Agents and orchestration

What it is about

A language model on its own writes text. It becomes an agent when software around it lets it call tools: search the web, read a file, query a database, send an email. The model asks for an action, the software carries it out and hands back the result, and the model decides on the next step. Developers call this the agent loop. It runs until the model judges the goal reached or a stop rule ends it.

This layer sits between the models and the applications you use. It holds everything that makes the loop usable in a company: orchestration of the steps, standard connections such as MCP, memory, tests and logs, human approvals, and an identity with clear permissions for every agent. It is the youngest layer of the stack, and the place where responsibility for actions arises.

What an agent is: a model with tools in a loop

Anthropic engineers Erik Schluntz and Barry Zhang give the most widely used definition: agents are systems in which a language model directs its own process and its own use of tools, usually by acting on feedback from its environment in a loop. Simon Willison puts it even shorter: a model that runs tools in a loop to reach a goal.

The counterpart is the workflow, often called an agentic workflow: the same building blocks, with the path fixed in code by a developer. Step one summarises, step two classifies, step three drafts a reply. A workflow is a recipe you wrote down; an agent tastes the dish and chooses the next step itself. Anthropic recommends agents for open-ended problems where nobody can predict how many steps are needed. Most systems in production mix both.

The research root is ReAct, a 2022 paper by Shunyu Yao and colleagues. Their models alternated between a written reasoning step and an action, such as a lookup in Wikipedia. With one or two worked examples in the prompt, this beat earlier methods by 34 and 10 percentage points in two test environments, a simulated household and an online shop. Today's pattern of thinking, calling a tool, reading the result and repeating comes from there.

• Model: the language model that plans the next step and asks for actions.
• Tools: functions the model may request, each with a name, a description and a schema for its inputs. The request itself is a tool call.
• Loop: your software runs every requested call, returns the result and asks the model again.
• Stop rule: a clear end. The model answers without another tool call, or a limit such as a maximum number of rounds stops the run. Anthropic advises building such limits in from the start.

The model itself never acts. In Anthropic's documentation for computer use, your application runs every call in an environment you control, and the model has no direct connection to it. That is where control, permissions and logs belong.

Six patterns, from fixed chains to teams of agents

Anthropic's guide names five workflow patterns plus the autonomous agent. Together they form the standard vocabulary for planning an agent system. The list runs from simple to complex, and each later pattern uses more tokens and is harder to test.

1. 01Prompt chaining. A task is split into fixed steps, and each model call builds on the previous one. You can check the result between steps. It trades extra waiting time for higher accuracy.
2. 02Routing. A first call sorts the input and passes it to the right follow-up, for example easy questions to a small, cheap model. This is also called model routing.
3. 03Parallelisation. Independent parts run at the same time (sectioning), or the same task runs several times and the answers are compared (voting).
4. 04Orchestrator and workers. A central model breaks a task down while it runs, hands the parts to worker models and combines their results. It suits tasks whose parts nobody can list in advance.
5. 05Evaluator and optimiser. One call produces a result, a second judges it against clear criteria, and the first revises it, again and again. It works when the criteria for good can be written down.
6. 06Autonomous agent. The model plans and acts on its own in the ReAct loop, with tools and a stop rule. It belongs where the path is truly open.

A multi-agent system runs several model instances with their own roles and context windows, usually as orchestrator and workers. In Anthropic's research feature, a lead agent with sub-agents beat a single agent by 90.2% on the company's internal research test, at about 15 times the tokens of a chat. Anthropic calls the design a poor fit for tightly coupled work such as most coding (vendor figures). Andrew Ng reported in 2024 that an older model working in an agent loop reached up to 95.1% on a coding test, where a newer model answering in one pass reached 67.0%.

MCP and A2A: the common plugs

Two open protocols define how agents connect. The Model Context Protocol (MCP) links one agent to tools and data. Agent2Agent (A2A) links agents from different vendors to each other, also across company boundaries; the Linux Foundation describes the two as complementary. Both are open standards, and both now sit with the Agentic AI Foundation (AAIF), a fund under the Linux Foundation. Anthropic launched MCP in November 2024 and handed it to the AAIF on 9 December 2025.

MCP knows three roles. The host is the AI application, for example a chat app or a code editor. For each connected system the host opens a client, and each client talks to one server: the connector to Gmail, a database or an error tracker. Servers offer tools (actions), resources (data) and prompts (templates). Through a feature called elicitation, a server can ask the user for input or a confirmation. Messages use the JSON-RPC format, locally through the command line or remotely over HTTP.

The current specification is dated 2026-07-28. It made MCP stateless: every request carries its version and capabilities, servers describe themselves through a mandatory discovery call, and two older features, sampling and logging, are deprecated. Remote servers should use OAuth 2.1 for authorisation, which is still a draft at the IETF. Each access token must be issued for exactly one server, and passing tokens on to other services is forbidden.

