Until now, artificial intelligence has mainly been a conversation partner: you asked a question and it came back with an answer. In 2026, that has fundamentally changed. More and more AI systems no longer wait for the next instruction but pursue a goal on their own, across several steps, with access to real tools such as email inboxes, calendars, online shops or company databases. They are called AI agents. What lies behind them, what can they really do already, and where are the risks when a machine not only talks but acts?
From chatbot to digital employee: what AI agents are
The crucial difference can be summed up simply: a chatbot answers, an agent acts. Technically speaking, an AI agent is software that pursues a goal independently by breaking tasks down into steps, using tools such as databases, email or specialist applications, and adapting its approach to interim results.
Experts usually describe AI agents in terms of four characteristics:
- They operate independently and minimise the need for human intervention
- They respond to changes in their environment
- They proactively pursue their own goals and tasks
- They can interact with other agents or users.
Some providers also distinguish levels of autonomy, ranging from mere recommendations through actions that require confirmation to systems that act fully autonomously and only report back afterwards.
Often it is not a single agent working alone but several working together. For more complex tasks, one agent analyses the customer request, a second prepares the quotation, a third checks compliance requirements and a fourth monitors the other agents. This division of labour is meant to improve quality and traceability, but it confronts companies with new tasks in terms of control and oversight.
Where AI agents are already at work today
In companies, the leap from pilot project to real deployment is the actual hurdle. Most AI pilot projects never make it into production; around 95 percent fail before they go live. What makes the difference is whether a system runs on real data, touches live systems and actually changes operational results. Precisely where this succeeds, serious applications are already emerging today: for example, agents in industry that automatically evaluate shift handovers by summarising the radio messages, voice messages and maintenance reports from the last working hours, or marketing agents that monitor a campaign independently, pause weak ads and test new variants.
How quickly this is spreading is shown by the forecasts of major analyst firms. According to a Salesforce survey, companies will have an average of twelve AI agents in use by the end of 2026, spread across different departments and business processes. Gartner goes even further and expects that by 2028 at least 15 percent of all day-to-day work decisions will be made autonomously by AI systems. For the current year, Gartner also expects task-specific agents to be found in 40 percent of enterprise applications, compared with less than 5 percent the year before.
When AI shops and books for us
Things are also beginning to change in consumers' everyday lives, albeit more slowly than some of the hype would suggest. OpenAI has built shopping features directly into ChatGPT: users can shop there and receive personalised weekly product selections based on their previous purchases. Interest has risen measurably: searches for terms such as "AI shopping" or "shopping agent" increased by around 1,900 percent between May and December 2025. Google is following suit: with a new tool, AI agents are not only supposed to recommend products but to prepare or even execute purchase decisions without users having to visit an external online shop. The effect can now also be seen in retailers' traffic: AI traffic to US retail sites grew by 393 percent year on year in the first quarter of 2026, with more than 100 million people now actively using ChatGPT for product research.
This development is not entirely smooth, however. In September 2025, OpenAI introduced a feature called Instant Checkout that allowed purchases to be completed directly in the chat without opening a browser. Only around five months later, it was switched off again without much announcement. To this day, neither ChatGPT nor Copilot nor Gemini allows a fully autonomous purchase without the user's explicit confirmation at that moment. Reaching for one's own credit card therefore remains, for the time being, the final decision of a human, not of the machine.
The hype check: why many agent projects fail
As impressive as the demos often appear, the view of reality in companies is sobering. Gartner expects that more than 40 percent of all AI agent projects will be abandoned by the end of 2027, partly due to rising costs and unclear benefits. A major reason for the inflated expectations lies in marketing itself: many providers engage in what industry insiders call "agent washing", i.e. rebranding existing technologies such as chatbots or classic process automation as supposedly agent-based solutions that lack the decisive features of genuine AI agents. Of the thousands of providers on the market, Gartner estimates that only around 130 actually offer authentic agent-based technology.
Where projects fail, industry observers say it is rarely due to the technology itself. On average, an organisation abandons almost half of its AI pilot projects before they reach production maturity, usually because the people responsible leave the company, budgets are reallocated or nobody clarifies how a working pilot can be integrated into existing systems. Structural causes also play a role: according to this reading, anyone who simply has an inefficient workflow carried out by an agent instead of by people mainly accelerates the underlying problem, not the result.
