AI Agents: Capabilities, Risks, and Real-World Limits

AI agents are moving from experimental demonstrations into business operations, commerce, and scientific research. These systems can interpret goals, plan tasks, use software tools, and take actions with limited human intervention. They can manage information, automate workflows, and interact with external systems.

The promise is substantial: higher productivity, faster decisions, and lower operating costs. The risks are equally significant. AI agents may misunderstand instructions, misuse permissions, expose data, or take legally consequential actions that are difficult to explain.

The central question is no longer whether AI agents can act. It is whether they can act reliably, securely, and accountably enough for real-world deployment.

What Is an AI Agent?

An AI agent is a software system that interprets a goal, develops a plan, uses tools or data sources, performs actions, evaluates the results, and continues or changes course. Depending on its design, it may request human approval before completing sensitive tasks.

A typical AI agent workflow includes:

1. Receiving a goal or instruction.
2. Interpreting the user’s intent, context, and constraints.
3. Creating a plan.
4. Selecting tools, applications, or data sources.
5. Executing one or more actions.
6. Evaluating the results.
7. Continuing, revising the plan, or escalating to a person.

An agent’s practical capabilities depend on more than its underlying AI model. They also depend on its memory, context window, connected tools, data quality, permissions, monitoring, and approval rules.

AI Agents Versus Chatbots and Copilots

A chatbot primarily generates responses to user prompts. It may answer questions, summarize documents, or produce text, but it normally does not control external systems.

A copilot assists a person during a task. It may draft an email, suggest code, analyze a spreadsheet, or recommend a next step. The person generally remains directly involved in execution.

An AI agent can perform a multistep workflow. It may read an email, identify a request, check a database, create a ticket, notify a team, and update a record. The agent operates with greater autonomy and interacts with external systems through tools or integrations.

The distinction is not absolute. Many products combine chatbot, copilot, and agent features. The term “agent” can also create inflated expectations. A system may automate a narrow workflow without independently managing a broad objective.

The Bank Policy Institute has criticized the reliability of some AI agents, arguing that they may not consistently act in a user’s best interests or accurately represent the user’s intentions.

Technical Autonomy Is Not Practical Reliability

Autonomy means that a system can act without continuous human input. Reliability means that it completes an assigned task accurately, safely, and consistently.

More autonomy does not automatically create better outcomes. An agent that acts quickly but makes frequent errors may create more work and risk than it removes.

Organizations evaluating AI agents should measure:

• Task success rate.
• Error frequency.
• Escalation rate.
• Cost per completed task.
• Human review time.
• Security incidents.
• Damage caused by incorrect or unauthorized actions.

A reliable agent must do more than produce convincing reasoning. It must behave predictably in changing environments and recognize when it lacks enough information to proceed.

What Can AI Agents Do Today?

Administrative and Executive Workflows

AI agents are being tested for information-heavy executive tasks. Business Insider reported that Asana’s CEO uses agents to manage an inbox, monitor performance, and track competitors.

These tasks suit AI agents because they involve recurring information processing and can be divided into defined steps. An agent can collect messages, categorize them, compare performance indicators, summarize competitor activity, and present findings for human review.

Each task also has failure modes:

• Inbox prioritization may classify an urgent message as low priority.
• Competitive monitoring may mistake irrelevant activity for a meaningful trend.
• Performance summaries may inherit errors from source data.
• Automated responses may create reputational or contractual problems.

The safest design uses agents to collect, organize, and recommend information while requiring approval before high-impact communication or decisions.

Marketing and Operational Automation

Fortune reported an example of a company replacing $60,000 marketing roles with AI agents and hiring one employee at a substantially higher salary. This is an individual company account, not evidence that AI agents will replace all marketing jobs. It does illustrate how companies may restructure work around automation.

Marketing agents can support:

• Campaign drafting.
• Audience segmentation.
• Performance monitoring.
• Report generation.
• Message testing.
• Lead qualification.
• Routine content adaptation.

Human work remains essential for strategy, brand judgment, compliance, creative direction, and accountability for business results. An agent may optimize a campaign against a metric while missing a cultural, legal, or reputational issue that a human would recognize.

Food Delivery and Commerce

External AI agents can potentially place restaurant orders on behalf of users. They may interpret a request, select a restaurant, choose menu items, apply preferences, authorize payment, and submit the order.

DoorDash reported that external AI agents had generated only “hundreds” or “several hundred” orders during the period covered by its reporting. The figure confirms that agent-driven ordering exists, but adoption remains small compared with conventional app and web ordering.

Key barriers include:

• Authentication and account linking.
• Payment authorization.
• Incomplete user preferences.
• Substitutions for unavailable items.
• Refunds and disputes.
• Fraud prevention.
• Platform incentives.
• Responsibility for incorrect orders.

