In January 2025, OpenAI pushed out a research preview called Operator. It opened a browser, hunted down a restaurant, and filled in a booking form while you watched the cursor drift across the screen. A few weeks later, Deep Research appeared and spent anywhere from five to thirty minutes reading sources before writing a report. Neither needed a brand-new model family to be useful. Both changed what people expect a chatbot to do with its afternoon.
So what does any of this have to do with AGI? More than the demos suggest, and less than the launch posts implied. OpenAI’s own AGI definition describes “a highly autonomous system that outperforms humans at most economically valuable work” — and autonomy is exactly the ingredient agents add. That makes them the most direct public test of the mission statement the company has ever shipped.
The agent loop is basically the whole product
Strip out the branding and every one of these tools has the same skeleton. A model sits in a loop with a goal written in plain language, a set of tools (search, a browser, a code sandbox, a connector to your calendar), and a condition that tells it when to stop. The model picks an action, sees what happened, and picks again.
The 2025 releases were mostly packaging around that loop:
- Responses API and Agents SDK (March): developer plumbing for running the loop with tool calls, tracing and guardrails built in. OpenAI also adopted the Model Context Protocol that month, which let agents reach outside systems without custom glue code.
- ChatGPT Agent (July): the consumer version, running on a virtual computer with a confirmation step before anything irreversible happens.
- Deep Research: the narrow, high-value case, where the agent’s job is to read for twenty minutes and show its sources.
- Codex and AgentKit: software work on one side, plug-and-play agent building blocks for enterprises on the other.
None of that is AGI. An agent that stalls on a CAPTCHA is not outperforming humans at most economically valuable work. What these products do is expose the failure modes that stand between here and there: reliability over long horizons, recovery from mistakes, and the cost of running a model in a loop for hours.
Long horizons are where the wheels come off
Single-step benchmarks are close to saturated. The number that matters now is how long a task can run before an agent’s success rate decays to a coin flip. METR’s evaluations put that threshold at roughly fifty minutes of human-equivalent work in early 2025, with the figure doubling about every seven months. If that pace holds, eight-hour tasks land somewhere in the late 2020s. It might not hold. Curves like this have bent before, and benchmark contamination is a real problem.
Errors don’t stay small
Run the arithmetic. An agent that nails 95% of individual steps still fails a twenty-step task about a third of the time, because 0.95 to the power of twenty is 0.36. Stretch it to forty steps and the same agent fails roughly 87% of the time. Human workers also get things wrong step by step, and they still finish the job because they notice when something has gone sideways and back up. Teaching an agent to notice is a different research problem from making it smarter, and it’s the one that decides whether agents become colleagues or party tricks.
Where agents sit on the ladder to AGI
OpenAI sorts progress internally into five levels: chatbots, reasoners, agents, innovators, organisations. Agents are rung three, defined as systems that can take actions for days at a time. Reasoning models got the company to rung two. Rung three is the one under construction, and it’s a far bigger jump than the naming implies, because it needs memory, permission handling and error recovery rather than another bump in raw capability. It also needs a lot of compute, which is why the trillion-dollar infrastructure story and the agent story are the same story told from different ends.
A demo is not a coworker
The part nobody puts on a slide is the gap between ChatGPT and AGI: hallucinated arguments in tool calls, ambiguous instructions that a human would have queried, two-factor prompts and session timeouts, and the general brittleness of the open web. Agents handle the clean 80% of tasks well. The messy 20% is where most of the economic value lives, and it’s where they currently fall over.
Every tool call is an attack surface
Give a model a browser and a logged-in session and you have handed it a way to be manipulated by any page it reads. Prompt injection is the obvious route: a hotel review containing instructions, a calendar invite with sharp fine print, a support ticket written to hijack whatever summarises it. OpenAI’s mitigations are layered. Supervised training to refuse high-risk actions, a monitor model watching the agent’s reasoning, explicit confirmation before consequential steps, and a sandbox that keeps your passwords out of reach. Those are mitigations, not solutions. The question of who actually decides it’s safe to ship an agent with more autonomy and fewer checkpoints is the live argument inside every lab right now.
Autonomy has a price tag
An agent that thinks for twenty minutes and fires off forty tool calls is expensive in a way a single chat reply isn’t. One deep-research run can burn more inference than a month of casual conversation, which is why pricing per task, per seat and per credit are all being trialled at once. Cost per finished job, not cost per token, becomes the metric that decides whether a product survives. Compute is the binding constraint on the whole category, and the five-rung path to AGI reads as much like a capital-spending forecast as a research plan.
What to watch over the next twelve months
Ignore the launch videos. Track these instead:
- Task horizon at 50% success. Not model size, not benchmark scores. How long a task an agent completes unattended before it becomes a coin flip.
- Post-failure behaviour. What the agent does in the thirty seconds after something breaks tells you more than what it does in the first thirty.
- Permission design. Scoped credentials, time-limited access, read-only defaults. The products that get this right will be the ones allowed near real money.
- Pricing per completed task. A vendor willing to charge on outcomes is a vendor confident about its success rate.
- Compliance appetite. Whether risk teams let an agent touch a CRM, a support queue or a payment system, and what they demand in exchange.
The word AGI is now a contract term
This is the part that separates OpenAI’s agent rollout from a normal product cycle. AGI is defined in the company’s charter, a board committee is meant to certify it, and a Microsoft revenue-sharing clause is tied to the moment it gets declared. That clause has been reported as worth around $135 billion. An agent benchmark isn’t only a research result anymore. It’s a trigger event with lawyers attached, which is why the governance structure around AGI is worth reading before you read another capability announcement.
Which brings the argument back to something unglamorous. The question that matters isn’t how many tasks an agent can attempt. It’s how many it finishes, unattended, over a working day, without doing something you’d have to apologise for on Monday morning. That number is small today. Every rung on the ladder depends on it getting bigger.