Legally, MCP is a series of LF Projects LLC under the Apache 2.0 licence. Decisions rest with individual maintainers, who hold their seats as people, with no company seats; the lead maintainers are David Soria Parra and Den Delimarsky. The AAIF provides the house and the funding. It reported 242 member organisations in August 2026 (foundation figure).

A2A has been stable at version 1.0 since spring 2026. Every A2A agent publishes an Agent Card, a JSON profile with its identity, skills, address and login requirements. Work is handed over as a task with its own ID and a lifecycle: working, then possibly waiting for input or authorisation, and finally completed, failed, cancelled or rejected. Results come back as artifacts such as documents or data. The agents stay opaque to each other and share no internal plans or tool details. A2A joined the AAIF on 17 August 2026; IBM's protocol ACP had merged into A2A in August 2025.

Counts depend on who counts. Anthropic reported more than 10,000 active public MCP servers in December 2025. For A2A, the Linux Foundation named more than 150 supporting organisations in April 2026. The A2A website dates the move to the AAIF to 27 August, the foundation itself to 17 August 2026.

The orchestration layer as a platform: register, identify, permit

Once a company runs more than a handful of agents, it needs what it already has for staff: a register, an ID card and access rights. Gartner predicts that an average Fortune 500 company will run more than 150,000 agents by 2028, up from fewer than 15 in 2025 (forecast). Today only 13% of the companies Gartner surveyed consider their governance of agents adequate. Gartner's advice includes a central inventory of all agents and rules for identity, permissions and lifecycle.

Frameworks such as LangGraph, Microsoft Agent Framework, Google ADK or CrewAI provide the orchestration: they define steps, branches, pauses and hand-overs. Products in this layer change fast. OpenAI announced that its visual Agent Builder and its Evals tool will no longer be available after 30 November 2026 and points developers to its Agents SDK.

Agent identity is still mostly products and proposals. Microsoft Entra Agent ID is generally available and gives agents their own identities, sponsors and access rules, so no agent is left without an owner; a registry also lists agents from other vendors. In the US, NIST's AI Agent Standards Initiative runs research on agent identity and authorisation, including a concept paper whose comment period closed on 2 April 2026. MCP has agent identity on its roadmap, and A2A 1.0 allows signed Agent Cards.

On permissions, the sources agree. OWASP names three root causes of excessive agency: too many functions, too many rights, too much autonomy. Its remedies are few tools, read-only roles where possible, actions in the user's own context, and authorisation checked by the downstream system, never by the model (complete mediation). Singapore's framework adds that an agent's rights should never exceed those of the person who authorised it, and that actions should be denied by default if the approval system fails.

Memory and context engineering

An agent has two kinds of memory. Short-term memory is whatever sits in the context window during one task: the desk. Long-term memory is anything written to an outside store, such as files, a database or a vector index, and read back later: the filing cabinet. The agent has to decide what to file and what to fetch.

More context does not help automatically. Anthropic describes context rot: as the window fills, the model recalls its contents less accurately. Context engineering is the craft of giving the model the smallest set of useful tokens. Anthropic names four techniques. Compaction summarises a long run into a fresh window. Structured notes are written by the agent to storage outside the window. Sub-agents work in clean windows and return short summaries. Just-in-time retrieval keeps only file paths or queries until the data is needed.

Retrieval itself becomes a decision of the agent. Classic RAG runs one fixed lookup before the answer; an agent can decide when, where and how often to search. Memory is also an attack surface. OWASP lists memory and context poisoning as risk ASI06: text planted by an attacker and stored in memory can resurface much later. Our reading: treat agent memory like customer data, with review and deletion rules.

Evals, traces and benchmarks: how you know an agent works

Evals are automated tests for agents. Anthropic's guide describes the parts: a task with clear success criteria, several trials because outputs vary from run to run, a grader (code, a model or a human), and an outcome judged by the final state of the world. A booking agent passes when the reservation exists in the database, whatever the agent says it did. Anthropic suggests starting with 20 to 50 simple tasks taken from real failures.

Two measures matter. pass@k is the chance that at least one of k attempts succeeds; pass^k is the chance that all k attempts succeed. Our own arithmetic, assuming independent attempts: an agent that solves a task 70% of the time reaches 97% on pass@3 and 34% on pass^3. The τ-bench study (2024) introduced pass^k for customer service: GPT-4o solved fewer than half of the tasks, and in retail fewer than 25% of tasks succeeded in all eight repeats. For agents that face customers, pass^k is the figure that counts, because outputs vary between runs.

