An AI agent is a program built on a large language model that does more than generate text: it carries out operations in external information systems on its own. Unlike a chat assistant, an agent is given the authority to call application interfaces (APIs), change records in databases, run code and start transactions on behalf of an organization.
In brief
- From text to execution: a chat assistant gives a person an answer; an AI agent sends a command straight to the execution environment: a database, a cloud server, a payment gateway or a file store.
- Connection at industrial scale: according to Anthropic, as of 9 December 2025 there were more than 10,000 active public servers of the Model Context Protocol (MCP) and more than 97 million monthly downloads of its Python and TypeScript SDKs.
- The danger of direct authority: if an agent is handed full-permission keys with no check in between, a mistake of a probabilistic model immediately becomes a deleted production volume or a wiped file system.
- The limit of manual approval: in 52.9% of public descriptions of AI agent deployments in Russia in 2025–2026 (37 of 70, from the institute’s desk review of October 2026), the main containment measure is approval of the operation by a human.
- A mathematical check before the action: checking the parameters of every call with a formal solver against a machine-readable contract separates what the model proposes from what is actually admitted for execution.
What is an AI agent in simple terms?
In practice, an AI agent differs from earlier programs in its right to act on its own. It receives a goal, breaks it down into intermediate steps, chooses software tools and runs a chain of calls until it gets a result. A person sets the overall task but does not type each command.
Architecturally, agentic AI is a system of four connected parts:
- The language model (planning core): turns the task into a sequence of machine operations and interprets the responses of external programs.
- Memory and state: keeps the context of a multi-step task, the history of calls already made and data taken from corporate reference systems.
- The tool catalogue (the interfaces of action): modules connected through standard buses, in particular through the MCP protocol, for working with files, querying databases, sending messages or managing cloud infrastructure.
- The execution environment: a server, a workstation or a sandbox where commands and scripts run under the credentials that were issued.
In engineering practice this class of systems is called agentic AI. Classic robotic process automation (RPA) scripts follow a fixed route and stop at any change in the interface. An agent that runs into an error looks for a workaround on its own to finish the task. This ability to improvise while holding credentials is what creates a new class of information security threats.
How does an AI agent differ from a chatbot and an assistant?
The difference between an AI agent and an AI assistant is a direct path to the infrastructure. An assistant finishes its work by showing text on the user’s screen; an agent finishes it by changing the state of an external system. Between an assistant’s advice and the production environment there is always a person who reads the answer and decides whether to run the proposed code. In an agent, this buffer is removed for the sake of speed.
| Feature | Chatbot (scripted) | AI assistant (conversational) | AI agent (autonomous executor) |
|---|---|---|---|
| Result of the work | An answer from a pre-written decision tree | Generated text, a reference answer, a draft of code | A completed operation: a changed database, a sent API call, a script that ran |
| Degree of autonomy | None: it moves strictly along the branches of the script | One step: a human’s request, a text answer | Many steps: planning, calling tools, reading errors, working around obstacles |
| Access to infrastructure | Reads a reference list or files a request in one form | Reads files uploaded to the chat and search results | Calls APIs directly, has access to a terminal, the file system and cloud resources |
| Cost of a model error | An unhappy user, a hand-off to an operator | An inaccuracy in the answer, which an employee corrects | Deleted working volumes, files and databases |
| Control | The script tree is checked when it is set up | A person proofreads the answer before using it | A formal check of the parameters of every call at a gate before it runs |
Moving from adviser to executor changes what has to be protected. While the model only generated text, the main risk was a wrong wording in the answer. Once the model can call external tools, any hallucination or misreading of the context becomes an executable command in the company’s production environment.
What do AI agents already do in companies?
In companies, AI agents already write and deploy code, manage cloud environments, route requests between internal databases and work with external services. Most of the verifiable data concerns software development and IT infrastructure management.
Industry data confirm the scale:
- Autonomous development and work with code. According to Anthropic’s announcement of its Series G round of 12 February 2026, the run-rate revenue of the agentic coding environment Claude Code exceeded $2.5 billion, having more than doubled since the start of 2026; the number of business subscriptions quadrupled, and businesses account for more than half of all Claude Code revenue. Earlier, in a Menlo Ventures report of 20 November 2024, code copilots had already reached 51% adoption among the enterprises surveyed.
- Connection to corporate systems through MCP. When the Model Context Protocol was donated to the Agentic AI Foundation under the Linux Foundation on 9 December 2025, there were more than 10,000 active public MCP servers and more than 97 million monthly SDK downloads in Python and TypeScript. Stacklok’s report “State of Model Context Protocol in Software 2026” (published in January 2026, based on a December 2025 survey of 300 senior technical leaders at enterprises with 500 or more employees in the US, Canada and the UK, in finance, retail and software) found that 41% of organizations already used MCP in limited (29%) or broad (12%) production; among software companies the figure was 45% (26% and 19%).
