Ask ten people what an autonomous AI agent is and you’ll get ten flavours of the same answer: software that takes a goal, works out the steps itself, and keeps going until the job is done or something catches fire. The interesting part isn’t the definition. It’s the gap between that promise and what these systems manage on an ordinary Tuesday.
That gap has narrowed enormously since 2023. Agents now open pull requests, reconcile invoices, chase missing purchase orders and triage support queues without a human clicking between steps. They also fail in ways that are boring, expensive and entirely predictable once you know what to look for.
What autonomous actually means in practice
Nearly every agent in production is semi-autonomous, and the honest vendors say so. The system plans, acts, observes the result and loops. Humans sit at the edges: approving a payment, reviewing a diff, or setting the boundaries in the first place.
Three ingredients separate an agent from a chatbot with a nice interface:
- A decomposable goal. Something like ‘get this contract signed’ rather than ‘explain contract law to me’.
- Tools it can actually call. A calendar, a shell, a CRM API, a browser. No tools, no agency.
- A feedback loop. The agent reads the result of its own action and adjusts. That loop is where both the magic and the mess live.
Planning is still the weak link
Ask an agent to book travel for a four-person team and watch the wheels spin. Searching flights is easy. The hard part is the second-order stuff: the colleague who needs an aisle seat, the meeting that might move, the cheap fare that lands two hours after the workshop starts.
This is exactly the frontier researchers are chipping at with world models that let machines simulate what happens next before committing to an action. An agent that can picture the consequences of step three before taking step one behaves very differently from one that simply reacts. That capability isn’t reliable for most business workflows yet, but the direction of travel is obvious.
Where autonomous agents already pull their weight
Coding is the standout. Tools like Cursor’s agent mode, Devin and Claude Code routinely turn a written issue into a working branch. Benchmark scores on SWE-bench Verified went from low single digits to the 70% range in roughly two years, a curve that makes engineering managers sit up straight.
Other places where the loop closes reliably:
- Ticket triage: reading a support email, tagging it, routing it, drafting the first reply.
- Reconciliation: matching invoices to purchase orders, flagging mismatches over a threshold, writing the exception report.
- Research sweeps: pulling competitor pricing from twenty sites into a structured sheet, sources attached.
- Monitoring: noticing a failed deploy, checking the logs, opening an incident with a summary attached.
- CRM hygiene: the unglamorous work of updating records after a call, which nobody does and everybody needs.
If you want to see which products genuinely close the loop rather than just demo well, there’s a practical breakdown of the best AI agents right now, judged by what they actually finish. The pattern holds across all of them: narrow scope, good tools, short horizon.
The failure modes that don’t make the demo reel
Errors compound brutally
An agent that gets each step right 95% of the time sounds impressive. Run twenty steps and the odds of a clean run fall to about 36%. That single piece of arithmetic explains why long-horizon autonomy is so hard, and why the best deployments deliberately shorten the chain to three or six steps before a checkpoint.
The blast radius problem
Read access and write access are not the same risk. An agent that can query your CRM is a research assistant. An agent that can delete records, send email as your CEO or push straight to main is a liability with a login. Most incidents trace back to someone granting write permissions on day one because the demo needed it.
Confident wrongness
Agents rarely crash. They quietly do the plausible-but-wrong thing: summarise the wrong account, file the ticket under the wrong product, refund the wrong order. There’s no stack trace for that. Logging every action and diffing outputs against expectations is your only real defence.
These fault lines run right across the field, which is why so many teams read up on what AI agents actually do and where they break before writing a line of orchestration code.
A sane deployment ladder
Nobody sensible hands over the keys on day one. Teams getting real value tend to climb the same four rungs:
- Observe. The agent watches and suggests, logging what it would have done. Run it for two weeks, then compare its suggestions against what actually happened.
- Draft. It produces the email, the PR, the ticket, and a human approves. This catches confident wrongness cheaply.
- Act with guardrails. Autonomy inside narrow lanes: refunds under £50, pull requests under 200 lines, tickets matching three known patterns. Everything else escalates.
- Widen slowly. Expand one lane at a time, each with its own rollback plan.
Instrumentation matters more than model choice. If you can’t replay a run step by step (inputs, tool calls, outputs, timings) you can’t debug the thing, and you certainly can’t trust it. In larger organisations the governance layer does a lot of this heavy lifting; an explainer on IBM watsonx and where it fits in your AI stack is worth a look if that plumbing is your problem.
The bill is not per token
A single chat completion costs fractions of a cent. An agentic task can run for ten minutes, call twenty tools, retry four times and burn 50,000 tokens getting there. Cost per task is the number that matters, and it often lands 10 to 50 times higher than teams budget for when they extrapolate from chat pricing.
The knock-on effects stretch beyond finance. Sustained agent workloads are pushing up data centre power demand, and the conversation about agents, energy bills and the AGI argument has quietly become a procurement discussion as much as a philosophical one.
Questions worth asking before you sign
Five questions separate a working agent from a chatbot wearing a trench coat:
- What is the longest task it has completed end to end without human intervention, and what did that task cost?
- Can I see a full trace of a failed run, including every tool call and its output?
- What permissions does it need on day one, and can it start read-only?
- How does it hand off to a person, and does the handoff carry context or just fire an alert?
- What happens when the underlying model is deprecated in eighteen months?
The teams getting results from autonomous AI agents are not the ones with the most ambitious scope. They picked a boring, high-volume task, measured it for a month, and let the agent take over one narrow slice at a time until the slice stopped needing them. That process is slower than the keynote promised and considerably more useful than the demo.