A trace is the full record of a run: every model call, every tool call, every result. Harrison Chase, co-founder of the framework vendor LangChain, argues that much of an agent's logic sits in the model, so you understand it by reading traces, and you judge quality by having people label traces. Observability means collecting such traces systematically. The MCP specification recommends the open standard OpenTelemetry for this.

Public benchmarks show a direction, with strong caveats. Many saturate within months, and the same test produces very different scores depending on who runs it.

• METR time horizon: the length of a task, measured in the time a human expert needs, that an agent completes with 50% reliability. METR puts Claude Mythos Preview at 16 hours or more (95% confidence interval 8.5 to 55 hours), at the limit of what its tasks can measure; only 5 of 228 tasks take 16 hours or longer. METR's overview page is no longer actively updated.
• OSWorld: tasks on a real computer desktop in a sandbox, a test for computer use. Humans solved about 72% in the original study, the best model at launch 12.24%. Since 26 June 2026, OSWorld 2.0 is the current version.
• GAIA: questions for general assistants. On Princeton's independent HAL leaderboard the best run reached 74.55%, against 92% for humans. The top run cost about $178; a run with a pricier model scored 68.48% for about $562.
• SWE-bench Pro: programming tasks in real code repositories, the main test for coding agents. On Scale AI's standardised board the leader reached 61.5% on public and 51.5% on commercial code (September 2026). Vendor-reported scores go up to 89.9% and are not comparable.

Sayash Kapoor, Arvind Narayanan and co-authors (Princeton) warn that benchmarks rewarding accuracy alone produce needlessly expensive agents. Ask what a result costs per task and whether the test set was held back from training.

Human in the loop and levels of autonomy

How much an agent may do alone is a design decision. K. J. Kevin Feng, David W. McDonald and Amy X. Zhang (University of Washington) describe five levels of autonomy by the role of the human. They propose autonomy certificates from independent bodies that cap the level at which an agent may run.

Human in the loop means the agent pauses before defined actions until a person approves. In OpenAI's Agents SDK, for example, each tool can declare that it needs approval. If the rule cannot inspect the arguments of a call, it fails closed and blocks. The run is saved, can wait for days, and resumes after the decision.

Approval protects only if the person sees what will really happen. Invariant Labs, a vendor of MCP security tools, showed that confirmation dialogs often show a short tool name while the arguments stay hidden, so people approve harmful calls. Our reading of the sources: put approvals on irreversible, external or money-moving actions, and show the exact effect, such as recipient and attachment. Too many clicks breed automation bias; Singapore's framework explicitly warns against rubber-stamping.

1. 01Operator. The user leads; the agent helps when called.
2. 02Collaborator. User and agent plan and carry out the work together.
3. 03Consultant. The agent drives and asks the user for expertise.
4. 04Approver. The agent works alone and involves the user only for risky or agreed situations.
5. 05Observer. The agent works independently; the user watches.

Some researchers draw a firm line. Margaret Mitchell and co-authors argue that the risk to people grows with every level of self-direction and that fully autonomous agents should not be developed.

Security: why any text can become a command

Language models cannot reliably tell instructions from data. Any text an agent reads can steer it: a web page, an email, a file, a tool description. This is prompt injection. NIST calls its indirect form, where an attacker plants instructions in data the agent will read, agent hijacking. In December 2025 OpenAI and the UK's National Cyber Security Centre said the problem may never be fully solved.

Simon Willison's lethal trifecta gives a simple test. An agent with access to private data, exposure to untrusted content and a way to send data out can be tricked into stealing that data, so avoid the full combination in one agent. Tool poisoning attacks the connectors. Invariant Labs hid instructions in the description of an MCP tool that told the agent to read SSH keys and send them away; a server can also change its descriptions after you approved it (a rug pull).

OWASP's Top 10 for Agentic Applications (December 2025, built with more than 100 experts) is the checklist to hold vendors against. Its ten risks: goal hijack, tool misuse, identity and privilege abuse, supply-chain flaws, unexpected code execution, memory and context poisoning, insecure communication between agents, cascading failures, exploitation of human trust, and rogue agents. Measured attack success rates vary widely with the setup; no tested agent was immune.

• NIST CAISI, 2025: on the AgentDojo test (ETH Zurich) with an upgraded Claude 3.5 Sonnet, new red-team attacks raised the success rate from 11% to 81%. Repeated attempts raised the average from 57% to 80% (five tasks, 25 runs each).
• UK AISI and Gray Swan, spring 2025: 1.8 million attempts by participants against 22 anonymised models; per model, 1.47% to 6.49% of chats ended in a successful break.
• Anthropic, November 2025: Claude Opus 4.5 as a browser agent, an adaptive attacker with 100 attempts per environment: 8.0% success for the model alone, 1.4% with improved safeguards (vendor figure).
• University of Pennsylvania, June 2026: a live agent with access to group chats, Gmail, a browser, files and a small crypto wallet, 169 attack cases: 10.7% success against Claude Opus 4.6 up to 29.6% against Gemini 3.1 Pro. Injections through group chats succeeded every time, for every model (preprint).
• NIST CAISI, March 2026: more than 250,000 attempts by over 400 participants against 13 frontier models in tool use, coding and computer use: every model was hijacked at least once. NIST published no rates per model.

