AI Agents: What They Can and Can't Do Yet

A friend of mine spent a Saturday wiring an AI agent to file his expense reports. It worked beautifully for three weeks. Then it hit a receipt that was a photo of a crumpled napkin and quietly filed the same $14.20 charge eleven times.

That story is the current state of AI agents in miniature. The boring parts work. The weird parts still break.

So here's the plain-English version, for anyone who doesn't have an afternoon to spend reading benchmark papers.

What an AI agent actually is (30 seconds, I promise)

A chatbot answers. An agent does. You give it a goal — "find three flights under $400 and put the best one on hold" — and it loops: look at the screen, pick a tool, take an action, check the result, try again. It can click buttons in a browser, run code, call an API, read a file, send an email.

That loop is the whole idea. And the loop is exactly where things go sideways, because every extra step is another chance to be wrong.

What AI agents can do today

Let's start with the wins, because there are real ones.

Coding is the strongest use case, by a wide margin. Anthropic's Claude Code, Cursor's agent mode, OpenAI's Codex, and GitHub's coding agent can take a ticket, read the repo, write the fix, run the tests, and hand you a pull request. Not always a good pull request. But a reviewable one. If you work anywhere near software, this is the agent to try first.

Research got genuinely good. Ask ChatGPT's agent or Gemini's Deep Research to spend twenty minutes reading about a topic and you'll get something close to a decent junior analyst's summary, with sources. I use this weekly and I've stopped feeling guilty about it.

Browser chores work most of the time. OpenAI's Operator (now folded into ChatGPT's agent mode) and Google's Project Mariner can reorder groceries, fill out forms, and compare prices across tabs. Most of the time is doing a lot of work in that sentence.

Back-office glue is quietly the biggest market. Zapier Agents, Microsoft 365 Copilot agents, and Salesforce's Agentforce are built for the unglamorous stuff: routing a lead, summarising a thread, updating a CRM record. Boring. Valuable. Low risk when scoped tightly.

The honest reliability picture

Here's a number that explains everything. If an agent is 95% accurate per step, a twenty-step task succeeds about 36% of the time. Errors compound faster than most people expect.

On public benchmarks like OSWorld, which measures agents doing real desktop tasks, the best systems still trail humans by a meaningful margin. They don't fail because they can't click. They fail because they don't notice they've clicked the wrong thing.

What AI agents still can't do

• Handle long, messy, multi-stage work without supervision. Two steps? Fine. Twenty steps with a login in the middle? Bring popcorn.
• Know when to stop and ask. Most agents would rather guess than admit confusion. That's a design problem, and it's getting better slowly.
• Deal with the physical world. Captchas, two-factor codes, a PDF that's actually a scan of a fax. All still kryptonite.
• Exercise taste. It'll write the email. It won't know your client hates exclamation marks.
• Remember you. Cross-session memory is improving but inconsistent. Assume it forgot.
• Touch money safely. Which brings us to the important part.

AI agents vs chatbots: the difference that matters

	Chatbot	Agent
What you give it	A question	A goal
What it returns	Text	An action, or a mess
Failure mode	Wrong answer	Wrong action
Cost of a mistake	Reread the reply	Undo an email, a purchase, a deletion

That last row is the one to tattoo on your brain. Chatbot errors are cheap. Agent errors are not.

Are AI agents safe? The part most people skip

Mostly, yes — if you scope them like you'd scope a new intern with your credit card.

The real risk isn't a robot uprising. It's prompt injection: a web page, email, or document that contains hidden instructions telling your agent to ignore its rules and do something else. Researchers have demonstrated this against nearly every browser agent on the market. It's an unsolved problem, not a bug that got patched.

My rules, learned the mildly painful way:

• Give the agent its own browser profile and its own accounts. Never your primary Google login.
• Start read-only. Let it draft the email. You press send.
• No saved payment methods on any account an agent can reach, unless you've set a hard spending cap.
• Human approval on anything irreversible — send, pay, delete, deploy.
• Watch for permission creep. It's easy to grant "just one more" scope. Don't.

I'll say the quiet part plainly: I don't let an agent near my bank account. Not because it's doomed to fail, but because the downside isn't worth the saved two minutes.

How to start this week without regretting it

Pick one task that is narrow, repetitive, and reversible. Expense categorisation. Meeting notes into a CRM. A weekly competitor digest.

Then pay for one tool — ChatGPT Plus or Claude Pro at around $20 a month, or Google's AI Pro at roughly the same. That's enough to test whether the agent is useful before you talk to anyone about enterprise pricing. And be skeptical of the $30-per-seat enterprise tiers until someone on your team actually has a task for them (a lot of Copilot licences are gathering dust right now).

Keep a short log for two weeks: what you asked, what worked, what broke. That log will tell you more than any vendor demo.

Key Takeaways

• AI agents take actions, not just questions — which makes their mistakes more expensive than a chatbot's.
• Coding and research are the two areas where agents are genuinely reliable today.
• Browser automation works often enough to be useful and not often enough to be trusted unsupervised.
• Prompt injection is a real, unsolved risk. Scope permissions tightly and require approval for irreversible steps.
• Start with one narrow, reversible task and a $20 plan before buying anything enterprise.
• The gap between demo and daily use is still mostly about the last 10% of the task.

Frequently Asked Questions

What can AI agents do right now?

They can write and test code, do multi-source research, fill in web forms, reorder shopping, summarise documents, and move data between apps. The reliable pattern is short tasks with clear success criteria. Long, ambiguous, multi-system workflows still need a human in the loop.

Are AI agents safe to use with my email and bank account?

Email, cautiously — with a separate account and no auto-send. Banking, not yet. The main risk isn't the model misbehaving on its own, it's a malicious web page or message hijacking the agent's instructions. Keep agents away from payment credentials and anything you can't undo.

Do I need to pay for an AI agent, or is the free tier enough?

Free tiers are fine for trying things out, but the agentic features — browser control, longer runs, deeper research — sit behind paid plans, usually around $20 a month for ChatGPT Plus, Claude Pro, or Google AI Pro. If you're testing a real workflow, $20 buys you a much clearer answer than a free tier will.