What is agentic AI why it changes how software gets work done

[Hunter_68]

TL;DR

• Agentic AI describes systems where a language model plans steps, uses tools and acts towards a goal, rather than only answering a single prompt
• The key ingredients are a capable model, tools it can call, memory or context about the task, and a loop that checks results and decides what to do next
• Open standards are forming: Anthropic's Model Context Protocol (November 2024) and Google's Agent2Agent protocol (April 2025) now sit under Linux Foundation governance, with MCP a founding project of the Agentic AI Foundation in December 2025
• Adoption is real but uneven: Stack Overflow's 2026 survey found 66 percent of developers use coding assistants or agents, while about 26 percent use automated agent workflows
• Agents raise new security and governance questions, which OWASP addressed in its Top 10 for Agentic Applications published in December 2025
• The winning pattern so far is narrow, well scoped agents with clear permissions and a human checking important steps

From chatbots to agents

For most people, the first experience of modern AI was a chat window. You typed a question, the model replied, and the conversation moved one message at a time. That pattern is useful, but it leaves the human doing most of the work around it. You copy answers into other tools, run the commands yourself and check every result by hand

Agentic AI changes that relationship. Instead of answering a single prompt, an agent is given a goal and the means to pursue it. It can break the goal into steps, call tools such as search, code execution, databases or business applications, look at what happened and decide what to do next. The human sets direction and reviews outcomes, while the agent handles much of the routine work in between

The word agentic has become a marketing favourite, so it helps to be precise. A system that summarises a document is not an agent in any meaningful sense. A system that reads a support ticket, looks up the customer's account, drafts a fix, runs a test and proposes the change for approval is much closer. The difference lies in planning, tool use and the ability to act across several steps

How an agent works under the hood

At the centre sits a large language model that does the reasoning. Around it, developers provide a set of tools, each described in plain language with defined inputs and outputs. When the model decides a tool would help, it produces a structured request, the surrounding software runs the tool, and the result is fed back to the model. This cycle repeats until the goal is met, a limit is reached or a human steps in

Context is the agent's working memory. It includes the goal, instructions, relevant documents, the history of actions so far and the results of each tool call. Managing that context well is one of the hardest engineering problems in agent design, because models can only consider a limited amount at once and can be distracted by irrelevant detail. Good agents summarise, prune and retrieve information carefully as they go

Planning and checking complete the picture. Strong agents write down a plan, compare progress against it and test their own work, for example by running code or verifying a fact against a source. Weak agents charge ahead and repeat mistakes. Much of the practical progress since 2024 has come from better models and better loops rather than from any single breakthrough

Memory across sessions is another growing feature. Some agents can store notes about a user's preferences or a project's conventions and recall them later. That makes them more helpful over time but raises questions about what is stored, who can see it and how it can be corrected. Good products make memory visible and editable

Open standards for connecting agents

In November 2024, Anthropic released the Model Context Protocol, usually called MCP, as an open standard for connecting AI applications to tools and data sources. It gives developers one common way to expose a database, a file system or a business application to any compatible AI client. MCP spread quickly across the industry, with support from many AI providers and developer tools during 2025. A useful analogy is a universal adapter between models and the systems they need to use

In April 2025, Google announced the Agent2Agent protocol, known as A2A, aimed at letting agents built by different vendors discover each other and collaborate. It was later placed under Linux Foundation governance. In December 2025, the Linux Foundation launched the Agentic AI Foundation, with Anthropic's MCP, Block's goose agent framework and OpenAI's AGENTS.md convention as founding projects. Neutral governance encourages competitors to build on the same plumbing

Standards matter for anyone buying or building agents. They reduce lock in, make security reviews more consistent and let organisations reuse connectors across tools. They also create shared attack surfaces, which is why security researchers have paid close attention to MCP servers and permissions. Healthy standards plus careful configuration is the combination to aim for

Where agents are delivering value

Software development has been the clearest early success. Coding agents can read a codebase, make changes across several files, run tests and open a pull request for review. Stack Overflow's 2026 Developer Survey, with more than 30,000 responses, found that 66 percent of developers used coding assistants or agents and about 26 percent used automated agent workflows. Many developers report that agents changed how they work during late 2025 and 2026, as models became more reliable over long tasks

Customer service, IT operations and back office work are the next frontier. Agents can triage tickets, gather account information, reset access, reconcile records and prepare reports. In these settings, value comes less from brilliance and more from consistency, speed and the ability to work across several systems. Well designed agents hand off to humans when a case falls outside their scope

Research and analysis tasks are another strong fit. An agent can search many sources, extract key facts, compare them and produce a structured summary with citations. The human still needs to check conclusions, especially where accuracy matters. Used this way, agents act like tireless research assistants rather than replacements for expert judgement