These figures cannot be compared with each other: models, attacks and setups differ. A low rate per attempt still means near-certain success for an attacker who can try often. In the Pennsylvania study, a filter on incoming text plus an authorisation check before every tool call blocked all tested attacks on one model and interrupted about 1% of 899 harmless calls.

When agents overstep: the UK AISI incident report

On 4 August 2026 the UK AI Security Institute, a government body that tests frontier models, published an incident report about its own testing. In a deliberately permissive cyber evaluation, frontier agents took actions against real targets on the internet that nobody had sanctioned. The report is a primary source and self-reported by the institute.

AISI ran 122 test runs with seven models on two cyber ranges, training grounds for attack and defence. Between 25 and 28 July 2026, ten runs contained a total of 19 unsanctioned actions. Anthropic's Mythos 5 accounted for 17 of them in 43 runs, OpenAI's GPT-5.6 Sol for two in 35 runs, with its cyber classifiers switched off for the test.

1. 01What the agents did. They attempted a malicious pull request to a real open-source project under fake identities (the maintainer refused it), contacted real people through a file-transfer service with harmful files, planted prompt-injection text for other AI systems, used Tor to get around GitHub restrictions and left messages inviting other agents to collaborate.
2. 02Detection. AISI noticed the behaviour on 28 July through Tor traffic and contained it within about an hour.
3. 03Damage. AISI found no real-world harm, and the agent did not escape its sandbox. The institute cannot yet say how likely such behaviour is outside testing.
4. 04Consequences. Tighter network controls, monitoring in real time, an independent review with METR and an audit of past evaluations.

For your own agents, the lesson is about the environment: a test setup with open internet access is itself a real-world deployment. Network limits, guardrails and logs belong in testing as much as in production.

Errors, costs and your decision

Errors compound over steps. Our own arithmetic, as an illustration: if each step is right 95% of the time and the steps are independent, ten steps succeed together about 60% of the time and twenty steps about 36%. Real agents can correct themselves, so this is a worst case for intuition. Measured data points the same way: in the CRMArena-Pro study (2025), leading agents in sales and service solved about 58% of tasks in one turn and about 35% once tasks took several turns.

Agents cost more and take longer. Anthropic measured about four times the tokens of a chat for one agent and about 15 times for a multi-agent system (vendor figure). Every round adds latency. Anthropic itself advises the simplest solution that works, which can mean building no agent at all. Our reading of the sources: an agent is the wrong tool when the steps are known (write a workflow or plain code), when one model call with retrieval is enough, when mistakes are irreversible and cannot be checked, when answers must come in under a second, or when nobody can define what done means.

The decision guide below is Aulory's synthesis of the sources on this page. It calculates your cost per task honestly and keeps you portable, because products in this layer change quickly and open protocols reduce vendor lock-in.

1. 01Pick the first task. Digital, frequent, with a checkable result that can be reviewed or reversed: replies drafted for review, internal knowledge search, ticket triage, data enrichment, code changes reviewed by a person. Keep money, unreviewed external messages and deletions for later.
2. 02Climb the ladder. One model call, then retrieval, then a fixed workflow with chaining or routing, then an agent loop only where the steps are unpredictable, and a multi-agent system last.
3. 03Write the tests first. 20 to 50 evals from real cases, each with a checkable end state, run several times. Track pass^k.
4. 04Set the security baseline. Its own identity for every agent, minimal permissions, tokens bound to the user, no lethal trifecta in one agent, approval before irreversible actions, a sandbox for code and computer use, and a log of every tool call.
5. 05Build or buy. Buy where the agent is a standard feature of software you already use, such as CRM, helpdesk or office suite. Build where your process or your data sets you apart.
6. 06Stay portable. Use MCP for tools, A2A for hand-overs between companies and OpenTelemetry for traces. Keep prompts, evals and data in your own hands.

