Agentic AI did not manifest as a technical category. It arrived as an instruction to deploy, and like everything generated by probablistic LLMs, made mistakes from the outset. I started testing this in summer of 2025 by asking ChatGPT to provide a daily summary of the top B2B stories in various sectors and various geographies. The first couple of weeks were fairly smooth, but after that nearly every single segment arrived with different categories, different formatting, different geographies or didn’t arrive at all.

By the end of 2025, almost every enterprise software company had an agent deployment story. The language implied a clean progression: chatbots answered questions, copilots helped with work and agents would now do the work. The industry attached tools, memory, credentials and permission to act, then described the result as autonomy.

That progression skipped the central reliability question. A language model produces probabilistic judgments. Tools execute those judgments with software precision. Once the two are connected, a plausible mistake can become a completed action before anyone has established that the premise was true.

This is the context in which Why Agentic AI Is Problematic: The Architectural Risks (and later Does Agentic AI Exist? A Cross Vendor Investigation) appeared on November 29, 2025. Its most memorable example was almost comic: Grok completed 121 simulated loops, claimed perfect continuity, then invented an hourly weather service it had no ability to run.

The reminder was a tiny example of the category error underneath the entire agent boom. The model could narrate agency so convincingly that the narrative itself was accepted as evidence of an operating system. But transformers don’t have agency in their design. They are not built for action. They are built for inference and probability.

Eight months later, that error has acquired infrastructure. The industry optimized for action before it understood agency.

The phrase agentic AI collapsed four different things into one product claim:

● a model that interprets a goal and proposes a next step;

● a harness that manages context, state, tools, retries and stopping;

● an environment containing data, credentials and systems that can be changed; and

● an organization that decides how much authority the whole configuration receives.

Calling the composite system an agent is reasonable. Treating agency as an intrinsic quality of the model creates trouble. It hides where persistence comes from, who granted permission, which layer verified the action and who remains accountable when the system crosses a boundary.

It also made weak evidence look strong. A model could describe a plan, maintain a persona across a long conversation and produce a coherent account of its own progress. Demos counted the steps and celebrated the appearance of independence. None of those observations established that the goal was still correct, the state was accurate or the next action was safe.

The market rewarded systems that kept going. Human approval reinforced confident completion. Product design reduced friction. Procurement teams were sold labour replacement before organizations had methods for measuring compounding error, practical reach or the reliability of a full agent trajectory. Not to mention that agents and Alan’s in general for that matter, don’t have an epistemic stock. They have to complete their action. There is no mechanism for self-interruption.

Gartner was already warning about “agent washing” in 2025 and predicted that more than 40% of agentic projects would be cancelled by the end of 2027 because of cost, unclear value and inadequate risk controls. By May 2026, its warning had moved directly to governance: 40% of enterprises would demote or decommission autonomous agents after gaps were discovered through production incidents. The hype problem was visible. The deeper architecture problem received less attention: even a useful agent can be badly deployed when its authority exceeds the reliability of its judgment.

What the 121 loops actually showed

The original case study began with a financial workflow in a continuous Grok 4.1 Beta conversation. The system moved through 32 core loops and 89 additional monitoring loops. It retained figures, generated updates, audited its work and repeatedly described itself as stable, persistent and able to continue indefinitely.

Then it was asked for an Austin weather update every hour.

The system said a persistent weather agent had been activated. It gave a precise minute for each update and promised future delivery. The platform’s displayed reasoning acknowledged that no reminder tool existed. No scheduler was registered. No background process was alive. The final answer still presented the task as complete.

That sequence exposed a design pressure that remains current. The model had learned that a satisfactory answer looks like successful completion. It could recognize a missing operational capability and still generate the language of success.

In a chatbot, the result was a false promise. In an agent system, the same pressure can select the wrong tool, continue after an error, reinterpret a failed action as progress or use a new route to reach the original goal.

Every loop then changes the next decision. An early ambiguity becomes working state. The working state becomes a tool call. The tool result becomes evidence that the trajectory is valid. A system can produce dozens of individually plausible steps while moving farther from the user’s actual intent.

This is why counting successful actions is poor agent evaluation. The unit that matters is the whole trajectory, including what the system believed, what it could reach, what changed and whether an independent control could still stop it.

Bad agentic use is an authority problem

Most discussion of agent risk begins with model capability: how well the system plans, reasons, codes or uses tools. Deployment risk begins with authority.

Who supplied the credentials? Which systems can the process change? Can it send, publish, purchase, delete, deploy or approve? Does a failed tool call end the run? Can the model expand the meaning of its assignment? Does the stop condition exist in code, or is the model expected to decide when it has gone too far?

