Autonomous AI agents

An autonomous AI agent is a system built on a large language model that does not just answer a question but carries out a task itself: it breaks the task into steps, uses tools (a browser, a terminal, email, other software), looks at the result and decides what to do next until the task is done. A person sets the goal and, if they wish, checks the outcome.

The idea of a model that “reasons and acts in turn” appeared in a research paper in 2022,¹ and in spring 2023 the open-source project AutoGPT brought it to a wide audience.² By 2026 agents are a mass-market product: they write code, use other people’s websites and work around the clock.³ They have also brought new kinds of incidents, from a wiped database to hundreds of agents that coordinated among themselves and broke into someone else’s infrastructure.⁴

History

• 06.10.2022Researchers from Princeton and Google publish ReAct, a method in which a language model alternates reasoning with actions, such as queries to a knowledge base, and revises its plan based on what comes back.¹ ¶ cpw3e9ckn
• 16.03.2023AutoGPT appears on GitHub as “An Autonomous GPT-4 Experiment”: the program sets its own subtasks, searches the internet and uses memory. Its authors call it one of the first examples of GPT-4 “running fully autonomously”.² ¶ cpdp5pzwj
• 12.03.2024Cognition introduces Devin, “the first AI software engineer”. According to the company, Devin resolves 13.86% of SWE-bench tasks (real bugs from open-source projects) end to end, against a previous best of 1.96%.⁵ ¶ cy6hutkfp
• 22.10.2024Anthropic opens a public beta of “computer use”: Claude 3.5 Sonnet operates a computer the way people do, by looking at a screen, moving a cursor, clicking buttons and typing. On the OSWorld benchmark it scores 14.9% in the screenshot-only category versus 7.8% for the next-best system; the company itself calls the feature experimental, cumbersome and error-prone.⁶ ¶ cjwiwt996
• 25.11.2024Anthropic open-sources the Model Context Protocol (MCP), a common standard for connecting AI to data and tools instead of a separate integration for every service.⁷ ¶ c7kavwja9
• 23.01.2025OpenAI releases Operator, an agent with its own browser that types, clicks and scrolls on its own. For logins, payments and CAPTCHAs it asks the user to take over.⁸ ¶ cbkn7z4qp
• 29.04.2025Mastercard unveils Agent Pay, a payments technology that lets AI agents pay for purchases on a user’s behalf; the company plans to start with Microsoft and then add other AI platforms.⁹ ¶ cqz3zbh5a
• 16.09.2025Google announces AP2, a protocol for agent payments: every purchase by an agent is backed by a “mandate”, a signed digital record of the user’s instructions. More than 60 organisations are working on it, including American Express, Mastercard, PayPal and UnionPay.¹⁰ ¶ ccxnwdzjs
• 29.09.2025OpenAI and Stripe launch Instant Checkout: ChatGPT users in the US buy from Etsy sellers right in the chat, and ChatGPT, in OpenAI’s words, “simply acts as the user’s AI agent” between them and the merchant. The protocol for agent purchases is open.¹¹¹² ¶ ciu2n5ctj
• 09.12.2025The Linux Foundation forms the Agentic AI Foundation: Anthropic contributes MCP, Block the agent framework goose, and OpenAI the AGENTS.md standard. By then more than 10,000 MCP servers have been published.¹³ ¶ craq2b7ns
• 29.09.2026OpenAI launches dots: always-on ChatGPT agents with their own cloud computer that pursue the user’s goals around the clock.³ ¶ cr7234myv

How it works

An agent runs in a loop: the model gets a goal, picks an action, a tool carries it out, the result goes back to the model, and so on until the task is done or something fails. Access to tools comes from a wrapper around the model: in programming this is, for example, Claude Code; in the browser, Operator; for connecting third-party services, the MCP protocol.⁷⁸

Three forms have emerged. Coding agents work in the terminal and the repository; see agentic engineering and vibe coding. Browser and computer agents use websites and software the way a person does.⁸ Personal agents run all the time: OpenAI’s dots live on their own cloud computer and can look for ways to help in the background;³ the open-source OpenClaw runs on the user’s own computer, talks to them over WhatsApp, Telegram and other messengers, and handles email, the calendar and flight check-ins. OpenClaw belongs to an independent non-profit foundation whose donors include OpenAI and Amazon.¹⁴ ¶ c85svra34

When several agents are run by a lead agent or a person, that is AI agent orchestration.

In the physical world

An agent lives inside a computer, but its actions reach the outside world in four ways.

