How AI Agents Work?

The Adoption Illusion: Why 79% of Companies Claim Agents but Only 16% Have Real Ones

Seventy-nine percent of companies say they've adopted AI agents. Strip away the labels, and only a fraction are running anything that deserves the name.

That tension sits at the heart of the current agentic AI moment. PwC's survey of US executives reports that 79% of companies see AI agents being adopted, yet deeper deployment data shows only 23% are scaling agents in even a single business function, and just 16% of enterprise AI deployments qualify as "true agents" at all. The rest? Fixed-sequence or routing-based workflows wearing an agent's name badge.

PwC itself flags the gap, cautioning that "reports of full adoption often reflect excitement about what agentic capabilities could enable — not evidence of widespread transformation." Stanford HAI data cited by industry trackers suggests fewer than 10% of organizations have actually deployed agents in any given function. Gartner, meanwhile, predicts more than 40% of agentic AI projects will be cancelled by end of 2027 over unclear value, cost overruns, or weak risk controls.

So what separates a real agent from a relabeled chatbot? It comes down to mechanics:

• Agents decide by inference, calculating the most probable next step — their behavior isn't scripted and isn't fully predictable, which is why security researchers insist on access constraints rather than rigid rules.
• They use tool calling to connect to APIs, databases, and external systems — an agent's real power lives in its connections, not its model.
• They run a continuous loop of planning, reasoning with tools, and reflecting on feedback, storing past interactions in memory to adapt over time.

A fixed-sequence workflow, by contrast, follows a predetermined path: if the user says X, do Y. Useful, but not agentic. The difference is autonomy in the loop — who or what decides the next step.

This distinction matters because it determines whether you're buying transformation or theater. MIT Sloan's research on real deployments found that 80% of the work in a production agent was data engineering, governance, and workflow integration — not prompts. Genuine deployments also demand tool discipline: deciding exactly which skills, data, and APIs each agent can touch. That's why SkillzBench is building per-agent loadouts — so an agent only sees the vetted tools you choose for it, with every skill version-pinned, security-scanned, and benchmarked before it ships.

Before you trust any "agent" claim — vendor's or your own team's — ask three questions: Does it plan multi-step tasks on its own? Does it call external tools? Does it learn from feedback? If the answer is no, you're looking at a workflow, and knowing the difference is where real adoption starts.

Inside the Agent Loop: Plan, Reason with Tools, Reflect

Every agent, no matter how sophisticated, runs on the same fundamental rhythm: it perceives its environment, reasons about what to do, and acts — then repeats. According to MIT Sloan's explainer on agentic AI, agents "perceive, reason, and act" in digital environments to achieve goals on behalf of humans. That repeating loop is what separates an agent from a chatbot that simply answers and stops.

IBM breaks the loop into three stages. First comes goal initialization and planning: a human defines the objective, and the agent decomposes it into subtasks. Second is reasoning with available tools — the agent fills knowledge gaps by calling APIs, querying databases, running web searches, or delegating to other agents, then self-corrects as results come back. Third is learning and reflection, where feedback from human review and other agents is stored in memory, enabling personalized, adaptive responses over time (IBM).

How agents reason matters as much as what they do. Two dominant paradigms have emerged:

• ReAct — the agent cycles through Think-Act-Observe, reasoning one step at a time and adjusting based on each tool result.
• ReWOO — the agent plans upfront without depending on intermediate tool outputs, which reduces token usage and can be more efficient for predictable workflows.

Agents also span a spectrum of complexity. IBM identifies five types, from simplest to most advanced: simple reflex agents that react to immediate inputs, model-based reflex agents that maintain an internal state, goal-based agents that plan toward objectives, utility-based agents that weigh trade-offs, and learning agents that improve from experience (IBM). Most enterprise deployments today sit somewhere in the middle — capable of planning and tool use, but still supervised.

The payoff is concrete. IBM's case study of a multi-agent legal research assistant cut contract review time from 90 minutes to 45 minutes — a 50% reduction on a task that previously consumed a professional's full attention. That result came not from a smarter model but from orchestration: the agent's power came from its ability to connect to and operate other tools, databases, and APIs.

This is why the tool ecosystem, not the underlying model, determines what an agent can actually do. It's also where risk concentrates — research has found that roughly 26% of published agent skills carry at least one vulnerability, and NIST has flagged constraining agent access as a core security priority. That's the problem SkillzBench is building for: a free directory of verified agent skills with a free MCP tool that lets you choose exactly which skills and tools each agent can see. Understanding the loop is step one; equipping it safely is step two.

It's the Tool Ecosystem, Not the Model: Why Connections Define What an Agent Can Do

Strip away the marketing, and an AI agent is mostly plumbing. Yes, the underlying model matters — but security researchers point out that an agent's true power comes from its ability to connect to and operate other tools, databases, and APIs, not from the raw intelligence of the model itself.

The industry is converging on this insight fast. According to adoption data, the MCP Registry — the public catalog of servers that connect agents to external systems — grew 407% in roughly two months after its September 2025 launch, reaching around 2,000 server entries. That explosive growth isn't hype; it's thousands of developers independently deciding that connectivity is what makes agents useful.

