Where AI Agents Actually Are: A Snapshot, 27 August 2026

This is a snapshot. It is dated 27 August 2026, and it is written to be read again later, when we know which parts were wrong.

That is the whole point of it. The AI conversation is loud, fast and almost entirely undated — people make confident claims and then quietly stop making them, and nobody keeps score. So this post tries to do the opposite: state where things actually stand, with numbers you can go and check, and finish with a set of markers specific enough to be graded.

One rule I set myself: no roll-call of this week’s models. I went looking for a clean list of current frontier releases and found aggregator sites confidently naming models that do not survive cross-checking. Version numbers are the least durable thing you can write about this field — anything I name here is stale within weeks. The structure lasts longer than the leaderboard.

1. The number that actually matters

The single most useful measurement in this field right now comes from METR, and it is not a benchmark score. It is a duration.

METR measures the length of task — timed by how long it takes a competent human professional — that a frontier agent can complete on its own. That length has been doubling roughly every seven months for about six years. Over 2024–25 the doubling looked more like every four months.

Exponentials on that timescale are the reason this feels like it is happening to you rather than around you. But there is a catch, and it is the most important thing in this entire post.

That headline number is measured at 50% reliability. A coin flip. It is the task length an agent finishes successfully half the time.

METR also measures an 80% horizon — the length of task an agent completes well enough that you would not feel obliged to check its work. That number is dramatically lower. For Claude 3.7 Sonnet the 50% horizon was 59 minutes and the 80% horizon was about 15 minutes: a gap of four to five times. And the 80% line rises more slowly than the 50% line.

So there are two curves, and the press only ever quotes the top one. The gap between them is the exact distance between demo and deploy. Every disappointed enterprise pilot in the next section lives in that gap.

METR, to their considerable credit, publish their own note on the limitations of the measurement. Anyone quoting the doubling figure at you without mentioning the reliability threshold either has not read it or is hoping you have not.

2. What an agent actually is, mechanically

Strip the marketing off and an agent is four things in a loop:

• A model that predicts the next token, and nothing more mystical than that.
• Tools — functions it can call. Read a file. Run a query. Send a request.
• A context window, which is its entire working memory. Anything not in it does not exist.
• A harness — the unglamorous loop that runs the model, executes the tool it asked for, feeds the result back, and decides whether to go round again.

That is it. The intelligence sits in the model, but the reliability sits almost entirely in the harness, and the harness is ordinary software engineering: retries, timeouts, validation, permissions, logging, knowing when to stop.

This is why two teams using the identical model get wildly different results, and why “which model is best” is a much less interesting question than the discourse assumes. In practice the failures are boring and repetitive:

• Context exhaustion. Long tasks fill the window, early decisions fall out, and the agent contradicts something it decided an hour ago.
• Error compounding. Chain twenty steps at 95% each and you are at 36%. Autonomy multiplies small failure rates into large ones.
• Confident wrongness. A failed tool call that returns something plausible is worse than one that crashes, because the loop continues.
• No natural stop. Knowing a job is finished, or hopeless, is a genuinely hard problem and mostly still solved by imposing a step limit.

None of these are solved by a better model. They are solved by better engineering around the model, which is why the interesting work has quietly migrated from prompts to plumbing.

3. The plumbing got standardised, and that is the big structural change

If you want one genuinely load-bearing development to date this snapshot by, it is not a model release. It is that the connection layer stopped being proprietary.

Model Context Protocol — the standard for how an agent discovers and calls tools — is now vendor-neutral. Anthropic donated it in December 2025 to the Agentic AI Foundation, a directed fund under the Linux Foundation co-founded with Block and OpenAI. It is now governed as a Linux Foundation project rather than by whoever invented it.

The adoption numbers are genuinely startling. Per the protocol’s own July release notes, the Tier 1 SDKs are seeing close to half a billion downloads a month, with the TypeScript and Python SDKs each having crossed one billion total downloads.

The 2026-07-28 specification is the tell for where this is heading. It threw away the stateful bidirectional design — no more initialize handshake, no more session IDs — in favour of stateless request/response, header-based routing, and cacheable responses. In plain terms: they are rebuilding it to work like the web. Stateless, cacheable, routable, load-balanced. That is not a research decision, it is an infrastructure decision, and you only make it when you expect enormous volume.

Alongside it sits Google’s A2A for agent-to-agent communication, launched April 2025 — MCP connects an agent to tools, A2A connects agents to each other.

Worth noting for balance: there is a body of academic work arguing these protocols standardise the mechanics of interoperability while leaving governance unexpressed — they can say what a tool does, but not who is accountable when it does it wrong. That gap is going to matter.