Consumer agent commerce remains an early use case because a simple request can involve many decisions and financial consequences.

Laboratory and Scientific Research

AI agents are also entering scientific workflows. R&D World has covered the use of agents, copilots, and AI in physical laboratory research.

Potential applications include:

• Experiment planning.
• Literature review.
• Instrument coordination.
• Data analysis.
• Repetitive laboratory procedures.
• Research documentation.

WIRED reported a neuroscience example in which an AI agent injected drugs into a live mouse’s brain.

The significance extends beyond that experiment. It demonstrates that agents can operate in physical research environments, where errors can affect living subjects, equipment, samples, and safety procedures. Physical actions require validated protocols, instrument safeguards, trained supervision, and clear intervention procedures.

Why AI Agent Adoption Remains Limited

Reliability Problems

AI agents can fail even when their explanations and outputs appear convincing. Common failure modes include:

• Misunderstanding the user’s intent.
• Selecting the wrong tool.
• Using outdated or incomplete information.
• Repeating failed actions.
• Taking an irreversible action too early.
• Failing to recognize uncertainty.
• Treating an ambiguous instruction as a complete specification.

Users need predictable behavior, not merely plausible responses. An agent that occasionally sends the wrong email or changes the wrong record may be unacceptable even if it performs well on average.

Ambiguous Instructions and Changing Environments

Agents operate in environments where websites change, application programming interfaces return unexpected data, policies vary by jurisdiction, and prices or inventory change continuously.

A request such as “book the best option” is not precise enough for a high-autonomy system. The agent must determine whether “best” means lowest cost, shortest travel time, a preferred provider, flexible cancellation, or another factor.

Organizations should define explicit constraints, including:

• Maximum budget.
• Approved vendors.
• Time limits.
• Required service levels.
• Required confirmation points.
• Prohibited actions.
• Acceptable substitutions.

Clear constraints reduce the number of decisions the agent must infer.

Trust and User Experience

Users may avoid AI agents if they must inspect every action. Constant review reduces the time savings, while no review creates the possibility of costly mistakes.

Effective systems should:

• Show the agent’s plan.
• Display relevant sources and tool calls.
• Explain why an action was selected.
• Identify uncertainty.
• Preserve an audit trail.
• Provide an easy way to pause or cancel execution.

The more consequential the action, the more important these controls become.

AI Agent Security and Trusted Access

Why Agent Permissions Create New Risks

An agent with access to email, financial systems, customer records, or laboratory equipment can cause harm at machine speed. Major risks include:

• Excessive permissions.
• Credential theft.
• Prompt injection.
• Data leakage.
• Unauthorized purchases.
• Misuse of connected tools.
• Privilege escalation.
• Destructive or irreversible actions.

An agent’s intelligence does not determine its authorization. A highly capable agent should not automatically receive broad access. Permissions must match the task, environment, and current user authorization.

Identity and Access Management for AI Agents

Oracle emphasizes the role of Oracle Cloud Infrastructure Identity and Access Management, or OCI IAM, in controlling AI agent access.

Strong access control should:

• Assign an identifiable identity to each agent.
• Grant only necessary permissions.
• Separate agents by function and environment.
• Use short-lived or rotating credentials.
• Revoke access when an agent is retired or compromised.
• Record actions for review.
• Restrict network access and available tools.
• Monitor behavior continuously.
• Provide emergency shutdown procedures.

Least privilege is the central principle. An agent that summarizes internal documents does not need permission to delete records or move money.

A Practical Access-Control Framework

Organizations can classify agent actions into three risk levels:

Low risk: Summarizing documents, organizing data, or generating internal drafts.

Medium risk: Sending messages, editing records, scheduling meetings, or updating workflow status.

High risk: Moving money, changing legal documents, deleting data, approving contracts, or controlling laboratory equipment.

Controls should match the risk:

• Low-risk actions may run automatically.
• Medium-risk actions should pass policy checks and may require review.
• High-risk actions should require explicit human authorization.

Permissions must be reviewed whenever an agent gains new tools, enters a new environment, or receives broader responsibilities.

Who Is Responsible When an AI Agent Causes Harm?

CNBC has examined legal liability when autonomous AI agents violate rules, highlighting the unsettled nature of accountability.

Responsibility may involve:

• The user who issued the instruction.
• The company that deployed the agent.
• The developer that built the system.
• The provider of a connected tool.
• The organization that supplied faulty data.

An AI agent is generally not a substitute for a legally accountable person or organization. Deploying an agent does not eliminate the need for governance, compliance, or supervision.