How agents actually gain capabilities comes down to two mechanisms. The first is tool calling: the agent reaches out to APIs, databases, and web searches to fill gaps in its knowledge and execute multi-step plans, as IBM's technical explainer describes. The second is instruction packages — agent skills like SKILL.md files that teach coding agents such as Claude Code, Codex, and Cursor how to handle specific tasks. Together, these connections define the agent's real-world abilities:

• MCP servers that connect an agent to databases, APIs, and third-party services
• Agent skills that package instructions for specific workflows and tools
• Memory systems that let the agent store and reuse past interactions
• Feedback loops from humans and other agents that shape future behavior

But every connection is also an attack surface. A PwC survey of US executives found that only 20% of organizations trust agents with financial transactions — the lowest-rated use case measured. And published research on agent skills found roughly 26% carry at least one vulnerability. As Living Security puts it, a threat actor doesn't need to break the model; they just need to find the weakest link in the chain of tools the agent uses.

This is why NIST's work on securing agent systems focuses on constraining and monitoring what tools and data each agent can access, rather than hardening the model itself. The principle is simple: an agent should only see what you deliberately chose to give it. SkillzBench is building around exactly this idea — a free directory where every skill is security-scanned, version-pinned, and benchmarked, plus a free MCP connector that lets you toggle which skills and tools each agent can actually reach.

The takeaway is straightforward. When you evaluate an agent — or build one — don't ask which model powers it. Ask what it's connected to, who verified those connections, and what happens when one of them fails.

Unpredictable by Design: The Security Reality of Inference-Based Systems

An agent doesn't follow a script — it predicts. AI models make decisions by calculating the most probable outcome, which means their actions are not always fully predictable, and that single fact breaks the traditional security playbook. A firewall rule or approval gate assumes deterministic behavior; an agent can surprise you.

This is why rigid rule-based controls fail for agentic systems. NIST, which issued a formal request for information on securing AI agent systems, frames the challenge around three categories of agent-specific risk: models interacting with adversarial data such as indirect prompt injection, use of insecure models such as those compromised by data poisoning, and models taking harmful actions even without any attack — a phenomenon known as specification gaming. Notably, NIST's guidance focuses on methods to constrain and monitor the extent of agent access in the deployment environment, rather than on making the model itself behave.

The tool ecosystem compounds the problem. A threat actor doesn't need to break the model; they just need to find the weakest link in the chain of tools the agent uses. In multi-agent setups, agents are often designed to trust each other by default, which enables lateral movement once one component is compromised. Your biggest vulnerability, as security researchers put it, isn't a person or a machine — it's the interaction between them.

The practical answer is least-privilege design: give each agent a narrow, deliberate "loadout" of tools and data, and monitor what it does with them. That means:

• Deciding exactly which tools, skills, and data sources each agent can reach — nothing more.
• Vetting every component before it's connected, since published research found roughly 26% of agent skills carry at least one vulnerability.
• Pinning versions so a skill can't silently change behavior after you've approved it.
• Continuously re-scanning as upstream components change.

This is the verification layer SkillzBench is building: every skill version-pinned to a commit SHA, security-scanned, and scored on a 0-100 trust scale, with per-agent loadouts so the agent only sees what was chosen for it. Inference will never be fully predictable — but with the right constraints, what an agent can touch always is.

From Understanding to Deployment: Evaluate Before You Trust

Understanding how an agent works is only half the battle — the other half is proving it works before you let it loose. Teams that actually run agents in production treat evaluation as infrastructure, not an afterthought.

The numbers make this discipline visible. Among organizations building agents, industry data shows 89% maintain observability tooling and 62% can trace individual agent steps and tool calls. Meanwhile, Gartner predicts more than 40% of agentic AI projects will be cancelled by the end of 2027, often due to escalating costs, unclear business value, or inadequate risk controls. The teams tracing every step are the ones still standing.

The reason tracing matters so much comes down to how agents decide. Because agents operate on inference rather than fixed rules, their actions are not always fully predictable — which means you cannot assume a deployment that worked yesterday will behave identically tomorrow. You have to watch it.

A practical deployment checklist looks like this:

• Start with low-stakes tasks. Data analysis is the most trusted agent use case at 38%, while financial transactions sit at just 20% — begin where failure is cheap.
• Pin skill versions. An agent skill that passed testing last week may have changed upstream; pinning to a specific version keeps behavior reproducible.
• Scan before connecting. Published research found roughly 26% of agent skills carry at least one vulnerability, so security review should precede any integration.
• Benchmark with and without each skill. Measuring the Lift — the performance difference the skill actually delivers — separates genuine capability from placebo.
• Keep humans in the loop for high-stakes actions, especially anything touching money or autonomous decisions.

This evaluate-before-deploy mindset is exactly what SkillzBench is being built around: free benchmarking of every skill in a sandbox with the same model, with and without the skill, plus security scanning and a free MCP connector so you can browse, test, and equip skills at no cost. As MIT Sloan's Kate Kellogg puts it, moving agency from humans to machines demands a real increase in governance and infrastructure — and that infrastructure is what turns an interesting agent experiment into a deployment you can actually trust.

Skills, proven. Browse the free directory, scan what you're connecting, and measure the Lift before your agent ever touches production.