Personal productivity agents are emerging too. Assistants that manage calendars, sort email, book travel or fill in forms on the web promise to save time on everyday admin. They also need access to sensitive accounts, so trust and permissions matter enormously. Many people start by letting such agents draft actions for approval rather than act alone

How capability is measured

One widely discussed measure comes from METR, a research organisation that evaluates AI systems. In a March 2025 paper, METR measured the length of tasks, timed by how long they take skilled humans, that AI agents can complete with 50 percent reliability. It found that this task horizon had been doubling roughly every seven months since 2019, with faster growth in the most recent period. Later METR updates have continued to show rapid growth for leading models

Measures like this are useful but easy to over read. A 50 percent success rate is not good enough for many business processes, and benchmark tasks are cleaner than real work. Reliability at 80 or 95 percent, cost per task and behaviour when things go wrong often matter more in practice. Anyone evaluating agents should test them on their own tasks rather than relying on headline numbers

New risks that come with autonomy

Giving AI the ability to act creates risks that chat interfaces did not. An agent with access to email, files or financial systems can cause real damage if it misunderstands instructions or is manipulated. Prompt injection, where malicious instructions hidden in a web page, document or email hijack an agent, is the most discussed threat. Because agents read untrusted content as part of their work, they are naturally exposed to it

In December 2025, the OWASP GenAI Security Project published its Top 10 for Agentic Applications, cataloguing risks such as goal hijacking, tool misuse, identity and privilege abuse, memory poisoning and cascading failures between agents. It complements the earlier OWASP Top 10 for LLM Applications. Frameworks like these give security teams a shared vocabulary. They also help organisations ask better questions of vendors

Agents can be misused by attackers too. In November 2025, Anthropic reported disrupting a cyber espionage campaign it attributed with high confidence to a Chinese state sponsored group, in which an AI agent performed an estimated 80 to 90 percent of the operational work against around 30 targets. The company banned the accounts and notified authorities. The case showed that defenders need to plan for adversaries who use agents as well as for agents that go wrong by accident

Designing agents responsibly

• Start narrow: give each agent one well defined job with clear success criteria
• Apply least privilege: grant only the tools, data and permissions the task needs
• Keep humans in the loop for irreversible, costly or sensitive actions
• Treat all external content as untrusted and separate it from instructions where possible
• Log every action and tool call so behaviour can be reviewed and audited
• Set limits on time, spending and number of steps, with safe ways to stop
• Measure reliability on your own tasks before scaling up

These principles are not exotic. They mirror long standing security practice for any automated system, from scripts to service accounts. What is new is that agents make decisions in natural language and can be influenced by what they read. That makes careful scoping and oversight even more important

Testing agents is its own discipline. Teams build evaluation sets of realistic tasks, including tricky edge cases and deliberately malicious inputs, and run them whenever the model, prompts or tools change. Tracking success rates, costs and failure types over time shows whether changes help or harm. Without this discipline, agent quality can drift silently

Why agents change how software gets work done

The deeper shift is in the shape of software itself. Traditional applications encode every step a developer anticipated. Agentic systems combine fixed code for the parts that must be predictable with model driven reasoning for the parts that vary. That blend lets software handle messy, open ended tasks that were previously too expensive to automate

It also changes the role of people. Instead of performing every step, workers increasingly specify goals, review results and handle exceptions. Some tasks become faster and some roles change significantly, which raises real questions about skills, training and job design. Organisations that invest in helping staff work well with agents tend to see better results than those that simply deploy tools

Expectations need to stay grounded. Gartner predicted in June 2025 that more than 40 percent of agentic AI projects would be cancelled by the end of 2027 because of costs, unclear value or weak risk controls. That is not a verdict against agents. It is a reminder that careful scoping and measurement separate successful projects from expensive experiments

Closing thoughts

Agentic AI is one of the most important shifts in software since the move to the cloud. It turns language models from conversation partners into capable assistants that can plan, use tools and complete multi step work. The technology is improving quickly, standards are maturing and real deployments are delivering value. Responsible design keeps that progress safe and sustainable

If you are experimenting with agents at work or at home, please share what has worked and what has not. Concrete stories about scope, permissions and reliability are the most useful contributions. This forum is a great place to compare notes as the field moves


Key references for citation

• Anthropic, Introducing the Model Context Protocol, November 2024
• Linux Foundation, launch of the Agentic AI Foundation, December 2025
• METR, Measuring AI Ability to Complete Long Tasks, March 2025
• OWASP GenAI Security Project, Top 10 for Agentic Applications, December 2025
• Stack Overflow, 2026 Developer Survey
• Anthropic, report on disrupting an AI-orchestrated cyber espionage campaign, November 2025
• Gartner, prediction on agentic AI project cancellations, June 2025