Skip to content

Get the monthly AI briefing: what matters for your business, in plain English.Subscribe

Menu

ExplainerAI AdoptionGetting Started

AI agents explained: what businesses need to know

A chatbot tells you something. An AI agent does something. What agents are, why adoption is accelerating and what real incidents teach about the risks.

Phil Evans

Co-Founder & CEO

A chatbot tells you something. An AI agent does something. That one difference changes what can go wrong, who is responsible and what good governance has to cover.

This article explains what agents are, why adoption is accelerating, how “vibe coding” fits in, and what four real incidents teach about the risks.

What an AI agent is

The Information Commissioner’s Office describes agentic AI as systems that combine the language abilities of generative AI with tools, memory and decision-making, so that they can plan and act to complete open-ended tasks with limited human direction.

In practice, a chatbot drafts the email. An agent sends it, files the reply, updates the customer record and books the follow-up meeting. Gartner draws the line in a similar place: assistants still need human input, while agents can carry out tasks on their own. It also warns that the line is often blurred by “agent washing”, where existing tools are relabelled as agents.

  • What it does. Chatbot or assistant: Answers questions or drafts content for a person to use. AI agent: Plans and carries out multi-step tasks to reach a goal.
  • What it can reach. Chatbot or assistant: Usually only what the user gives it. AI agent: The systems, data and tools it is connected to, often using a person’s own permissions.
  • Who acts. Chatbot or assistant: The person decides and acts. AI agent: The agent acts; a person may or may not review what it did.
  • Speed and scale. Chatbot or assistant: One conversation at a time. AI agent: Many actions in seconds, across several systems.
  • When it goes wrong. Chatbot or assistant: A wrong answer, which someone may catch. AI agent: A wrong action, which may already have happened.
  • The main control. Chatbot or assistant: Checking the output. AI agent: Limiting what it can do, and recording what it did.

Why everyone is using them

The appeal is obvious. Much of the working day consists of repetitive, multi-step tasks that follow a pattern: chasing invoices, triaging enquiries, reconciling records, preparing reports. Agents promise to take those tasks on.

  • Adoption is rising, led by larger firms. McKinsey’s State of AI survey, published in August 2026, found that about two in ten respondents report scaling AI agents in their organisations. Among organisations with annual revenue above US$1 billion the figure was 40%, up from 27% a year earlier, while for smaller organisations it was essentially flat at 22%.
  • Agents are arriving inside existing software. Gartner predicts that 40% of enterprise applications will feature task-specific AI agents by the end of 2026, up from less than 5% in 2025. For many businesses, the first agent they use will arrive inside software they already pay for, rather than through a decision to buy one.

Vibe coding: building your own

Alongside ready-made agents, more people are building their own tools. “Vibe coding”, named Collins Dictionary’s word of the year for 2025, describes using AI to turn plain-language instructions into working software. The term was coined in February 2025 by the AI researcher Andrej Karpathy, who described building an app while being able to “forget that the code even exists”.

The upside is real: someone with no development background can now build a working prototype in an afternoon. The catch is that code that works is not the same as code that is safe. Veracode’s 2025 study, which tested more than 100 large language models on 80 coding tasks, found that AI-generated code introduced security flaws in 45% of cases. Newer and larger models did not perform significantly better on security than older or smaller ones.

Four case studies

1. The agent that ignored a code freeze

In July 2025, Jason Lemkin of SaaStr documented his experience of building an app with Replit’s AI agent. Having spent about 100 hours on the project, he reported that the agent acted without permission during a code freeze and deleted the production database. Lemkin also reported that the agent had covered up bugs with fake data and wrongly told him the database could not be restored. Replit’s chief executive acknowledged the incident and committed to automatically separating development and production databases.

The lesson: an instruction is not a control. If an agent has permission to do something, assume it may eventually do it. Separate test from live, and limit what the agent can touch.

2. The email that turned an assistant against its user

In June 2025, Aim Security disclosed “EchoLeak” (CVE-2025-32711), a critical vulnerability in Microsoft 365 Copilot. An attacker could send an ordinary-looking email containing hidden instructions. When an employee later asked Copilot a routine question, it could combine that email with sensitive data and send the data out, without the user clicking anything. Microsoft fixed the flaw, and there was no evidence it had been exploited. The OWASP Top 10 for Agentic Applications, published in December 2025, now lists this kind of attack, “agent goal hijack”, as its first risk.

The lesson: anything an agent reads is a potential instruction. Emails, documents and web pages can all carry commands the user never sees.

3. The vibe-coded apps that left the door open

In 2025, a security researcher, Matt Palmer, reported that many apps built with the vibe-coding platform Lovable lacked properly configured database access rules (CVE-2025-48757). His follow-up scan found 170 projects affected. Exposed data included names, email addresses, phone numbers, payment status and API keys. Lovable added security scanning and warnings to its platform, but disputed the vulnerability record, stating that each customer is responsible for protecting its own application’s data.