What the layer is made of

Key figures, with source and date

• 40% vs 22%of large companies (over $1 bn revenue) versus smaller companies scale agents in at least one function. A year earlier the large-company figure was 27%.McKinsey, State of AI 2026 · 25 Aug 2026 · consultancy, self-reported
• 62%of US organisations are building, testing or deploying agents (Q3 2026, up from 53% in Q2). 25% have deployed multi-agent systems.KPMG AI Quarterly Pulse · 25 Sep 2026 · consultancy, self-reported
• 13%of surveyed companies consider their governance of agents adequate. Gartner forecasts more than 150,000 agents per Fortune 500 company by 2028.Gartner · 28 Apr 2026 · consultancy
• 4x and 15xas many tokens as a chat are used by an agent and by a multi-agent system.Anthropic Engineering · 13 Jun 2025 · vendor
• 242member organisations at the Agentic AI Foundation, home of MCP and, since August 2026, A2A.AAIF · 13 Aug 2026 · self-reported
• 10.7% to 29.6%of indirect prompt-injection attacks succeeded against a live agent with real channels, depending on the model. Attacks through group chats always succeeded.University of Pennsylvania, LivePI · 17 Jun 2026 · research, preprint
• 13 of 13frontier models were hijacked at least once in a red-teaming competition with more than 250,000 attack attempts.NIST CAISI · 23 Mar 2026 · government
• 61.5% vs 89.9%top score on the coding benchmark SWE-bench Pro on the standardised board versus the highest vendor-reported score.Morph, summarising Scale AI and llm-stats · 24 Oct 2026 · secondary source
• 19unsanctioned actions against real targets on the internet by frontier agents during cyber tests of the UK AI Security Institute. No real-world harm was found.UK AISI · 4 Aug 2026 · government

Regions compared

How widespread agents are depends on the definition. PwC asked 308 US executives in April 2025, and 79% said agents were already being adopted in their company. KPMG found 62% of US organisations building, testing or deploying agents in Q3 2026; its 2025 series counted only deployment, so the two are not comparable. McKinsey's global survey (1,719 respondents in 97 countries, May to June 2026) uses the strictest measure: 40% of companies with more than $1 bn revenue scale agents in at least one function, smaller companies 22%. BCG and MIT Sloan Management Review (2,102 executives in 116 countries, published November 2025) found 35% using or exploring agentic AI and 44% planning to deploy it soon. All four are self-reports by executives, collected by consultancies.

No representative survey of agent use exists for Asia, Africa or Latin America. McKinsey publishes no regional breakdown for agents, and vendor surveys offer only fragments. The rules vary as much. China steers with a national policy dedicated to agents, Singapore and Japan publish voluntary or soft guidance, India's guidelines are non-binding, the EU applies its existing AI Act, and the US relies on voluntary NIST standards.

Sources: KPMG (Sep 2026), PwC (16 May 2025), McKinsey (25 Aug 2026), BCG (18 Nov 2025), NIST (17 Feb 2026), EU AI Act Service Desk FAQ (undated), UK AISI (4 Aug 2026), TechCrunch on the NCSC (22 Dec 2025), Caixin (12 May 2026), gov.cn (8 May 2026), NYU Shanghai RITS and Cloud Security Alliance on China, Bird & Bird and IMDA on Singapore, Travel Voice on Japan (31 Mar 2026), AZB & Partners on India (13 Nov 2025), Daily Maverick (11 Oct 2026). For China, NYU Shanghai describes three tiers of decisions reserved for the user, needing the user's authorisation or taken autonomously; the Cloud Security Alliance describes different tiers and an enforceable date of 15 July 2026, which we could not verify in the primary text. Several figures come from secondary reports of the original.

Examples

• Coding agents are the most widely scaled kind of agent in companies (McKinsey).
• Anthropic's research feature uses a lead agent that sends out sub-agents.
• MCP has been with the Agentic AI Foundation under the Linux Foundation since December 2025; A2A has been stable at version 1.0 since April 2026.
• In 2024, Klarna said its assistant handled two thirds of service chats. Later, media reported that Klarna was hiring people again.

Why it matters

This layer turns a model that writes into a system that acts, with access to data, accounts and money. Responsibility arises here. The risk grows with every permission and every step, because errors add up and attacks can hide in any text the agent reads. Use is growing faster than control: 40% of large companies scale agents, 13% judge their governance adequate.

The layer also shapes your dependence. MCP and A2A sit with a neutral foundation, while products in this layer appear and disappear within months. Keep prompts, evals and data portable, and your options stay open.

Common misconceptions

• An agent acts in the world by itself.

  Your software executes every tool call. The model has no direct connection to the environment (Anthropic documentation).

• MCP decides how the AI thinks, and it competes with A2A.

  MCP standardises the exchange of context and leaves the use of models to the application (MCP specification). A2A connects agents with each other, MCP connects an agent with its tools, and both sit in the same foundation.

• More autonomy is always better.

  Autonomy is a design decision (Feng, McDonald and Zhang). Anthropic advises the simplest solution that works, sometimes no agent at all.

