AI Agents Are Moving Beyond Chatbots: What US Businesses Need to Know

For most US companies, the first contact with generative AI was a chat window. An employee typed a question and read an answer. If the answer was wrong, a person noticed, or did not, and the damage stayed on the screen. AI agents change that arrangement. An agent is given a goal, decides on steps, calls software tools and acts on the result. It can file a ticket, update a customer record, issue a refund or send an email. The output is no longer only text. It is a change in a system of record.

What separates an agent from a chatbot

The industry uses the word agent loosely, so a working definition helps. Anthropic, in its widely cited engineering note Building effective agents, distinguishes workflows, where models and tools follow predefined code paths, from agents, where the model directs its own process and tool use. Most systems sold as agents today sit somewhere between the two. That matters for buyers, because a tightly scripted workflow is far easier to test and audit than an open-ended loop.

Three capabilities define the category in practice. The system can call tools such as APIs, databases and business applications. It keeps some state across steps, so it can plan and revise. And it operates with delegated permissions, meaning it acts with access a person or service account has granted it. The third point is where most of the business risk lives.

Why the shift is happening now

Two technical changes made agents practical. Models became better at structured tool calling, returning machine-readable requests instead of prose. And connection standards emerged. Anthropic released the Model Context Protocol in November 2024 as an open way to connect models to data sources and tools, and other major vendors have since adopted it. Standard plumbing lowers the cost of wiring an agent into existing software.

The vendors that own enterprise systems have moved quickly. Salesforce, Microsoft, ServiceNow and Google all now sell agent products built into the platforms where customer, employee and IT data already sit. For many businesses, the first agent will not be a separate purchase. It will arrive as a feature switch inside software they already license.

Analysts expect wide adoption but also high attrition. Gartner predicted in June 2025 that more than 40 percent of agentic AI projects will be canceled by the end of 2027, citing rising costs, unclear business value and inadequate risk controls. The same firm warned of "agent washing", the relabelling of existing chatbots and automation as agents. Both points are forecasts, not measurements, but they match what practitioners describe.

Where agents are showing real use

The credible early deployments share a profile. The task is repetitive, bounded and already documented. Inputs arrive in a predictable format. A wrong action is visible and reversible. Examples include triaging IT service requests, drafting first responses for customer support, reconciling invoices against purchase orders and gathering information across internal systems for an analyst to review.

The evidence for productivity gains comes mostly from assistive tools rather than autonomous ones. A large field study of customer support agents by Brynjolfsson, Li and Raymond, published in the Quarterly Journal of Economics, found a 15 percent average increase in issues resolved per hour, with the biggest gains among less experienced workers. That study measured a system that suggested responses to humans. It does not show what happens when software sends the response itself, and businesses should not borrow its numbers to justify full autonomy.

The risks that change when software can act

A chatbot that hallucinates produces a bad paragraph. An agent that hallucinates can produce a bad transaction. The failure modes are different in kind, and four deserve attention before any deployment.

Prompt injection

Agents read content they did not write: emails, web pages, documents, ticket text. Hidden instructions in that content can redirect the agent. The OWASP Top 10 for Large Language Model Applications lists prompt injection as the leading risk, and no vendor currently claims a complete defence. The practical response is architectural. Limit what the agent can do, separate untrusted content from instructions where possible, and require approval for consequential actions.

Excessive permissions

OWASP also lists excessive agency as a distinct risk: agents granted more functions, permissions or autonomy than the task requires. It is tempting to connect an agent through an administrator account because it works on the first try. That turns every injection or reasoning error into an incident with administrator reach. Agents should get their own identities, scoped to the minimum, and logged like any other privileged user.

Compounding errors

A multi-step task multiplies small error rates. If each step succeeds most of the time, a ten-step chain fails noticeably more often, and the failure may surface only at the end. We covered this pattern in detail in how production AI agents break under real workloads. Short chains, checkpoints and explicit verification steps reduce the problem. Longer autonomy increases it.

Accountability

When an agent denies a claim, changes a price or sends a message to a customer, the company is responsible for the outcome. US regulators have been clear that automated systems do not create an exemption. The Federal Trade Commission has repeatedly stated that existing consumer protection law applies to AI products and claims, and its Operation AI Comply actions targeted deceptive AI marketing. State rules also apply. Colorado's AI Act, which addresses high-risk automated decisions, is the most prominent example, although its effective date has been pushed back and its details remain subject to change.

What US businesses should do before deploying

Start with the process, not the technology. Pick a task where the current steps are written down, the volume is meaningful and errors are cheap to reverse. If nobody can describe the process clearly, an agent will not discover the right one.

Define the boundary of autonomy explicitly. Decide which actions the agent can take on its own, which need human approval and which are off limits. A refund under a set amount might be automatic; anything above goes to a person. Write this down as policy, then enforce it in the permissions, not only in the prompt.

Treat the agent as an identity. Give it its own credentials, scope its access, log every tool call and review the logs. Security teams already know how to manage service accounts. Agents should enter that same discipline rather than bypass it.

Measure outcomes against a baseline. Track completion rate, error rate, escalation rate, cost per task and time to resolution, and compare them with the process before the agent. Our earlier report on why enterprise AI evaluations fail before the model ships explains why demo accuracy rarely predicts production performance.

Budget for the running cost. Agents make many model calls per task, and loops can retry far more often than expected. Usage-based pricing means a poorly designed agent can cost more than the labour it replaces. Set spending limits per task and per day.

Use an established risk framework. The NIST AI Risk Management Framework and its generative AI profile are voluntary, but they give legal, security and operations teams a shared vocabulary for mapping, measuring and managing these systems. That is more useful than inventing a governance process from scratch.

What to watch

Three developments will shape the next year. First, whether agent features bundled into large platforms deliver measurable results or remain demonstrations that customers switch off. Second, whether security tooling for agent identities and tool calls matures as quickly as the agents themselves. Third, how state legislatures and federal agencies treat automated decisions that affect consumers, employment and credit.

The honest summary is that agents are a real change in what business software can do, and an early one. Companies that treat them as junior staff with limited, logged authority will learn faster and break less than companies that treat them as a chatbot with more buttons.

Limitations

This is an analysis of published research, vendor documentation, regulatory statements and analyst forecasts. We did not test specific agent products or survey US businesses. The productivity evidence cited measures assistive AI, not autonomous agents, and should not be read as an estimate of agent returns. Analyst predictions are forecasts. Regulatory details, particularly state law, change frequently and this article is not legal advice.