AI agents are LLM-driven systems that plan, call external tools and act autonomously over long horizons, and by mid-2026 the field’s centre of gravity has shifted from demonstrating capability to measuring it on realistic end-to-end tasks and containing the security failures that autonomy creates.
Summary
An AI agent is a large language model wrapped in a loop: it receives a goal in natural language, decides on actions, invokes external tools (browsers, simulators, laboratory instruments, payment APIs, shells), observes results, and iterates until it believes the goal is met. The distinguishing features versus a chatbot are tool use, persistent memory across turns or runs, and the authority to take actions with real-world side effects. Standardisation has arrived at the tool interface: the Model Context Protocol (MCP) is an open standard letting models connect to external tools, databases and services, and is increasingly adopted by agent builders. A parallel payments layer, x402, extends HTTP 402 with a negotiation flow so autonomous agents can pay for API calls, with settlement delegated to third-party facilitators.
The parameters that decide whether an agent is useful are not model quality alone. They are: whether the task can be verified (does a simulator, compiler or statistical ground truth exist to check the answer); whether knowledge persists between runs; whether the agent can be given exactly the authority it needs and no more; and cost per unit of progress. FluxBench introduces Token ROI, a cost-efficiency metric measuring effective improvement per token spent, precisely because raw success rate hides how expensive agentic iteration is. Memory is emerging as the other decisive parameter: the prevailing paradigm treats each execution in isolation and discards insight between runs, and closing that gap produced large measured gains in computational materials science.
That security literature is unusually consistent. Agentic browsers act as an automated channel for cross-origin data flows and frequently violate the same-origin policy, in benign settings as well as under attack. Most MCP servers cannot distinguish who is invoking a request and rely on persistent authorisation, so one approval implicitly grants access to multiple untrusted callers. Self-hosted agents can be compromised through corruption of their own memory and configuration files using entirely legitimate system calls. Long-term multimodal memory can be poisoned by imperceptible image perturbations without any access to the model or the text channel. Whether agents scale is now as much a question about authorisation, identity and memory integrity as about reasoning.
Evidence base
- Agents with persistent, provenance-tracked knowledge and reflection sessions cut reasoning overhead by 67% and moved accuracy from 47% to 3% deviation from literature on a six-step quantum simulation workflow, reaching 1% deviation on an unfamiliar material with zero pipeline failures (2026-07-03).
- Existing agentic browsers frequently violate the same-origin policy both in benign settings and under attack; SOPGuard, implemented in BrowserOS, enforces it with small runtime overhead (2026-06-15).
- Most MCP servers rely on persistent authorisation states that allow tool invocation without re-authentication regardless of caller, and many fail to enforce per-tool authentication (2026-07-22).
- x402 sees rapid adoption by major vendors and economically meaningful mainnet activity, yet analysis of real facilitator deployments yielded four attack vectors including free shopping, asset theft, service denial and gas abuse (2026-07-23).
- CyberGym-E2E covers 920 real-world vulnerabilities across 139 open-source projects for the full discovery, PoC and patch lifecycle, and GeneBench-Pro spans 129 multi-stage evaluations across 10 domains, indicating benchmark effort has moved to realistic end-to-end tasks (2026-06-30 to 2026-07-21).
- A survey of 21 agent permission proposals found the field concentrated on uniform product-level policies, with user-level specification, derivation and enforcement still unresolved (2026-07-21).
Open questions
- What absolute success rates do frontier agents achieve on the L3 agent-only setting of ArchEval and on the full RTL-to-GDS flow in FluxBench, where no simulator feedback or tool harness carries them?
- Does the memory-driven gain reported by QMatSuite (67% less reasoning overhead, 3% deviation from literature) transfer outside computational physics to domains without a deterministic ground truth?
- Can SOP enforcement, per-tool MCP authentication and kill-chain sequence detection be composed into a default agent runtime without eroding the utility that makes agents worth deploying?
- In CyberGym-E2E’s full lifecycle, do agents generate more patched vulnerabilities than exploitable ones, and does that ratio move with model capability or against it?
Assessment drafted 2026-08-31 from up to 18 KB sources using the technology-scorecard framework; scores are a draft read pending review.