4. The hole nobody has closed

Here is the part that should worry you, and it has not moved in a year.

Prompt injection is unsolved. Not “hard.” Not “being worked on.” Structurally unsolved, and openly acknowledged as such by the people building these systems.

The reason is architectural. A language model receives everything — your instructions, the user’s request, and whatever text came back from that webpage or email or document — as one undifferentiated sequence of tokens. There is no privilege boundary. There is no mechanism that reliably says “this part is a command and that part is merely data.” Fifty years of computer security rests on exactly that distinction, and this architecture does not have it.

The clearest framing is Simon Willison’s lethal trifecta. An agent is exposed when it has all three of:

• Access to private data — your files, your mail, your database.
• Exposure to untrusted content — anything it reads from the outside world.
• A way to send data out — an API call, a link, even a rendered image.

Hold all three and you are one poisoned document away from a bad afternoon. And note that this list describes the exact feature set every vendor is currently selling you. “Connect it to all your systems and let it act autonomously” is a description of the vulnerability.

The honest mitigation today is not a filter. It is architecture: break the trifecta. Deny one of the three legs. Keep the agent that reads untrusted input away from the credentials, or away from the network. Everything else is probabilistic patching of a deterministic hole.

5. The adoption gap

The most-quoted number in enterprise AI comes from MIT Media Lab’s NANDA initiative — The GenAI Divide: State of AI in Business, built on 150 leadership interviews, 350 employee surveys and 300 public deployments. Its finding: roughly 95% of generative AI pilots produced no measurable P&L impact. Somewhere between $30bn and $40bn invested for a 5% hit rate.

The part that gets skipped is the diagnosis. MIT’s conclusion was not that the models were not good enough. It was organisational — a learning gap, poor integration into real workflows, and budgets pointed at sales and marketing while the better returns sat in operations and finance.

The 2026 picture is roughly this: most large organisations are experimenting, a minority have scaled agents into even one function, and a small fraction can show measurable value. The commonly cited blockers are no longer intelligence. They are integration, security and operations — the same three things that have blocked every enterprise software wave since client-server.

Which lines up exactly with sections 2, 3 and 4. The bottleneck is not the brain. It is the wiring, the permissions and the last 30 percentage points of reliability.

6. What I believe but cannot prove

Flagged as opinion, so it can be scored honestly later.

• The 80% horizon becomes the headline number within two years. Once enough money has been lost in the gap, the industry will start quoting the reliability figure that matters.
• Prompt injection gets contained architecturally, not solved. The fix will look like sandboxing and capability boundaries — the same answer we reached for every other unsolvable input-trust problem.
• “Agent” stops being a product category. It becomes a feature, the way “cloud” did. Nobody sells you a cloud any more; they sell you something that happens to run on one.
• The winners are boring. Whoever does permissions, audit logs and rollback well takes the enterprise market from whoever has the cleverest reasoning.

7. Markers — check these on 27 August 2027

Specific enough to be wrong, which is the only kind worth writing down.

• METR’s 50% horizon. On the seven-month doubling it should be roughly 4× today’s figure in a year; on the four-month doubling, closer to 8×. If it is neither, the trend broke, and that is the biggest story in the field.
• The 80% horizon. Does the gap narrow, hold, or widen? I say roughly hold. If it narrows sharply, deployment gets much easier very quickly.
• MCP. Still Linux Foundation governed, still the default, or has a rival standard taken ground? Do the SDK download figures keep climbing?
• Prompt injection. Still unsolved on 27 August 2027. I am fairly confident, and would be delighted to be wrong.
• The 95% figure. Does the successor study move materially, or does enterprise AI stay stuck at a single-digit success rate?
• At least one serious public incident caused by an agent with the full trifecta and production credentials. I think this is close to inevitable, and I hope it lands somewhere survivable.

Where that leaves us today

Capability is climbing on a genuine exponential and the plumbing has been standardised under neutral governance, which is the sort of thing that happens right before something becomes infrastructure. Meanwhile the security model has a hole in it that nobody knows how to close, and nineteen out of twenty corporate pilots return nothing.

Both halves are true at once. Anyone telling you only one of them is selling something.

If you are building with this now — and I am, daily — the practical version is short. Assume 50% reliability and design for the review step. Break the trifecta before you connect anything to production. Put your effort into the harness, not the prompt. And write down the date on your predictions, so that a year from now somebody can tell you how you did.

Snapshot taken 27 August 2026. Figures sourced from METR’s time-horizon research, the Model Context Protocol specification and release notes, MIT Media Lab’s NANDA GenAI Divide study, and Simon Willison’s work on prompt injection. Re-read it in a year and mark it.