Oct 23, 2026 · @Sal Dumitrascu

An AI agent is an AI system that doesn’t just answer questions. It takes actions: it looks up your order, issues a refund, books a meeting or updates a record. Think of it as a very fast new employee who can use your company’s software.

Getting one to work in a demo is easy. Getting one to work reliably, every day, with real customers is much harder.

Here’s why. Researchers at the AI company Sierra tested an agent on realistic customer-service tasks. It got a task right about 6 times out of 10 on the first try. But when asked to do the same task 8 times in a row, it got all 8 right only about 1 time in 4.

Imagine hiring someone who handles a request well most days, but you can never predict which days. That’s the gap. It helps explain why the research firm Gartner predicts that more than 40% of these projects will be cancelled by the end of 2027, mainly over rising costs, unclear value and weak risk controls.

The good news: the problems are predictable, and each one has a fix. Here are six.

Problem 1: It worked once, so we assumed it always works

What goes wrong. The agent is tested a few times, looks great, and gets launched. Then small mistakes start showing up every day.

Why. Most testing asks “can it do the task?” The real question is “does it do the task every time?” Those are very different. If something works 9 times out of 10, the chance it works 10 times in a row is only about 1 in 3. Small slip-ups add up fast.

The fix. Test like a strict inspector, not a proud parent:

• Run each test task many times, and count how often it succeeds every time.
• Check how the agent got the answer, not just the answer. Did it use the right tools in the right order?
• Keep testing after launch. Re-run the tests whenever anything changes, such as a new AI model or new instructions.

Problem 2: Giving it more freedom than the job needs

What goes wrong. A process with five fixed steps is handed to an agent that’s free to improvise. Sometimes it skips a step, repeats one, or invents a new one.

Why. “Agent” has become a buzzword, so it gets used for everything. The AI company Anthropic draws a helpful line between two approaches:

• A workflow is like a recipe. You write the steps; the AI helps with each one.
• An agent is like a chef. It decides the steps itself.

Their advice: use the simplest approach that works. Recipes are predictable. Chefs are flexible, but less predictable.

The fix. Decide step by step how much freedom each part needs. Fixed, regulated steps (approvals, payments) should follow strict rules. Simple judgment calls (sorting an email) need a single, narrow AI task. Only open-ended work (researching a tricky problem) needs a free-roaming agent, and even then with a time limit.

Problem 3: The surprise bill

What goes wrong. The pilot cost a few hundred dollars. Rolled out to everyone, the bill is far bigger than anyone planned for.

Why. AI services charge by the amount of text they read and write. An agent works in loops, re-reading its notes every time it takes a step, so it uses a lot more than a simple chat. Anthropic’s own data shows a single agent uses about 4 times as much as a normal chat, and a team of agents working together uses about 15 times as much. That can be worth it for valuable work, but only if you plan for it.

The fix.

• Measure the cost of each successful job, not each attempt. A cheap agent that fails half the time is the expensive one.
• Set hard limits on how long, and how many steps, any single job can take.
• Use smaller, cheaper AI models for easy tasks and save the most powerful ones for hard problems.
• Watch for an agent stuck in a loop, repeating the same action over and over.

Problem 4: It did something it shouldn’t have

What goes wrong. The agent reads an email or web page that contains hidden instructions, and follows them. Or it does something it’s allowed to do, like issuing a refund, in a situation where it should have asked a human first.

Why. Once an AI can take actions, any text it reads becomes a way to steer it. The security organisation OWASP published a Top 10 list of these risks in December 2025, built with more than 100 experts. It covers dangers such as an agent’s goal being hijacked, tools being misused, stolen permissions and “poisoned” memories.

The fix. Treat an agent like a new employee with access to company systems:

• Give it its own ID badge. Every agent should have its own login, so you can always see which agent did what.
• Only the keys it needs. If it only needs to read customer records, don’t let it change them. Big or irreversible actions should need a human’s approval.
• Rules it can’t talk its way around. An instruction in the AI’s prompt can be overridden by clever wording. A hard rule in the system, such as “refunds over $100 need a manager”, can’t. Amazon’s AgentCore Policy works this way.
• Don’t trust everything it remembers. Google warns that false information saved in an agent’s memory can mislead it later.
• Keep a list. Know every agent you have, who owns it and what it can access.

Problem 5: No one can explain what went wrong

What goes wrong. A customer complains. The system log just says the request “succeeded”. Nobody can tell which step went wrong or why.

Why. An agent rarely crashes outright. It takes a wrong turn halfway through a job, like a driver who misreads one sign and ends up in the wrong town. Normal monitoring only records that the trip happened, not the route. Anthropic found that when users said its research agent was missing obvious information, the team couldn’t see why until it recorded every step.

The fix. Give every agent a “flight recorder” that logs each step: what it was asked, which tools it used, what came back and what it decided. There’s now a shared industry format for these records, from a project called OpenTelemetry, and Amazon, Microsoft and Google all support it.

One caution: these records can contain customer details, so protect them like any other sensitive data.

Problem 6: Stuck with one supplier

What goes wrong. A better or cheaper AI model comes out, or the company switches cloud providers, and the agent has to be rebuilt from scratch.

Why. Early agents were wired directly into one company’s products. It’s like buying appliances that only fit one brand of plug.

The fix. Use the industry’s new “universal plugs”. These are open standards that no single company controls:

• MCP connects an agent to tools and data. Anthropic handed it to the Linux Foundation in December 2025, with backing from Google, Microsoft, Amazon and others.
• A2A lets agents from different companies work together. Google handed it to the Linux Foundation in June 2025.
• OpenTelemetry is the shared format for the “flight recorder” logs from Problem 5.

A simple test: could you move your agent to a different provider in a couple of weeks? If not, find out what’s holding it in place.

What Amazon, Microsoft and Google offer

All three big cloud companies now sell a ready-made “home” for agents that tackles most of these problems: built-in testing, memory, an ID for each agent, safety rules, flight-recorder logs and support for the universal plugs. One naming note: in April 2026 Google renamed its product, so older articles may call it Vertex AI Agent Engine. In practice, most companies pick the one that fits the systems they already use.

Before you go live: a simple checklist

• Does each step have only as much freedom as it needs?
• Have we tested each task many times, and do we know how often it gets it right every time?
• Do we know the cost of each successful job, with limits on runaway jobs?
• Does the agent have its own login, with access to only what it needs?
• Are risky actions blocked or sent to a human by a hard rule?
• Do we treat what it reads and remembers with healthy suspicion?
• Can we replay any job step by step, and are those records protected?
• Could we switch AI model or provider without starting over?

Notice that none of these is “pick a smarter AI”. The AI sets the limit of what an agent can do. The engineering around it decides how often it actually does it.

Which of these has been hardest in your organization? I’d love to hear what went wrong, and what fixed it.

Jargon decoder