Agentic AI in production

Research report, v3, issued 9 August 2026. Written for investment decision makers evaluating agentic AI systems in production. Evidence cut-off: 9 August 2026.

Adoption figures are contested, the agentic security baseline is eight months old, and the European compliance calendar moved twice in the past year. This report separates what current sources establish from what they only assert, and states which is which.

What the evidence supports

Four findings carry the rest of this report. Three of them rest on named primary sources. The fourth, the one most often quoted in board papers, does not survive contact with the underlying data.

Adoption percentages are not measurements

Public trackers published in 2026 disagree by more than a factor of six on the same question. One collection reports 79% enterprise adoption against 11% of agents actually running in production. Another cites S&P Global Market Intelligence and McKinsey at 31% of enterprises with at least one agent in production. A third states 72%.

The numbers are not reconcilable because the questions are not the same: adopted, in production, and scaled measure three different things, and none of these aggregators publishes its instrument or sample. Any single adoption percentage should be treated as unusable for planning.

Projects die of governance, not of model capability

Gartner predicted in June 2025 that more than 40% of agentic AI projects would be cancelled by the end of 2027, naming escalating costs, unclear business value, and inadequate risk controls as the causes. The same release estimated that only about 130 of the thousands of vendors marketing agentic products were genuine, describing the rest as agent washing.

All three named causes are scoping and control problems that precede any model choice.

Architecture is a spending decision

Anthropic reported that a multi-agent configuration outperformed a single-agent baseline by 90.2% on its internal research evaluation. In the same post, Anthropic reported that agents consume roughly four times the tokens of a chat interaction while multi-agent systems consume about fifteen times.

Token usage alone explained 80% of the performance variance Anthropic measured. The multiplier is only earned where the task genuinely splits into independent parallel threads.

Both baselines moved recently

OWASP published its first Top 10 for Agentic Applications on 9 December 2025, a list distinct from the LLM Top 10. In parallel, amendments adopted in 2026 deferred most of the EU AI Act's high-risk obligations while leaving the August 2026 transparency and general-purpose enforcement dates in place.

Any architecture decision taken before late 2025 was taken against a different rulebook.

What an agentic system is

An agentic system is not a language model behind a chat window. It is production software in which a model reasons over a goal, retrieves context, holds state, calls tools, inspects what comes back, and continues until a stopping condition is met. A basic model application takes an input and returns an output. An agent decomposes the goal, chooses the next step, and triggers real actions through APIs.

Two shapes dominate. In a single-agent system one control loop owns the workflow, however many tools it calls and documents it retrieves. In a multi-agent system the work is split across specialised agents with defined roles, input and output contracts, and routing between them. The second shape costs more and fails in more places, so it needs a reason beyond elegance.

Underneath either shape sit six components. Each has a characteristic way of failing, and the failure is usually visible in a design review long before it is visible in production.

Component	What it owns	How it fails
Model layer	Routing cheap models to classification and reserving reasoning models for hard steps, with structured outputs so downstream code receives schemas rather than prose	One expensive model on every call, and free text where a contract was needed
Tools	The interface to databases, APIs, and code execution, each with a name, description, input and output schema, permissions, timeout, and retry behaviour	Vague descriptions that send the agent down the wrong path
State and memory	State is the current run: step, collected fields, tool results. Memory is conversation history, preferences, past actions, and retrieved knowledge	Everything loaded into the prompt, so context bloats and cost follows
Orchestration	The explicit control flow across model, tools, and memory, written as code, a graph, or a state machine	Control flow left implicit in a prompt, where it cannot be tested
Evaluation	Trace-level scoring of intent classification, retrieval quality, tool selection, and policy compliance against realistic scenarios	Grading the final answer only, so a wrong path that lands on a right answer passes
Approval and policy	Deterministic validation before a high-impact tool runs, with a human in the loop where the blast radius warrants it	Permissions expressed as instructions rather than enforced in code

What separates a demo from a system

The most detailed public account of taking an agent system to production remains Anthropic's write-up of its Research feature, published in June 2025. It is a single vendor describing a single product, so it is evidence rather than proof. It is also specific enough to argue with, which most vendor material is not.

Reliability

Agents hold state across long runs, so errors compound rather than surface. Restarting from the beginning is expensive and, for a user waiting, unacceptable. The reported answer was durable execution: checkpoints the run can resume from, retry logic around tool calls, and gradual traffic shifts at deploy time so a code change does not break agents that are mid-run.