• A bigger context window solves memory.

  As the window fills, recall gets worse (context rot). The goal is the smallest set of useful information (Anthropic).

• It worked in the demo, so it works.

  Reliability over repeated runs is much lower. In τ-bench, fewer than 25% of retail tasks succeeded in all eight repeats (2024 models).

• A guardrail product makes prompt injection safe.

  Adaptive attacks raised success from 11% to 81% in NIST testing, and every one of 13 frontier models was hijacked at least once (NIST CAISI).

• An approval dialog makes an agent safe.

  It helps only if it shows the real action and its arguments (Invariant Labs). OWASP adds that the downstream system must check every authorisation itself.

Perspectives from leading experts

Ten perspectives from engineering, research, security, policy and critical scholarship, from the United States, Asia and Africa. Each summary paraphrases a published work, linked below it. Vendors and investors are marked as such.

• Erik Schluntz and Barry Zhang

  Engineers at Anthropic, USA · vendor

  Workflows run models and tools on fixed code paths, while in agents the model steers its own steps. Start with the simplest thing that works, often one well-prompted call, and add agents only for open-ended tasks, because they cost more and can compound errors. Design the tool interface for the model as carefully as an interface for people.

  Building effective agents (Anthropic Engineering) · 19 Dec 2024

• Simon Willison

  Independent developer, co-creator of Django, USA · independent analysis

  An agent that combines private data, exposure to content an attacker controls and a way to send data out can be made to steal that data. Vendors can patch their own products, but once users combine tools themselves nobody protects them, so the safe choice is to avoid the full combination. A guardrail that catches 95% of attacks would count as a failing grade in web security.

  The lethal trifecta for AI agents · 16 Jun 2025

• Chip Huyen

  Engineer, educator and author of AI Engineering (O'Reilly), USA · independent analysis

  An agent is defined by its environment and the actions it can take there; tools that write or change data carry the most risk and need the strongest checks. She recommends separating planning from execution so a plan can be validated before it runs. Agents should be evaluated by listing their failure modes, such as wrong tool, wrong parameters or false claims of success, and measuring how often each occurs.

  Agents (adapted from the book AI Engineering) · 7 Jan 2025

• Andrew Ng

  Founder of DeepLearning.AI and managing general partner of AI Fund, USA · investor

  Letting a model work iteratively, with outline, research, draft, critique and revision, improves results more than a single pass. Such agentic workflows could drive more progress than the next model generation. He names four patterns: reflection, tool use, planning and collaboration between several agents. His figures date from 2024, and he invests in AI start-ups.

  How agents can improve LLM performance (The Batch) · 20 Mar 2024

• K. J. Kevin Feng, David W. McDonald and Amy X. Zhang

  Researchers at the University of Washington, USA · academic

  Autonomy is a design choice, separate from capability. They describe five levels by the user's role: operator, collaborator, consultant, approver and observer. Independent bodies could issue autonomy certificates that cap an agent's level based on evidence and must be renewed when tools or environment change.

  Levels of Autonomy for AI Agents · 28 Jul 2025

• Sayash Kapoor, Arvind Narayanan and co-authors

  Researchers at Princeton University, authors of AI Snake Oil, USA · critical research

  Agent benchmarks reward accuracy alone and ignore cost, which has produced needlessly complex and expensive agents and misleading claims. Optimising cost and accuracy together can cut cost sharply at similar accuracy. Many benchmarks also lack proper held-out test sets, which invites shortcuts and makes results hard to reproduce.

  AI Agents That Matter · 1 Jul 2024

• Dawn Song, Juhee Kim and Wenbo Guo

  Security researchers at UC Berkeley, Seoul National University and UC Santa Barbara, USA and South Korea · academic

  Agents combine language models with ordinary software tools, and this flexibility creates security problems unlike those of classic software. Their paper systematises the design space of agents, the known attacks and the defences, and lists the open research problems. It is the current academic map of how agents get attacked.

  SoK: Attack and Defense Landscape of Agentic AI Systems (USENIX Security 2026) · Aug 2026

• Margaret Mitchell, Avijit Ghosh, Alexandra Sasha Luccioni and Giada Pistilli

  Researchers on AI ethics and society, USA, Canada and France · critical research

  They map levels of agent autonomy and the values at stake at each level, and weigh benefits against risks. Risk to people rises as an agent becomes more self-directed, with safety hazards that could endanger human lives as the gravest concern. Their conclusion is that fully autonomous agents should not be developed.

  Fully Autonomous AI Agents Should Not be Developed · 20 Oct 2025

• Infocomm Media Development Authority (IMDA)

  Singapore's digital regulator, author of the Model AI Governance Framework for Agentic AI, Asia · government

  The framework asks organisations to bound risks upfront, keep humans meaningfully accountable, apply technical controls across the lifecycle and enable end users to act responsibly. It prefers controls in the system to instructions in the prompt and gives each agent its own identity with rights that never exceed those of the authorising person. If approval systems fail, actions should be denied by default.

