AI agents arrived in 2025 – here’s what happened and the challenges ahead in 2026
- Written by Thomas Şerban von Davier, Affiliated Faculty Member, Carnegie Mellon Institute for Strategy and Technology, Carnegie Mellon University
In artificial intelligence, 2025 marked a decisive shift. Systems once confined to research labs and prototypes began to appear as everyday tools. At the center of this transition was the rise of AI agents – AI systems that can use other software tools and act on their own.
While researchers have studied AI for more than 60 years, and the term “agent” has long been part of the field’s vocabulary, 2025 was the year the concept became concrete for developers and consumers alike.
AI agents moved from theory to infrastructure, reshaping how people interact with large language models, the systems that power chatbots like ChatGPT.
In 2025, the definition of AI agent shifted from the academic framing[1] of systems that perceive, reason and act to AI company Anthropic’s description[2] of large language models that are capable of using software tools and taking autonomous action. While large language models have long excelled at text-based responses, the recent change is their expanding capacity to act, using tools, calling APIs[3], coordinating with other systems and completing tasks independently.
This shift did not happen overnight. A key inflection point came in late 2024, when Anthropic released the Model Context Protocol[4]. The protocol allowed developers to connect large language models to external tools in a standardized way, effectively giving models the ability to act beyond generating text. With that, the stage was set for 2025 to become the year of AI agents.
AI agents are a whole new ballgame compared with generative AI.The milestones that defined 2025
The momentum accelerated quickly. In January, the release of Chinese model DeepSeek-R1[5] as an open-weight[6] model disrupted assumptions about who could build high-performing large language models, briefly rattling markets and intensifying global competition. An open-weight model is an AI model whose training, reflected in values called weights, is publicly available. Throughout 2025, major U.S. labs such as OpenAI[7], Anthropic[8], Google[9] and xAI[10] released larger, high-performance models, while Chinese tech companies including Alibaba[11], Tencent[12], and DeepSeek[13] expanded the open-model ecosystem to the point where the Chinese models have been downloaded more than American models[14].
Another turning point came in April, when Google introduced its Agent2Agent protocol[15]. While Anthropic’s Model Context Protocol focused on how agents use tools, Agent2Agent addressed how agents communicate with each other. Crucially, the two protocols were designed to work together. Later in the year, both Anthropic[16] and Google[17] donated their protocols to the open-source software nonprofit Linux Foundation, cementing them as open standards rather than proprietary experiments.
These developments quickly found their way into consumer products. By mid-2025, “agentic browsers” began to appear. Tools such as Perplexity’s Comet[18], Browser Company’s Dia[19], OpenAI’s GPT Atlas[20], Copilot in Microsoft’s Edge[21], ASI X Inc.’s Fellou[22], MainFunc.ai’s Genspark[23], Opera’s Opera Neon[24] and others reframed the browser as an active participant rather than a passive interface. For example, rather than helping you search for vacation details, it plays a part in booking the vacation.
At the same time, workflow builders like n8n[25] and Google’s Antigravity[26] lowered the technical barrier for creating custom agent systems beyond what has already happened with coding agents like Cursor[27] and GitHub Copilot[28].
New power, new risks
As agents became more capable, their risks became harder to ignore. In November, Anthropic disclosed how its Claude Code agent had been misused[29] to automate parts of a cyberattack. The incident illustrated a broader concern: By automating repetitive, technical work, AI agents can also lower the barrier for malicious activity.
This tension defined much of 2025. AI agents expanded what individuals and organizations could do, but they also amplified existing vulnerabilities[30]. Systems that were once isolated text generators became interconnected, tool-using actors operating with little human oversight.
The business community is gearing up for multiagent systems.What to watch for in 2026
Looking ahead, several open questions are likely to shape the next phase of AI agents.
One is benchmarks. Traditional benchmarks, which are like a structured exam with a series of questions and standardized scoring, work well for single models, but agents are composite systems[31] made up of models, tools, memory and decision logic. Researchers increasingly want to evaluate not just outcomes, but processes[32]. This would be like asking students to show their work, not just provide an answer.
Progress here will be critical for improving reliability and trust, and ensuring that an AI agent will perform the task at hand. One method is establishing clear definitions around AI agents and AI workflows[33]. Organizations will need to map out exactly where AI will integrate into workflows or introduce new ones[34].