Cost and latency

Effort has to be scaled to query complexity in the prompt itself, because agents judge it badly on their own. The published rule of thumb was one agent and three to ten tool calls for simple fact-finding, rising to more than ten subagents for genuinely complex research. Running subagents and tool calls in parallel cut research time on complex queries by up to 90%.

Evaluation

Evaluation started at about twenty queries representing real usage, not hundreds. A single model-as-judge call scoring against a rubric of factual accuracy, citation accuracy, completeness, source quality, and tool efficiency proved more consistent than multiple specialised judges.

Human testers still caught what automation missed, including a bias toward search-optimised content farms over authoritative sources. Rewriting one tool description after systematic testing cut task completion time by 40%, which is the clearest available argument for treating tool contracts as engineering artefacts rather than documentation.

Observability

Agents are non-deterministic between runs on identical prompts, so a bug report of the form "it did not find the obvious answer" is undiagnosable without a trace. Full production tracing of decision patterns, deliberately excluding conversation content, was what made failures attributable.

The security surface

On 9 December 2025 the OWASP GenAI Security Project published the Top 10 for Agentic Applications, drawing on more than a hundred contributors and a review board including NIST, the European Commission, and the Alan Turing Institute. It extends the LLM Top 10 rather than replacing it: an agent system inherits the model-level risks and adds these. Where OWASP named a public incident, it appears in the third column of the table.

Risk	What it is	Named example
ASI01 Agent goal hijack	An attacker redirects the agent's objective, often through data it retrieves	EchoLeak
ASI02 Tool misuse	Legitimate tools invoked unsafely, or tool interfaces exploited directly	Amazon Q
ASI03 Identity and privilege abuse	Credentials or inherited permissions carry the agent beyond its scope
ASI04 Agentic supply chain	Third-party tools, plugins, registries, and tool servers add runtime exposure	GitHub MCP exploit
ASI05 Unexpected code execution	A sandbox or agent boundary fails and arbitrary code runs	AutoGPT RCE
ASI06 Memory and context poisoning	Persistent memory or retrieval is shaped to mislead later steps	Gemini memory attack
ASI07 Insecure inter-agent communication	Messages between agents are spoofed, replayed, or unauthenticated
ASI08 Cascading failures	One agent's error fans out across everything downstream of it
ASI09 Human-agent trust exploitation	People over-trust agent output, or are deceived into harmful action
ASI10 Rogue agents	An agent operates outside its intended purpose or oversight

Two entries deserve board attention specifically. Identity and privilege abuse is structural: an agent inheriting a user session or a shared service account holds whatever access that credential carries, and no prompt constrains it. Cascading failure is what turns an incident into an outage.

Governance and the regulatory calendar

The EU AI Act entered into force on 1 August 2024 and applies in phases. Amendments adopted in 2026 deferred the high-risk obligations but left the August 2026 dates untouched, so guidance written before mid-2026 is now wrong in both directions.

Date	What applies	Status
2 Feb 2025	Prohibited practices and the AI literacy duty	In force
2 Aug 2025	General-purpose model provider obligations	In force
2 Aug 2026	Commission enforcement powers over general-purpose model providers, and Article 50 transparency duties	Unchanged by the 2026 amendments
2 Dec 2026	Machine-readable marking for synthetic-content systems placed on the market before August 2026	Deferred by four months
2 Aug 2027	National regulatory sandboxes, and models placed before August 2025	Deferred by one year
2 Dec 2027	Annex III standalone high-risk systems	Deferred by sixteen months
2 Aug 2028	Annex I product-embedded high-risk systems	Deferred by twelve months

Penalties are tiered. The broadest breaches carry up to EUR 35 million or 7% of worldwide annual turnover, and general-purpose model provider obligations up to EUR 15 million or 3%. Sources agree on these figures. They disagree on how much of the high-risk regime a given agent deployment falls under, a question that needs counsel rather than a report.

The operational consequence is narrower than the legal one. Human oversight, logging, and risk management are high-risk requirements, and each has a concrete engineering form: a deterministic gate in front of any tool that moves money, sends external mail, or deletes data, checking permissions in code rather than in a prompt, and writing an approval record a person can be named in. Teams that build that gate for their own risk appetite tend to find the compliance artefact already exists.