- Adoption forecasts. Gartner (press release of 26 August 2025) predicts that by the end of 2026, 40% of enterprise applications will feature task-specific AI agents, up from less than 5% in 2025. An earlier Gartner forecast (first given in October 2024 and repeated in a press release of 25 June 2025) expects that by 2028 at least 15% of day-to-day work decisions will be made autonomously (0% in 2024), and that agentic AI will be part of 33% of enterprise software applications (less than 1% in 2024). Juniper Research, in a press release of 7 April 2026, forecasts that spending through agentic commerce will reach $1.5 trillion by 2030.
Why should an agent never get keys without a check on every action?
Because a probabilistic model that hits an error in the working environment can, to finish its task, use any token it finds or call a destructive system command. A text restriction in the system prompt (“do not delete the production database”, “work only in the test folder”) is not a technical barrier: the model can override environment variables or call a legacy API endpoint if the key’s permissions allow it.
Real cases in which agents without an independent gate destroyed databases and working files were documented in 2026.
Case 1. A Cursor agent deletes the PocketOS production volume (April 2026)
According to the first-hand account of PocketOS founder Jer Crane on X and the statement of Railway CEO Jake Cooper, on Friday, 24 April 2026, a Cursor agent running the Claude Opus 4.6 model was performing a routine task in a staging environment. The AI Incident Database and Lumenova’s analysis of 25 August 2026 give the same date. Faced with a credentials mismatch, the agent found a full-permission Railway API token in a file unrelated to the task and, with a single call to a legacy endpoint that had no delayed delete, destroyed the volume holding the production database. The volume-level backups were stored on the same volume and disappeared with the database. The data was not lost for good only because Railway restored it from its own internal copies about 30 minutes after being contacted (AI Incident Database, incident No. 1469). Lumenova’s analysis stresses that pre-release testing caught none of the incidents it examined, and that the failures were caused by excessive access rather than by the quality of the models.
Case 2. Agents on GPT-5.6 “Sol” delete files and databases (July 2026)
After the GPT-5.6 “Sol” model was released on 9 July 2026, a series of incidents followed with agents running in full-access mode. On 13 July 2026, Matt Shumer wrote on X that a Codex agent on GPT-5.6 in full-access mode had deleted almost all the files on his Mac with an rm -rf command (the event took place around 10 July). Another user reported the deletion of a production database after destructive integration tests were run by mistake; a third reported files deleted from his home directory by a subagent that had been given the wrong path. On 16 July 2026, Thibault Sottiaux, head of Codex at OpenAI, publicly acknowledged the problem. He explained that the deletions happened more often in full-access mode without a sandbox, and that in some cases the model itself overrode the $HOME environment variable to point to a temporary directory and then deleted $HOME by mistake. Both cases are analysed in more detail on the page AI agent incidents.
Gartner (press release of 25 June 2025) predicts that over 40% of agentic AI projects will be cancelled by the end of 2027 because of escalating costs, unclear business value or inadequate risk controls. In a press release of 11 June 2025, Gartner also predicts that by 2030 guardian agents, specialised protective systems, will take 10–15% of the agentic AI market.
Who is responsible if an agent makes a mistake?
People and the organization are. An AI agent has no legal personality in any jurisdiction. An action that an agent performs with a corporate key on behalf of a company will be treated by counterparties and the regulator as an action of that company; inside the company, the question becomes the responsibility of those who gave the agent its authority and access. How this works under Russian law is described on the page who is liable for AI mistakes. The legal conclusion in a specific case belongs to the organization’s lawyer.
Trying to close this risk by having a living employee approve every operation runs into the limit of human attention. In the desk review of 70 public descriptions of AI agent deployments in Russia in 2025–2026 (October 2026), human approval is the main containment measure in 52.9% of cases (37 of 70). Under an intense stream of similar requests, checking turns over time into mechanically pressing the approve button, which is called approval fatigue, while responsibility for the approved operation stays with the company.
What to do: practical steps for a chief executive
To move AI agents from uncontrolled risk to a managed loop, the language model has to be separated from the direct execution of commands:
- Take stock of agent connections and secrets. Find all coding agents, connected MCP servers and scripts used in the organization. Remove full-permission tokens from working directories and configuration files, so that a model cannot find and use them as in the PocketOS incident.
- Do not run agents in full-access mode without isolation. Forbid running autonomous tools in
full-accessmode on workstations and production servers without a sandbox and a strict limit on the file system paths they can reach. - Write the limits of authority into machine-readable contracts. Move security rules out of the prompt’s text instructions into strict rule files, for example YAML contracts per class of actions, where the admissible call parameters are stated explicitly.