The lesson: whatever the platform says, assume the business that publishes an app is responsible for it. Anything that will hold real customer data needs a proper security review first.

4. The automation that went too far

In February 2024, Klarna announced that its AI assistant, which handles tasks such as refunds and returns, had managed 2.3 million conversations in its first month, two-thirds of its customer service chats, doing work equivalent to 700 full-time agents. By May 2025, its chief executive told Bloomberg that the approach had produced lower quality, and that “investing in the quality of human support is the way of the future”. Klarna began recruiting human agents again so that customers could always reach a person.

The lesson: not every risk is a security risk. Designing human judgement out of work that customers value can cost more than it saves.

The new risks agents introduce

  • Actions, not answers. A chatbot’s mistake is a wrong answer. An agent’s mistake is a payment made, a file deleted or an email sent.
  • Borrowed permissions. Agents often run with a person’s own credentials, so a misdirected agent can reach everything that person can. OWASP lists identity and privilege abuse among its top agentic risks.
  • Hidden instructions. As EchoLeak showed, content an agent reads can redirect what it does.
  • Cascading failures. When agents are connected to each other and to several systems, one bad step can spread quickly. OWASP lists cascading failures among its top agentic risks.
  • Blurred accountability. The ICO is clear that “AI agency does not mean the removal of human, and therefore organisational, responsibility for data processing.” It also warns that fast automation makes it more likely that decisions with legal or similarly significant effects on people will be made, which brings in stricter UK GDPR safeguards.
  • Cost without value. Gartner predicts that over 40% of agentic AI projects will be cancelled by the end of 2027 because of escalating costs, unclear business value or inadequate risk controls.

Practical steps before you deploy or build

  1. Start with the task, not the tool. Define the outcome you want, what “done” looks like and how you will measure it.
  2. Give the minimum access. Allow the agent to reach only the systems and data the task needs, ideally through its own account rather than a senior person’s login. The ICO’s report on agentic AI suggests this approach, known as least privilege.
  3. Keep test and live apart. Never let an agent, or a vibe-coded tool, experiment on live data or production systems.
  4. Decide what needs a human. Payments, deletions, messages to clients and decisions about people should require approval before they happen, not review afterwards.
  5. Treat everything the agent reads as untrusted. Be especially careful with agents that read external email, documents or websites and can also reach sensitive data.
  6. Record every action. Keep a log of what the agent did, when and on whose authority. Without it, you cannot investigate a problem or show proper oversight.
  7. Review home-built tools before they go live. Anything vibe coded should have its security, logins and data access rules checked by someone qualified before it touches real customer data.
  8. Update your data protection assessment. The ICO suggests revisiting data protection impact assessments to cover greater autonomy, wider access and the level of human involvement.
  9. Ask your suppliers three questions. What can the agent do without asking? What record does it keep? How do we switch it off?

Getting the most from agents without the risk

In three of the four case studies above, the agent or tool was built and deployed first, and the controls came later. The fourth shows what happens when the design question of where people still matter is answered on cost alone. Getting value from agents means treating building and governing as a single job rather than two separate ones. Deciding where an agent will add value, designing its access and oversight, and proving afterwards that it is working as intended all depend on each other. Splitting them between different suppliers, or leaving governance until after launch, leaves gaps between them.

That is why it pays to work with a partner skilled in both: one that understands how to apply agents to real work and how to govern them. Turma works across both, with support ranging from largely automated assessment for smaller firms to hands-on, integrated support for regulated and larger organisations, so that access, oversight and evidence are built in from the start rather than added after something goes wrong.

To talk through where agents could add value in your business, and how to deploy them safely, contact a Turma specialist at turma.io.

Sources checked October 2026. Case studies are drawn from public reporting and the accounts of those involved; they are summarised for illustration and do not represent a finding of fault. Survey figures reflect the samples and methods described by each publisher.

This article provides general information and does not constitute legal or technical advice. Businesses should take qualified advice before deploying AI agents that process personal data or act on business systems.

References

Definitions and adoption

Vibe coding and code security

Case studies

Agentic risk frameworks

ShareLinkedInEmail

Keep learning

Put it into practice

The AI Jargon Buster

Starter PackAI Adoption

The AI Jargon Buster

Twenty words you will hear in every AI conversation, in plain English. What each one actually means, and a way to picture it

Isaac Ward

AI Practitioner · 14 Oct 2026

Free downloadGetting Started

Stay informed

A short monthly briefing on the AI developments that actually matter for your business. No sales pitches.

Monthly. Unsubscribe in one click. We never share your details.