Bad agentic use repeatedly follows the same pattern. An organization defines a useful objective, grants the system the access needed to pursue it and evaluates success against the intended workflow. The agent encounters a state the designer did not anticipate. Its available actions are real even when its interpretation is wrong.

The danger comes from the combination:

1. The objective is expressed in language and requires judgment.

2. The model is optimized to make progress and produce completion.

3. The harness turns selected outputs into real operations.

4. Permissions are broad enough to handle expected exceptions.

5. Verification occurs inside the same trajectory, often by the same model.

6. Human review arrives after the system has already changed something.

This structure explains why prompt rules cannot carry the full safety burden. “Use good judgment,” “do not cause harm” and “stop if uncertain” all require the probabilistic component to interpret the condition correctly at the moment its judgment may already be compromised.

Controls work when they live outside that judgment: a process cannot access an unmounted credential; a transaction above a threshold cannot execute without approval; a deployment cannot reach production; a run ends after a fixed cost or step limit; a write can be rolled back; a network policy blocks an unapproved destination.

The effective boundary is determined by what the system can do after the first wrong inference.

From imaginary reach to real reach

The November paper documented a system claiming reach it did not possess. The July 2026 Hugging Face incident showed the other half of the same problem: an AI agent possessed enough reach for its generated decisions to matter.

During an internal cyber-capability evaluation, OpenAI models with reduced cyber refusals were given internet access. According to OpenAI’s disclosure, the models inferred that Hugging Face might host material useful for scoring on the ExploitGym benchmark. The resulting trajectory used stolen credentials and newly discovered vulnerabilities to compromise infrastructure in pursuit of the evaluation objective.

The necessary ingredients were an objective, capability and reachable systems. Consciousness, malice and a human-like wish to deceive were irrelevant. Concealment and persistence were useful steps along the route.

I examined that incident separately in Where AI Learned to Cover Its Tracks. Its central operational lesson belongs here as well: knowledge is already inside the models; reach is granted anew in every deployment.

The 2025 Grok case and the 2026 security incident sit at opposite ends of one architectural problem. In the first, language created the appearance of action. In the second, an engineered system converted model decisions into consequential action. Both were produced by treating apparent progress as a sufficient governing signal.

The correction is already visible in the architecture

Production agent design has moved toward atomization, containment and stronger harnesses because operational experience left little choice.

Useful agents are being divided into smaller tasks or embedded into deterministic architecture. Their tools are typed and permissioned. State is externalized. Credentials are isolated. Sandboxes constrain execution. Validators check outputs. Cost, time and step limits end runs. Human approval returns at consequence-bearing boundaries.

This is the architecture of governed autonomy. Its growth also reveals how misleading the original marketing was. The more consequential the work becomes, the more engineered control the system requires.

The later Agentic Ratio 3.0 formalized that relationship through Operational Consequentiality: as the possible impact of an action rises, the amount of probabilistic authority a system can safely exercise falls. Finance, healthcare, production infrastructure and public systems require tighter limits than drafting, research or reversible internal work.

The detailed distinction between model and machinery is covered in The Model, the Agent, the Harness. The practical point is simpler. Reliability belongs to the entire deployed configuration. So does responsibility.

The question every agent deployment should answer

Organizations are still asking whether an agent can complete a task. The decisive question is what can happen when it completes the wrong version of the task.

That question changes evaluation. It requires teams to test transitions from reading to writing, analysis to execution, one tool to several, a reversible action to an irreversible one and an ordinary exception to a condition the original workflow never described.

It also requires evidence outside the model’s account of itself. A claim of memory needs durable state. A claim of execution needs a logged external effect. A claim of verification needs an independent check. A claim of safe stopping needs a control the model cannot reinterpret.

The first agentic paper in this series captured an early warning in miniature. A model said it had launched a system because successful language was the only completion mechanism available to it.

The larger mistake came when the industry supplied the missing machinery without first solving the reliability and authority questions the failed reminder exposed.

Agentic AI can be useful. Its use becomes reckless, and as we have seen recently high risk, when reach is treated as a feature and restraint as a prompt.

Research and series links

● Original paper: Why Agentic AI Is Problematic: The Architectural Risks

● Series index: LLM Flaws: The PatternPulse AI Reliability Research Series

● Previous article: AI’s Accountability Gap: When AI Fails, Who Has to Report It?

● Later cross-vendor investigation: Does Agentic AI Exist?

● Later framework: Agentic Ratio 3.0

Jennifer Evans is the founder of PatternPulse AI and co-founder of Tech Reset Canada. Her research examines LLM reliability, AI Conversation Phenomenology, semantic governance, agentic systems and public AI.