Organizations must determine:

• Who approved deployment?
• Who defined permissions?
• Who reviewed outputs?
• Who is responsible for customer harm?
• Which logs show what the agent did?
• Did it act within its approved scope?
• Were warnings or approval requirements ignored?
• Can the organization reproduce and explain the decision?

Governance Requirements for Enterprise AI Agents

Every production agent should have a named owner and documented operating boundaries. Documentation should define:

• The agent’s purpose.
• Allowed tools.
• Prohibited actions.
• Approved data sources.
• Approval thresholds.
• Escalation procedures.
• Retention and logging requirements.

Testing should include normal workflows, ambiguous requests, adversarial inputs, tool failures, unauthorized access attempts, and unexpected system changes.

Logs should preserve prompts, plans, tool calls, decisions, human approvals, errors, and final outcomes. Without these records, organizations may be unable to investigate incidents or demonstrate compliance.

Smaller Models Could Make AI Agents More Practical

GeekWire reported that the Madrona Prize recognized University of Washington research focused on shrinking AI models so they can run on small chips.

Smaller models could support agents on industrial equipment, laboratory instruments, robots, edge devices, and remote systems. Their advantages include:

• Lower hardware costs.
• Reduced latency.
• Lower bandwidth requirements.
• Better privacy through local processing.
• Operation in offline or restricted environments.

The trade-off is capability. Smaller models may provide faster responses and lower operating costs but have weaker reasoning, narrower knowledge, and less ability to manage complex workflows.

A compact model may be appropriate for a defined task such as detecting equipment anomalies. A broader agent coordinating multiple systems may require more powerful infrastructure.

A Realistic Adoption Roadmap for Businesses

Start With Bounded Workflows

Choose tasks that are repetitive, measurable, reversible, low risk, and supported by reliable data. Suitable starting points include:

• Internal search.
• Meeting preparation.
• Document classification.
• Report generation.
• Routine ticket triage.
• Data reconciliation.
• Draft creation.

Add Controls Before Adding Autonomy

Before enabling automatic execution, define:

• Success criteria.
• Tool permissions.
• Spending limits.
• Data boundaries.
• Approval requirements.
• Escalation paths.
• Emergency shutdown procedures.

Test the agent in a sandbox. Begin with recommendations or drafts. Move to automatic execution only after performance has been measured across normal, ambiguous, and adversarial cases.

Measure Business Value and Risk

Track:

• Time saved.
• Completion rate.
• Error rate.
• Human review time.
• Customer impact.
• Cost per task.
• Security incidents.
• Escalation frequency.

Compare the agent with the existing human or software workflow. Stop or redesign the system if oversight costs exceed productivity gains or if the agent creates unacceptable risk.

Conclusion: AI Agents Need Boundaries Before More Autonomy

AI agents can already manage information, support executives, automate marketing workflows, assist commerce, and participate in physical scientific research. Their capabilities will likely expand as models improve, tools become more connected, and smaller models run on local hardware.

The limitations remain substantial. Reliability is inconsistent. Consumer adoption is still limited in some use cases. Legal accountability is unsettled. Broad permissions create security risks. Physical-world actions require stronger safeguards than text generation.

Organizations should treat AI agents as powerful software operators, not independent employees. Successful deployment requires narrow objectives, least-privilege access, human oversight, transparent logs, and measurable outcomes.

Autonomy should expand only when an agent demonstrates reliable performance within clearly defined boundaries.

Frequently Asked Questions About AI Agents

What is an AI agent?

An AI agent is a software system that interprets a goal, plans tasks, uses tools, and takes actions with limited human intervention. Unlike a chatbot, it can interact with external systems and complete multistep workflows.

How are AI agents different from copilots?

Copilots generally assist a person during a task. AI agents can execute tasks independently, depending on their permissions and operating design. Many systems combine both approaches by requiring human approval for higher-risk actions.

What are the main risks of AI agents?

Key risks include incorrect actions, excessive permissions, data leakage, prompt injection, unauthorized transactions, poor decision-making, and unclear legal responsibility. Risk increases when agents can access sensitive data or take irreversible actions.

Are AI agents already widely used?

AI agents are being tested in executive workflows, marketing, commerce, and scientific research. Adoption varies by use case. DoorDash reporting that external agents had generated only “hundreds” or “several hundred” orders suggests that agent-driven food delivery remained at an early stage during the reported period.

How can businesses secure AI agents?

Use least-privilege access, unique agent identities, short-lived credentials, tool restrictions, approval workflows, audit logs, monitoring, and emergency shutdown procedures. Review permissions whenever an agent’s tools or responsibilities change.

Who is liable when an AI agent causes harm?

Liability depends on the facts, applicable laws, contracts, and roles of the user, deploying organization, developer, and service providers. Organizations should assume that deploying an agent does not remove their responsibility for governance, oversight, and compliance.