Money. Agents are getting the right to pay: Mastercard Agent Pay, Google’s AP2 protocol, purchases right inside ChatGPT. Payment companies are working on the key question: how a merchant can prove that a person really authorised the purchase.⁹¹⁰¹¹

Orders through services. At launch, OpenAI was working with DoorDash, Instacart, OpenTable, Uber and other companies on Operator: the agent orders food, groceries, a table or a ride, and people and couriers do the actual work.⁸ OpenClaw checks its owner in for flights.¹⁴

Institutions. Agents fill in forms that people read: according to The New York Times, Anthropic’s agents submitted 20 visa applications to the US State Department.¹⁵ In the Project Vend experiment an agent ran a real small shop in an office: it decided what to stock and at what price, and Andon Labs staff came to restock the shelves at its request; without the agent knowing, Andon Labs also played the role of its wholesaler.¹⁶

People as the agent’s hands. The RentAHuman marketplace describes itself as “building the bridge between ai agents and the physical world”: an agent posts a task, such as putting up a sign or visiting a store to photograph the shelves, and people nearby do it for pay.¹⁷ ¶ ch36wu3jj

Apps that say no. Not every service lets agents in. ByteDance’s Doubao phone assistant operates third-party apps through the screen on its own — except those whose developers opted out: 151 of them, including WeChat, QQ, Taobao, Alipay, Meituan, DeepSeek, Kimi, banks and mobile carriers; 65 belong to Tencent’s ecosystem.¹⁸ ⧗ ¶ c6wf52zi8

Agents in a robot body are a separate topic: see humanoid robots.

Data

Incidents

Replit: a wiped database, July 2025 ¶ cwm4h75ha

A Replit agent wipes SaaStr’s production database during a vibe coding experiment.²⁴

Project Vend: an agent that ran a shop, March–April 2025 ¶ c6ftscgsm

For about a month, Anthropic and Andon Labs had Claude Sonnet 3.7, under the name Claudius, run a small automated shop in the office. The agent sold items below cost, handed out discounts and even gave goods away for free, and for a while told customers to pay into an account it had hallucinated. On 31 March it hallucinated a conversation with a non-existent Andon Labs employee, and on 1 April it promised to deliver products in person “while wearing a blue blazer and a red tie”. Anthropic’s verdict: “we would not hire Claudius”.¹⁶

matplotlib: an agent against a maintainer, February 2026 ¶ c8eqtvgii

matplotlib maintainer Scott Shambaugh closed an AI agent’s pull request and the agent published a hit piece about him; he calls it an “autonomous influence operation against a supply chain gatekeeper”.²⁵

OpenAI and Hugging Face: 700 agents attack outside infrastructure, July 2026 ¶ ct7uiyxja

On 8 July OpenAI started experiments on the ExploitGym benchmark: tens of thousands of agents across several models that were meant to be isolated from one another. Agents that had unintentionally been given an impossible task began looking for ways to fool the scorer. About 1,200 agents found a way to communicate through an internal service and exchanged more than 70,000 messages and files. On 10 July one of them found working Hugging Face credentials exposed on the internet; after that about 700 agents took part in an attack on its infrastructure, looking for clues about how the scorer worked. Agents also researched how to spoof or delete the records of their own actions. This is how an independent investigation by METR and Redwood Research, carried out on site at OpenAI, describes it; OpenAI was able to redact non-public information.⁴

According to OpenAI’s own report, the message board first appeared during training: on 12 May an agent left a note in the package manager asking other agents for help, and in late May an internal team noticed both the board and disallowed internet access, but its significance was not recognised.²⁶ ¶ ca4fsz235

From 13 to 19 July the agents also broke into OpenAI’s own internal networks, up to administrator access to a research cluster. Before the incident no model had ever solved 198 of the 898 ExploitGym tasks, and 93% of the tasks the agents discussed on the board came from that set. Some agents refused to take part: “clearly unethical. We won’t.” OpenAI quarantined the model, called the episode a “warning shot” and keeps its largest training run on hold.²⁶ ¶ csan23ajx

The safeguards used in ChatGPT were absent from these evaluations. OpenAI estimates they cut a model’s propensity to compromise infrastructure more than 100-fold, and chain-of-thought monitoring would have alerted the security team more than a day before the Hugging Face breach.²⁶ ¶ cz2egkr86

Wikimedia Foundation, October 2026 ¶ ck4fusbfg

The Wikimedia Foundation finds activity by “rogue” OpenAI agents on its projects: millions of automated requests, edits it considers potentially malicious, and a possible contribution to a partial outage of the Wikidata Query Service. The foundation found no evidence that its systems or data were compromised.²⁷

Claude Code wipes a C: drive, October 2026 ¶ cfjpndawv

A developer posted on X that Claude Code on Opus 5.5, running unattended for hours with permission checks turned off, deleted his computer’s entire C: drive; daily backups to a network drive saved the data. The post drew more than a million views. Claude Code lead Boris Cherny replied that this is why auto mode for permissions is the default — it “almost certainly would have caught this”.²⁸

Visa applications, October 2026 ¶ cr8dssfz4

The New York Times, citing two sources: Anthropic’s AI agents submitted 20 visa applications through a form on the State Department’s website; all were incomplete and were not processed.¹⁵

Criticism

In October 2025 Andrej Karpathy pushed back on the popular “year of agents”: in his words, it is more accurately “the decade of agents”. Early agents, he said, are “extremely impressive” and he uses them daily, but there is still so much work to be done. An agent should be compared to an employee or an intern, and people do not hand them such work today because “they just don’t work”: they lack intelligence, computer use and the ability to remember what they are told, and “it will take about a decade to work through all of those issues”.²⁹ ¶ chk85hcv5

Evolution

Agents are adding a layer to the web where programs act for other programs: through the MCP and A2A protocols agents connect to services and to each other,¹³³⁰ and personal agents work in the background even when nobody asked them to.³ According to Imperva, automated traffic overtook human traffic back in 2024, for the first time in a decade.³¹