Another development to watch is governance. In late 2025, the Linux Foundation announced the creation of the Agentic AI Foundation[35], signaling an effort to establish shared standards and best practices. If successful, it could play a role like the World Wide Web Consortium[36] in shaping an open, interoperable agent ecosystem.
There is also a growing debate over model size. While large, general-purpose models dominate headlines, smaller and more specialized models are often better suited to specific tasks[37]. As agents become configurable consumer and business tools, whether through browsers or workflow management software, the power to choose the right model increasingly shifts to users rather than labs or corporations.
The challenges ahead
Despite the optimism, significant socio-technical challenges remain. Expanding data center infrastructure strains energy grids[38] and affects local communities. In workplaces, agents raise concerns about automation, job displacement[39] and surveillance.
From a security perspective, connecting models to tools and stacking agents together multiplies risks[40] that are already unresolved in standalone large language models. Specifically, AI practitioners are addressing the dangers of indirect prompt injections[41], where prompts are hidden in open web spaces that are readable by AI agents and result in harmful or unintended actions.
Regulation is another unresolved issue. Compared with Europe[42] and China[43], the United States has relatively limited oversight of algorithmic systems. As AI agents become embedded across digital life, questions about access, accountability and limits remain largely unanswered.
Meeting these challenges will require more than technical breakthroughs. It demands rigorous engineering practices[44], careful design and clear documentation of how systems work and fail. Only by treating AI agents as socio-technical systems rather than mere software components, I believe, can we build an AI ecosystem that is both innovative and safe.
References
- ^ academic framing (people.eecs.berkeley.edu)
- ^ Anthropic’s description (www.anthropic.com)
- ^ APIs (theconversation.com)
- ^ Model Context Protocol (www.anthropic.com)
- ^ DeepSeek-R1 (api-docs.deepseek.com)
- ^ open-weight (opensource.org)
- ^ OpenAI (platform.openai.com)
- ^ Anthropic (platform.claude.com)
- ^ Google (deepmind.google)
- ^ xAI (docs.x.ai)
- ^ Alibaba (huggingface.co)
- ^ Tencent (huggingface.co)
- ^ DeepSeek (huggingface.co)
- ^ downloaded more than American models (www.dataprovenance.org)
- ^ Agent2Agent protocol (developers.googleblog.com)
- ^ Anthropic (www.anthropic.com)
- ^ Google (developers.googleblog.com)
- ^ Perplexity’s Comet (www.perplexity.ai)
- ^ Browser Company’s Dia (www.diabrowser.com)
- ^ OpenAI’s GPT Atlas (chatgpt.com)
- ^ Copilot in Microsoft’s Edge (www.microsoft.com)
- ^ ASI X Inc.’s Fellou (fellou.ai)
- ^ MainFunc.ai’s Genspark (www.genspark.ai)
- ^ Opera’s Opera Neon (www.operaneon.com)
- ^ n8n (n8n.io)
- ^ Google’s Antigravity (www.googleantigravity.org)
- ^ Cursor (cursor.com)
- ^ GitHub Copilot (github.com)
- ^ had been misused (www.anthropic.com)
- ^ amplified existing vulnerabilities (arxiv.org)
- ^ agents are composite systems (arxiv.org)
- ^ not just outcomes, but processes (arxiv.org)
- ^ AI agents and AI workflows (www.anthropic.com)
- ^ integrate into workflows or introduce new ones (www.linkedin.com)
- ^ Agentic AI Foundation (aaif.io)
- ^ World Wide Web Consortium (www.w3.org)
- ^ better suited to specific tasks (arxiv.org)
- ^ strains energy grids (www.cmu.edu)
- ^ job displacement (www.forbes.com)
- ^ multiplies risks (arxiv.org)
- ^ indirect prompt injections (cetas.turing.ac.uk)
- ^ Europe (thefuturesociety.org)
- ^ China (carnegieendowment.org)
- ^ rigorous engineering practices (www.sei.cmu.edu)
Authors: Thomas Şerban von Davier, Affiliated Faculty Member, Carnegie Mellon Institute for Strategy and Technology, Carnegie Mellon University