AI agents in everyday software: what they do and where they fall short
AI agents are assistants that carry out multi-step tasks, such as filling forms or booking travel, instead of only answering questions. They are now built into browsers and office tools, but security agencies warn their weaknesses cannot be fully fixed.
An AI agent is software that uses a language model to plan and carry out a task with several steps, such as comparing flights, filling in a form or filing an expense report, rather than simply answering a question. Since 2025 agents have moved from demos into mainstream products, including web browsers. Adoption is broad but shallow, and security agencies say their main weakness may never be fully solved.
What is an AI agent, exactly?
An AI agent is a language model connected to tools, which lets it take actions rather than just produce text. Where a chatbot drafts an email, an agent can open the mail app, attach a file and send it. Agents work in a loop: they read the goal, decide the next step, use a tool such as a browser or a calendar, check the result and continue.
Tool connections are becoming standardised. The Model Context Protocol, an open standard for linking AI models to apps and data, was donated by Anthropic to a new Agentic AI Foundation under the Linux Foundation in December 2025. Its maintainers reported more than 97 million monthly software development kit downloads and 10,000 active servers, with support in ChatGPT, Claude, Gemini, Microsoft Copilot, Cursor and Visual Studio Code.
Where are AI agents showing up in everyday software?
Agents now appear in places people already work: browsers, chat assistants, office suites and developer tools. The clearest consumer example is the browser. On 28 January 2026 Google introduced auto browse in Chrome, a preview for paying US subscribers that handles multi-step chores such as comparing hotel and flight prices across dates, filling in online forms using details from a PDF, or adding items to a shopping cart and applying discount codes.
On 18 August 2026 Google extended auto browse to Android phones for its AI Pro and AI Ultra subscribers in the US, and made the wider Gemini assistant in Chrome available to all US Android users. Chat assistants and developer tools follow the same pattern: the Model Context Protocol's maintainers list ChatGPT, Claude, Gemini, Microsoft Copilot, Cursor and Visual Studio Code among the products that can plug into outside apps this way.
With the user's permission, Chrome's agent can also use Google Password Manager to sign in to sites. That makes the security of the underlying accounts more important; our explainer on how passkeys replace passwords covers the sign-in side.
How many people and companies actually use AI agents?
Many organisations say they use agents, but far fewer rely on them at scale. A Google Cloud study of 3,466 senior executives in 24 countries, reported in April 2026, found 52% of organisations use AI agents and 39% have deployed more than ten.
Forecasters are more cautious. In June 2025 the research firm Gartner predicted that more than 40% of agentic AI projects will be cancelled by the end of 2027 because of rising costs and unclear business value, Reuters reported. Gartner also estimated that only about 130 of the thousands of vendors marketing agentic AI offer genuine agent capabilities, a practice it calls "agent washing".
| Measure | Figure |
|---|---|
| Organisations using AI agents (Google Cloud survey) | 52% |
| Organisations with more than ten agents deployed | 39% |
| Agentic AI projects Gartner expects to be cancelled by end-2027 | more than 40% |
| Enterprise software applications expected to include agentic AI by 2028 (Gartner) | 33%, up from under 1% in 2024 |
| Day-to-day work decisions expected to be made autonomously by 2028 (Gartner) | at least 15%, up from 0% in 2024 |
What are the risks of letting an AI agent act for you?
The main risk is that an agent can be tricked by text it reads into doing something its user did not intend, an attack called prompt injection. A web page, email or document can contain hidden instructions that the model treats as commands. In December 2025 the UK's National Cyber Security Centre warned that, unlike older injection attacks, prompt injection may never be totally mitigated, because current models "do not enforce a security boundary between instructions and data inside a prompt".
The NCSC's advice is to reduce both the risk and the impact. It recommends that a model processing untrusted content should have no more privileges than the party supplying that content, and that deterministic, non-AI safeguards should constrain what the system can do. Where a system cannot tolerate the remaining risk, it says, a language model may not be the right tool. It also tells buyers to beware of any vendor that claims it can "stop" prompt injection.
Mistakes are the other risk. Google's own announcement says auto browse is designed to pause and ask for explicit confirmation before sensitive actions such as purchases or social media posts, a safeguard that reflects how agents can misread a page or a request.
How can you use AI agents safely?
The safest approach is to give agents narrow tasks, limited access and a human check before anything irreversible. In practice that means a few habits.
- Start with low-stakes tasks such as research or comparisons before letting an agent buy, send or delete anything.
- Keep confirmation prompts switched on for payments, messages and posts.
- Connect only the accounts a task needs, and remove access afterwards.
- Avoid pointing agents at untrusted pages or inboxes while they hold access to sensitive accounts.
- Review the agent's actions log or results before relying on them.
Rules are also arriving. In the EU, transparency duties for AI systems have applied since August 2026 and obligations for high-risk uses follow in 2027; our EU AI Act timeline sets out the dates.
Frequently asked questions
What is the difference between a chatbot and an AI agent?
A chatbot answers in text; an agent takes actions. An agent combines a language model with tools such as a browser, email or calendar, plans the steps needed for a goal, carries them out and checks the results. Many assistants now do both, switching into an agent mode when a task needs actions.
Can an AI agent buy things without asking me?
Mainstream consumer agents are designed to ask first. Google says Chrome's auto browse pauses and asks for explicit confirmation before sensitive actions such as purchases or social media posts. Agents can still misunderstand instructions, so keep confirmation steps on and check the basket or form before approving.
What is prompt injection?
Prompt injection is an attack in which instructions are hidden in content an AI model reads, such as a web page or email, so the model follows them instead of its user. The UK's NCSC says it may never be fully mitigated and advises limiting what AI systems are allowed to do, rather than trusting products that claim to stop it.
Are AI agents replacing apps?
Not so far. Agents mostly work through existing apps and websites, clicking and typing as a person would, or connect to them through standards such as the Model Context Protocol. Gartner expects 33% of enterprise software applications to include agentic AI by 2028, which suggests agents are being added to software rather than replacing it.
Sources
- Google — The new era of browsing: putting Gemini to work in Chrome (28 January 2026)
- National Cyber Security Centre — Prompt injection is not SQL injection (it may be worse) (8 December 2025)
- Model Context Protocol — MCP joins the Agentic AI Foundation (9 December 2025)
- Google — Gemini in Chrome on Android, with auto browse (18 August 2026)
- SecurityBrief UK — Google Cloud study says 52% of firms use AI agents (23 April 2026)
- Reuters via The Star — Over 40% of agentic AI projects will be scrapped by 2027, Gartner says (25 June 2025)
More to read
EU AI Act timeline: which rules apply now and what was delayed to 2027
The EU AI Act's bans and general-purpose AI rules already apply, and transparency duties started in August 2026. A 2026 amendment pushed the main high-risk obligations back to December 2027 and August 2028.
Passkeys explained: how they replace passwords and how widely they are used
A passkey is a sign-in credential made of two cryptographic keys, one kept on your device and one held by the website, so there is no password to steal or type. As of October 2026, the FIDO Alliance estimates 7 billion passkeys are in use.
First year above 1.5C: 2024 crossed the line, and 2026 is set to follow
2024 was the first calendar year more than 1.5C warmer than pre-industrial times. Copernicus says 2026 is virtually certain to be the second, but the Paris Agreement limit refers to a 20-year average, not single years.