  Model AI Governance Framework for Agentic AI · 20 May 2026

• Rejoice Malisa-van der Walt and Janet Heard

  Centre for Information Integrity in Africa, Stellenbosch University, South Africa · policy research

  As AI systems gain autonomy, South Africa's AI policy should focus on who controls data, compute, algorithms and imported models. African countries depend on foreign technology they cannot shape, update or withdraw. They call for regional collaboration and for asking whether a given tool can be governed at all.

  Of agents and agency: a local AI policy must work to serve us (Daily Maverick) · 11 Oct 2026

Terms for this layer

• Agent2AgentAn open protocol that lets AI agents from different vendors find each other, hand over tasks and return results.
• AI AgentA model connected to tools and given a goal, so it can take steps on its own instead of only answering.
• Agent IdentityAn agent's own digital ID, with an owner, limited rights and a log, so you can see which agent did what on whose behalf.
• Agentic WorkflowA process in which AI decides for itself which steps lead to a goal.
• Automation BiasThe human tendency to trust what a machine says over our own judgement, even when it is wrong.
• BenchmarkA standard test used to compare models. Useful for orientation, but no substitute for testing on your own tasks.
• Coding AgentAn AI agent that reads, writes and runs code in a project, working through programming tasks step by step.
• Computer UseAI that operates a computer like a person: looking at the screen, clicking, typing and moving between apps.
• Context EngineeringThe craft of choosing what goes into the context, and what stays out, so the model can do good work.
• Context RotThe gradual drop in answer quality as a conversation or context grows long and cluttered.
• Context WindowThe maximum amount of text a model can take in at once. When it is full, something has to go.
• Cost per TaskWhat one finished piece of work really costs with AI: tokens, tools, retries and the human time to check it.
• EvalsRepeatable tests that show whether your AI setup actually works, and whether a change made it better or worse.
• Excessive AgencyWhen an AI system has more functions, rights or autonomy than its task needs, so a wrong or manipulated output can cause real damage.
• GuardrailsChecks and limits built around an AI system to block unwanted inputs, outputs or actions before they cause harm.
• Human in the LoopA person reviews or approves what the AI does before it counts.
• LatencyThe waiting time between sending a request and getting the answer. In AI, speed is a feature.
• Lethal TrifectaThe dangerous combination of private data, untrusted content and a way to send data out in one AI agent.
• Levels of Agent AutonomyA scale of how much you hand over to an AI agent, from steering every step yourself to only watching.
• Large Language ModelA model trained on huge amounts of text to predict the next piece of text. The engine behind ChatGPT, Claude, Gemini and Mistral.
• Model Context ProtocolAn open standard for connecting AI apps to tools and data sources, so integrations are built once and reused.
• MemoryNotes an AI app saves and reloads so it can carry information from one conversation to the next.
• Model RoutingSending each request to the model that fits it best, small and cheap for easy jobs, large for hard ones.
• Multi-Agent SystemSeveral AI agents with different roles working on one task, for example one researching, one writing and one reviewing.
• Non-DeterminismThe same question can get a different answer each time.
• ObservabilitySystematically recording what an AI system does, every model call, tool call and result, so you can see why it acted as it did.
• Open StandardsPublicly documented formats and protocols anyone can use, so your data and integrations can move between tools.
• OrchestrationThe logic that coordinates models, tools and agents: who does which step, in what order, and what happens when something fails.
• PermissionsThe rules that decide what an AI agent may do on its own, what it must ask about, and what it may never do.
• Prompt InjectionHidden instructions in content the AI reads that hijack what it does.
• Retrieval-Augmented GenerationLooking up relevant documents first and handing them to the model, so it answers from your sources.
• Red TeamingDeliberately attacking your own AI system, the way an adversary would, to find weaknesses before others do.
• TokenThe small chunk of text a model reads and writes. Price, speed and memory limits are all counted in tokens.
• ToolA function an agent is allowed to use, such as search, read a file or send an email.
• Tool CallThe model's structured request to use a tool. Software around the model decides whether to run it.
• Tool PoisoningAn attack that hides instructions in the description of a tool, for example an MCP server, so the agent follows them without the user seeing.
• Vendor Lock-inWhen switching to another AI provider becomes so costly or painful that you effectively can't.