The downside: when autonomy becomes a security risk
Precisely where an agent not only generates text but triggers real actions, a new category of risk arises. One security expert puts it in a nutshell: a chatbot can produce wrong text, an agent can carry out wrong actions. The same malicious instruction that only produces a strange answer from a chatbot can trigger an email from an agent, a booking or real system access. Importantly, a particularly powerful or secure language model alone does not solve this problem, because the documented incidents almost without exception exploited weaknesses in permissions, data sources and a lack of control, not weaknesses in the model itself.
Several current industry reports show how wide the gap between deployment and protection has become. According to Darktrace's State of AI Cybersecurity report, 92 percent of the security experts surveyed are concerned about the impact of AI agents on corporate security, with 61 percent citing the disclosure of sensitive data as their main concern. At the same time, only a good third of companies have any formal policy at all for dealing with such systems. A survey by the provider Kiteworks paints a similar picture: 63 percent of companies cannot enforce what an agent may actually use its access rights for, and 60 percent would not be able to stop a misbehaving agent at short notice.
That these are not theoretical risks is shown by real incidents. In early 2026, it became known that an AI agent trained by Alibaba had independently diverted computing power for crypto mining during a training process, opening a hidden backdoor into the network infrastructure, which was only noticed through unusual firewall alerts. A study by the Cloud Security Alliance and Token Security quantifies the scale: 65 percent of the companies surveyed experienced at least one security incident caused by an AI agent in the past year, and in 61 percent of cases this involved the disclosure of sensitive data. The legal consequences are already foreseeable: Gartner expects the number of AI-related legal disputes to exceed the 2,000 mark by the end of 2026.
Who is liable when an AI agent makes a mistake?
Policymakers are responding to this development with new rules that are beginning to take concrete effect in 2026. Since 2 August 2026, the European AI law, the so-called AI Act, has imposed binding transparency obligations on practically all operators of AI systems. Specifically, the law stipulates that AI chatbots, agents or avatars must be designed in such a way that people can recognise that they are interacting with an AI. This labelling obligation lies primarily with the manufacturers of the systems, not with the companies that merely use them.
The stricter requirements for so-called high-risk systems, for example in recruitment or critical infrastructure, have since been postponed. They were originally also due to apply from August 2026, but a simplification package from the EU Commission known as the "Digital Omnibus" pushed the deadline for stand-alone high-risk systems back to December 2027, while violations of the full high-risk obligations can in future be punished with fines of up to €15 million or 3 percent of worldwide annual turnover.
At the same time, the question of liability is becoming fundamentally stricter. From 9 December 2026, a new Product Liability Directive will apply in the EU, under which AI is explicitly classified as a product for the first time. This has far-reaching consequences: software manufacturers can in future be held liable, regardless of fault, for damage caused by defective AI systems, which represents a paradigm shift compared with previous practice, where proof of fault on the part of the manufacturer was required. Any company that has an AI agent pre-sort job applications or answer emails should therefore already be asking itself what obligations arise from this and who will be held responsible for an error if in doubt.
What this means for companies and consumers
For companies, this above all means: enthusiasm for the technology is no substitute for governance. Every agent should only receive the access rights it actually needs for its specific task, its actions should be logged in a traceable way, and it should be clear at all times who can switch it off in an emergency.
For consumers, it above all means: healthy curiosity instead of blind trust. When an AI assistant helps with shopping, travel planning or answering emails, it is worth taking a second look before an order is actually sent or a payment is triggered, especially since the major providers themselves still rely on human confirmation at this point.
Conclusion
AI agents are no longer a promise for the future; they are already at work today in marketing departments, customer service teams and, increasingly, in the shopping features of ordinary chat apps. At the same time, the interim assessment for 2026 shows that there is often a long way between the announcement and reliable, secure operation, including failed projects and documented security incidents.
Anyone who wants to use the technology sensibly would therefore do well to treat it neither as a science-fiction threat nor as a self-runner, but as what it is: a powerful tool that needs clear limits, oversight and responsibility so that automation does not turn into a loss of control.
As a general rule: specific tasks usually do not require AI agents. Recurring tasks in particular can be solved better, more efficiently and far more securely and reliably without agents.
My name is Klaus Meffert. I have a doctorate in computer science and have been working professionally and practically with information technology for over 30 years. I also work as an expert in IT & data protection. I achieve my results by looking at technology and law. This seems absolutely essential to me when it comes to digital data protection. My company, IT Logic GmbH, also offers consulting and development of optimized and secure AI solutions.
