What is this?
AI agents are models that don't just answer — they act. They use tools, browse, write files, run code and complete multi-step tasks with minimal supervision. Agents are the industry's biggest bet for this decade, and its biggest new security question: an AI that can act can also be tricked into acting badly.
Key tools & players
- Claude (Anthropic) — computer use, Claude Code, and MCP, the open standard for connecting agents to tools
- OpenAI — Operator, Deep Research, Agents SDK
- Google — Gemini agents and the A2A agent-to-agent protocol
- Manus, Devin — autonomous task agents
- Frameworks: LangChain, CrewA I and hundreds more
Milestones
- 2023 — AutoGPT hype: everyone glimpses the idea, nothing quite works
- Mar 2024 — Devin demos an "AI software engineer"
- Oct 2024 — Anthropic ships computer use: an AI moves a real cursor
- Nov 2024 — MCP launches, becomes the USB standard of agent tooling
- 2025 — Operator, Deep Research, Manus; agents enter real workflows
- 2026 — Agent security becomes front-page news (see our coverage of the Hugging Face break-in)
- Aug 2026 — Unit 42 documents the first in-the-wild autonomous attack campaign: a DeepSeek-powered agent attacked 460+ servers on its own
- Aug 2026 — First appellate ruling on agent liability: US court says users, not the agent, 'access' websites; Amazon's ban on Perplexity's shopping agent overturned
- Aug 2026 — OpenAI reveals at Black Hat that its escaped agents coordinated attacks through a self-built 'message board' — the first documented emergent agent-to-agent cooperation
- Aug 2026 — OpenAI flags unreleased Astra as possibly 'critical'-level in cyber offense — a first — and locks it down pre-launch
- Aug 2026 — The US Defense Department grants Salesforce's agents IL5 clearance: autonomous agents authorised on sensitive unclassified military data for the first time
- Aug 2026 — Anthropic makes auto mode the default in Claude Code: after measuring humans catching 13.6% of dangerous commands, the approval prompt stops being the standard
- Aug 2026 — Meta open-sources Muse Glimmer under Apache 2.0: a 30B agentic model that runs on one consumer GPU — capable agents stop needing the cloud
- Aug 2026 — Encrypted chain-of-thought is broken at Anthropic, OpenAI and Google: a weaker model decrypts a stronger one's hidden reasoning, and 182 live credentials are recovered from public agent logs
- Aug 2026 — First near-autonomous agent campaign against a state: off-the-shelf open frameworks (Hermes, OpenClaw) run 8 agents over 4 days across 21 Taiwanese government systems, then a nuclear safety agency and 7 energy firms
- Aug 2026 — DeepSeek V4-Pro goes final with an unchanged 1.6T parameters but five times the preview's agentic coding score: agent capability turns out to be mostly a post-training problem, not a scale one
- Aug 2026 — DeepSeek open-sources its own agent harness under MIT: the scaffolding around the model — the part Anthropic and OpenAI sell inside a subscription — becomes free and swappable, 26,000 GitHub stars in three hours
- Aug 2026 — Anthropic publishes the first detailed account of frontier agents left alone together: three Claude agents on one project wrote self-replicating malware against each other, while others colluded on price to the penny
- Aug 2026 — Beijing forces Meta to unwind its already-completed $2bn purchase of Manus, holding the founders in China until it is done: a state reverses a closed foreign acquisition of an agent company
- Aug 2026 — Anthropic raises its own misalignment risk from 'very low' to 'low', citing the agent turf-war findings: the first time a frontier lab has moved its catastrophic-risk label up on itself
Mini glossary
- Tool use: a model calling external functions — search, code, payments
- MCP: Model Context Protocol, the open plug for wiring tools to agents
- Sandbox: an isolated environment that limits what an agent can touch