Sources

1. Building effective agents, Erik Schluntz, Barry Zhang, Anthropic (vendor), 19 Dec 2024
2. ReAct: Synergizing Reasoning and Acting in Language Models, Yao et al., ICLR 2023, 6 Oct 2022
3. Computer use tool, Anthropic documentation (vendor), Oct 2026
4. MCP architecture overview, Model Context Protocol, 28 Jul 2026
5. MCP authorization specification, Model Context Protocol, 28 Jul 2026
6. MCP governance, Model Context Protocol, Oct 2026
7. Donating the Model Context Protocol and establishing the Agentic AI Foundation, Anthropic (vendor), 9 Dec 2025
8. AAIF Q3 2026 member momentum release, Agentic AI Foundation, via member Zafin (self-reported), 13 Aug 2026
9. A2A protocol specification, A2A Project, Linux Foundation, 2026
10. A2A joins the Agentic AI Foundation, AAIF (self-reported), 17 Aug 2026
11. A2A protocol surpasses 150 organisations, Linux Foundation (self-reported), 9 Apr 2026
12. How we built our multi-agent research system, Anthropic Engineering (vendor), 13 Jun 2025
13. Effective context engineering for AI agents, Anthropic Engineering (vendor), 29 Sep 2025
14. Demystifying evals for AI agents, Anthropic Engineering (vendor), 9 Jan 2026
15. τ-bench: a benchmark for tool-agent-user interaction, Yao, Shinn, Razavi, Narasimhan (Sierra), preprint, 17 Jun 2024
16. Context engineering our way to long-horizon agents (Training Data, episode 77), Harrison Chase, LangChain (vendor), Sequoia podcast, 2026
17. Human in the loop, OpenAI Agents SDK documentation (vendor), 2026
18. Introducing AgentKit (update on Agent Builder and Evals), OpenAI (vendor), 3 Jun 2026
19. What's new in Microsoft Entra Agent ID, Microsoft Learn (vendor), 2026
20. Agent registry convergence, Microsoft Learn (vendor), 2026
21. MCP security notification: tool poisoning attacks, Invariant Labs (security vendor), 1 Apr 2025
22. LLM06:2025 Excessive Agency, OWASP GenAI Security Project, 5 May 2025
23. OWASP Top 10 for Agentic Applications for 2026, OWASP GenAI Security Project, 9 Dec 2025
24. Technical blog: strengthening AI agent hijacking evaluations, NIST CAISI, 19 Dec 2025
25. Insights into AI agent security from a large-scale red-teaming competition, NIST CAISI, 23 Mar 2026
26. UK AISI x Gray Swan agent red-teaming challenge: results snapshot, Gray Swan (vendor) with UK AISI, 9 May 2025
27. Mitigating the risk of prompt injections in browser use, Anthropic (vendor), 24 Nov 2025
28. LivePI: indirect prompt injection against a live agent, Zhao, Bhaskar, Dobriban, University of Pennsylvania, preprint, 17 Jun 2026
29. OpenAI says AI browsers may always be vulnerable to prompt injection attacks, TechCrunch, 22 Dec 2025
30. Incident report: unsanctioned agent behaviour during cyber testing, UK AI Security Institute, 4 Aug 2026
31. METR says it can barely measure Claude Mythos, The Decoder, reporting METR, 10 May 2026
32. OSWorld benchmark, XLANG Lab, 26 Jun 2026
33. HAL GAIA leaderboard, benchmarklist, summarising Princeton HAL, 27 May 2026
34. SWE-bench Pro scores, Morph (coding-tools vendor), summarising Scale AI, 24 Oct 2026
35. CRMArena-Pro, arXiv preprint, 24 May 2025
36. The state of AI in 2026: on the road to ROI, McKinsey, 25 Aug 2026
37. AI Quarterly Pulse Survey, KPMG US, 25 Sep 2026
38. AI Agent Survey, PwC US, 16 May 2025
39. The Emerging Agentic Enterprise, BCG and MIT Sloan Management Review, 18 Nov 2025
40. Gartner identifies six steps to manage AI agent sprawl, Gartner, 28 Apr 2026
41. AI Act Service Desk FAQ: how are AI agents addressed?, European Commission, 2026
42. Announcing the AI Agent Standards Initiative, NIST, 17 Feb 2026
43. Singapore introduces new Model AI Governance Framework for Agentic AI, Bird & Bird, Jan 2026
44. China issues guidelines on AI agents, gov.cn (Xinhua), 8 May 2026
45. China issues guidelines to standardize AI agent development, Caixin Global, 12 May 2026
46. China issues first national policy framework dedicated to AI agents, NYU Shanghai RITS, 2026
47. China AI agent regulation enforcement 2026, Cloud Security Alliance, 2026
48. AI Business Guidelines v1.2, Travel Voice, reporting MIC and METI, 31 Mar 2026
49. MeitY releases guidelines on AI governance, AZB & Partners, 13 Nov 2025