Foundation's Agentic AI Foundation in December 2025 and is supported by OpenAI, Google, Microsoft and AWS products.
How should enterprises govern AI agents?
Give each agent its own identity and least-privilege access, enforce policy at tool calls, require human approval for high-impact actions, sandbox execution, trace every action and cap spending, managed from one control plane across vendors.
Sources and further reading
- Definitions: Building effective agents, Anthropic, December 2024; A practical guide to building agents, OpenAI, 2025.
- Products: OpenAI deprecations; Claude Managed Agents, Anthropic, April 2026; Microsoft Agent 365, May 2026; Amazon Bedrock AgentCore Evaluations, March 2026; Gemini Enterprise Agent Platform, April 2026; ServiceNow AI Control Tower, May 2026.
- Protocols: Agentic AI Foundation, Linux Foundation, December 2025; A2A anniversary, Google, April 2026.
- Reliability: TheAgentCompany; τ-bench; OSWorld; METR on long tasks; Anthropic multi-agent research system.
- Security and governance: NIST agent hijacking evaluations, January 2025; NIST AI Agent Standards Initiative, February 2026; OWASP Top 10 for Agentic Applications, December 2025; Gartner on agentic AI project cancellations, June 2025.
- Gulf: UAE agentic AI for government services; AIQ and ADNOC contract, March 2025; HUMAIN ONE, October 2025.