- Put a software gate that checks actions in front of the tools. In the IS 3.0 architecture, a software gate sits between the agent and the executing system. One example is the MITR gate being developed by the ANO Scientific Research Institute of System Synthesis: it checks each call with a formal solver in
QF_UFLIAlogic, without calling a language model. According to instrument measurements of 14 October 2026 on a set of 19 action-class contracts, the median decision time of the gate under a rule (P4) is 0.95 ms, and a full call including an explanation takes 4.26 ms (earlier measurements: 26 September 2026, 0.74 and 3.31 ms with 17 contracts; 2 October 2026, 0.87 and 4.43 ms). A call is admitted only when the absence of a violation is mathematically proven (UNSAT); when there is a violation, a counterexample is returned with the conditions for a fix; if a class of actions has no contract, the solver refuses. The refusal is enforced in enforce mode, while in advisory mode the agent receives a warning: as of 14 October 2026, one class of actions, file deletion, runs in enforce mode, and the other classes run in advisory mode. - Make decisions provable with a hash chain of receipts. Every decision to admit or refuse should be written to a hash chain with external
OpenTimestampstime anchors. On the MITR test bench, as of 14 October 2026, a control set of 62 cases (ADR-0262: 50 attacks on actions and 12 ordinary controls) gave 0 missed attacks and 0 false refusals. A replay of the chain’s decisions with the checker written for an outside party matched 4,958 of 4,958; the replay was done by the institute. No outside verifier has replayed it yet; for checking the integrity of the chain and theOpenTimestampsstamps on your own, an open kit is published atasi5.ru/console/verify/. The strategy for governing autonomous agents is set out in the institute’s book Proven Action. Power and Control over AI Agents: Strategy 2027–2035 (Alexander Fischuk, 2026, in Russian).
Frequently asked questions
What is an AI agent in simple terms?
An AI agent is a program built on a language model that has been given tools to act in external systems: to call APIs, edit code, work with files and databases. Unlike an ordinary chatbot, an agent builds a plan of several steps by itself and carries out commands to reach the goal a person has set.
How does an AI agent differ from a chatbot and an assistant?
A chatbot answers from pre-built templates, and a conversational AI assistant only produces text or a draft of code in the chat window. An AI agent is connected directly to the working infrastructure, for example through the MCP protocol, and changes the state of corporate systems itself, without a person copying commands by hand.
What do AI agents already do in companies?
Agents write, test and deploy code, manage cloud resources and automate operations between corporate applications. According to Anthropic, as of 12 February 2026 the run-rate revenue of the agentic development environment Claude Code alone exceeded $2.5 billion, and more than half of it comes from business customers.
Why should an agent never get keys without a check on every action?
A probabilistic model that fails in a test environment may use any full-permission token it finds on a server, or override system variables to get around the error. In the spring and summer of 2026, direct access without a gate in between led to the deletion of a production database volume at PocketOS and to users’ directories being wiped by agents on GPT-5.6 “Sol”.
Who is responsible if an agent makes a mistake?
The company and the people who gave the agent its authority and credentials: the agent itself has no legal personality. Counterparties and the regulator treat an operation that an agent performed on a company’s behalf as an action of that company. The conclusion in a specific case belongs to the organization’s lawyer.
Sources
- AI Incident Database, incident No. 1469 (PocketOS, Cursor, Railway production volume deletion): https://incidentdatabase.ai/cite/1469/ ; Lumenova, “Agentic AI Security Incidents”, 25 August 2026: https://www.lumenova.ai/blog/agentic-ai-security-incidents/
- BankInfoSecurity, “OpenAI Warns GPT-5.6 File Deletions Stem From Full-Access Mode” (posts of 13 July 2026 and the explanation by the head of Codex at OpenAI of 16 July 2026): https://www.bankinfosecurity.com/openai-warns-gpt-56-file-deletions-stem-from-full-access-mode-a-32262
- Anthropic, “Donating the Model Context Protocol and establishing the Agentic AI Foundation”, 9 December 2025: https://www.anthropic.com/news/donating-the-model-context-protocol-and-establishing-of-the-agentic-ai-foundation
- Stacklok, “State of Model Context Protocol in Software 2026”, January 2026: https://stacklok.com/wp-content/uploads/2026/01/State-of-MCP-in-Software-2026_FINAL.pdf
- Anthropic, “Anthropic Raises $30 Billion Series G Funding at $380 Billion Post-Money Valuation”, 12 February 2026: https://www.anthropic.com/news/anthropic-raises-30-billion-series-g-funding-380-billion-post-money-valuation
- Menlo Ventures, “2024: The State of Generative AI in the Enterprise”, 20 November 2024: https://menlovc.com/2024-the-state-of-generative-ai-in-the-enterprise/
- Gartner press releases of 11 June 2025, 25 June 2025 and 26 August 2025: https://www.gartner.com/en/newsroom/press-releases/2025-06-25-gartner-predicts-over-40-percent-of-agentic-ai-projects-will-be-canceled-by-end-of-2027 ; https://www.gartner.com/en/newsroom/press-releases/2025-06-11-gartner-predicts-that-guardian-agents-will-capture-10-15-percent-of-the-agentic-ai-market-by-2030 ; https://www.gartner.com/en/newsroom/press-releases/2025-08-26-gartner-predicts-40-percent-of-enterprise-apps-will-feature-task-specific-ai-agents-by-2026-up-from-less-than-5-percent-in-2025
- Juniper Research, press release on the agentic commerce market, 7 April 2026
- ANO Scientific Research Institute of System Synthesis: instrument measurements of the MITR gate (protocol of 14 October 2026, ADR-0262) and a desk review of 70 public descriptions of AI agent deployments in Russia, 2025–2026 (October 2026). Open kit for checking the integrity of the chain: https://asi5.ru/console/verify/
Checked: 16 October 2026