Build, buy, or both

No framework comparison published in 2026 names an overall winner, and the ones that come closest are written by framework vendors. The stable consensus is narrower: graph-based orchestration suits stateful workflows that must survive a crash and pause for human review; role-based frameworks suit workflows that map to named specialists; the model vendors' own SDKs are the shortest path to a single agent calling one or two tools.

Microsoft moved AutoGen into maintenance and consolidated on the Microsoft Agent Framework, which reached general availability in April 2026, so teams on the older library face a migration rather than an upgrade.

One widely repeated figure should be treated with caution. A 2026 comparison citing Princeton HAL benchmark data reports that the orchestration scaffold alone moves agent benchmark performance by up to 30 percentage points on an identical model. We could not verify this against the primary benchmark, and it appears in one source. If it holds, framework choice is a larger lever than model choice, which would be a significant result.

Layer	Default call	Reasoning
Model serving and routing	Buy	Priced per token by several vendors and re-benchmarked continuously. Nothing built here stays current
Tracing and evaluation platform	Buy	Framework-agnostic products exist. Building one delays the evaluation set, which is what predicts survival
Orchestration framework	Buy, expect to replace	Orchestration code does not port. Keep the graph thin so replacing it is a project, not a rewrite
Tool integrations	Build, on a portable interface	Tools and prompts survive a framework change. This is the durable asset
Evaluation set and scenarios	Build	Nobody else holds your cases, your policies, or your definition of a wrong answer
Approval and policy gates	Build	They encode your permission model and produce your audit trail

The pattern behind that table is that orchestration code does not port between frameworks, while tools and prompts do. Committing tool integrations to a portable interface is the investment that survives a framework change. Before funding a second pilot, the two questions worth forcing an answer to are who owns this agent and holds the budget for it, and what the evaluation set is that decides whether it works.

Method and sources

Research was carried out on 9 August 2026 across security, regulatory, vendor engineering, and market-tracking sources. Primary material was preferred over commentary wherever it existed: the OWASP release and the Gartner and Anthropic posts are read directly rather than through summaries. Load-bearing figures were checked against at least two independent sources, and where sources disagree, as they do on adoption and on production rates, the disagreement is reported rather than averaged. Statements sourced to a single aggregator are marked as such in the text.

Sources

1. Gartner, Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027, 25 June 2025. Cancellation forecast, agent washing, the estimate of about 130 genuine vendors, and the January 2025 poll of 3,412 respondents.
2. Anthropic, How we built our multi-agent research system, 13 June 2025. The 90.2% evaluation result, the four times and fifteen times token multipliers, the 80% variance finding, the 90% time reduction, the 40% tool-description improvement, and the evaluation and deployment practices in section 3.
3. OWASP GenAI Security Project, OWASP Top 10 for Agentic Applications for 2026, published 9 December 2025. Contributor count and expert review board.
4. OWASP GenAI Security Project, The benchmark for agentic security in the age of autonomous AI, 9 December 2025. The mapping of ASI01 to ASI06 onto named public incidents.
5. EU Artificial Intelligence Act, Enforcement of Chapter V under the EU AI Act. Commission enforcement powers over general-purpose model providers from 2 August 2026, and the 2 August 2027 date for models placed before August 2025.
6. Covington, Inside Global Tech, EU AI Act Update: Timeline Relief, Targeted Simplification, and New Prohibitions, 28 May 2026. The Annex III, Annex I, Article 50(2), and regulatory sandbox deferrals.
7. Legiscope, EU AI Act Deadlines 2026-2027. Phase dates and the EUR 35 million or 7% penalty ceiling.
8. MediaLaws, EU AI Obligations for GPAI Providers, August 2025. The EUR 15 million or 3% ceiling under Article 101.
9. LangChain, The best AI agent frameworks in 2026, and Langfuse, Comparing open-source AI agent frameworks. Framework positioning. Both are published by vendors in the category.
10. Uvik, Agentic AI Frameworks 2026: Production Comparison. The Princeton HAL 30-point claim and the AutoGen to Microsoft Agent Framework transition. Single source for the former.
11. Digital Applied, Agentic AI Statistics 2026 and AI Agent Adoption 2026; Agentic AI Institute, Agentic AI Enterprise Adoption 2026; Unico Connect, Agentic AI Statistics 2026. The conflicting adoption and production figures discussed in section 1.1.