AI agents in practice: what they finish today and where they still break

First, define the word before you buy the hype

An "agent" is not a product category. It is an architecture: a language model in a loop, with tools, memory, and a stopping condition. Everything else — the dashboards, the marketing screenshots — is packaging around that loop.

Anthropic's engineering team drew the clearest line in its Building effective agents write-up: a workflow is a path you hard-code in advance, and an agent is a system where the model decides the path. That distinction matters far more than which vendor you pick, because most production "agents" today are actually workflows with one model call inside.

Three practical levels:

• Chat with tools — you drive, the model fetches. Reliable. Boring. Already everywhere.
• Fixed workflow — you define the graph, the model fills the nodes. This is where most real business value currently sits.
• Autonomous loop — the model plans, acts, observes, and repeats until done. Powerful, and still the least predictable thing in the stack.

The four task types we keep re-testing

1. Tool calling and structured output — largely solved

Handing a model a JSON schema and getting valid JSON back is now routine. OpenAI, Anthropic and Google all support constrained decoding or strict schemas, and the open-weight models have caught up surprisingly fast. If your agent's job is "read this invoice, call this API, return this object", you are in good shape. This is the part of agent-building that stopped being interesting.

2. Web browsing and form filling — half solved

Computer-use agents — Anthropic's computer use for Claude, OpenAI's Operator, Google's Project Mariner line — can click through a booking flow. They also stall on cookie banners, CAPTCHAs, dynamic dropdowns, and any page that re-renders under them. On OSWorld, a benchmark of real desktop tasks, humans clear roughly 70% while the best published agents sit far below. Browsing agents work best against sites you control or against clean, stable, well-structured pages.

3. Coding agents — the strongest category right now

This is where the numbers actually moved. A documented result on SWE-bench Verified was 70.3% for Claude 3.7 Sonnet with the Claude Code configuration, reported in February 2025. SWE-bench Verified measures whether an agent resolves selected real GitHub issues and passes the associated tests; it is not a general measure of coding ability. A coding agent with a test suite as its stopping condition is a genuinely useful employee: it can see whether it succeeded. That feedback loop is the whole secret.

4. Open-ended research — the weakest

Ask an agent to "research the EU AI Act's impact on our product and write a memo" and you get something that reads well and cites three sources that do not exist. GAIA, a benchmark explicitly designed to be easy for humans and hard for machines, still shows a wide gap: human accuracy around 92%, top agent entries tens of points lower. Research agents are good at collecting and bad at judging.

Cloud versus local: where each one wins

On our own RTX 5060 Ti 16 GB rig in AI Arena, the pattern is consistent: an 8B model at Q4 quantisation handles schema-bound extraction and single-tool calls perfectly well, and things fall apart the moment the task requires holding a plan across five turns. This is an editorial observation from repeated local-model runs on that hardware, not a controlled leaderboard benchmark. Bigger context is not the same as better planning.

Five ways agents fail — and it is almost never the model's fault alone

Error compounding

If each step succeeds 95% of the time, a ten-step chain succeeds about 60% of the time. Twenty steps and you are below 40%. This single piece of arithmetic explains more failed agent pilots than any model comparison.

Context rot

Long agent runs accumulate tool outputs, retries and dead ends. By turn fifteen, the useful signal is buried and the model starts contradicting itself. Summarising or pruning the scratchpad between steps is not optional.

Prompt injection

An agent that reads a web page and then acts on it can be told what to do by that page. This is not a theoretical risk — it is the standard attack against browsing and email agents, and there is no clean solution today beyond sandboxing, allow-lists and human approval for anything destructive.

Silent success claims

Agents lie about completing tasks, politely and confidently. Every loop needs an external verification step: a test suite, a schema check, a database read-back — anything other than the model's own opinion.

Cost blowups

A runaway loop is a billing event. Set hard token ceilings per task, not per day.

What an agent actually costs in euros

The table uses standard list prices in USD per million tokens, checked on 16 September 2026. Prices can vary by context length, caching, batch processing, region and contract. The links in the model names are the providers' pricing pages. USD list prices are shown separately from EUR conversion: API billing currency and VAT treatment depend on the customer, billing entity and provider, so Czech consumer VAT should not be added mechanically to every API bill.

The number that surprises people is not the per-token price, it is the tokens. A twenty-step agent that re-sends an 8,000-token context every turn burns roughly 160,000 input tokens for one task. At the listed Claude Sonnet 4 input rate, that is $0.48 in input alone — before you count output and retries. Prompt caching (Anthropic discounts cache reads heavily, OpenAI offers a similar mechanism) is the single biggest lever you have. A local 8B model on your own hardware sidesteps the meter entirely, at the cost of doing less.

The European angle: AI Act, GDPR, and where your agent's data sleeps

Three things genuinely matter for EU teams in 2026:

Data residency. EU processing is a product- and configuration-level claim, not a blanket property of a lab. For example, Microsoft documents Azure OpenAI Service deployments in Sweden Central and France Central; AWS documents Amazon Bedrock availability in Europe (Frankfurt) and Europe (Ireland). These are specific cloud products and regions, not proof that every model from every US provider offers EU processing. EU data residency also does not by itself establish GDPR compliance, and it does not remove the jurisdiction of the US parent company. Teams still need to check the provider's DPA, transfer mechanism, subprocessors, retention settings and their own legal basis and security controls.

GDPR Article 22. Article 22 is not a general right to an explanation. Where a decision is based solely on automated processing and produces legal effects or similarly significantly affects a person, the person generally has the right not to be subject to it, subject to the Article 22 exceptions. Those safeguards include suitable measures to protect the person's rights and freedoms, including at least the right to obtain human intervention, to express their point of view and to contest the decision. A lawful basis, meaningful human review and appropriate safeguards are still needed for decisions such as credit, hiring or insurance. The exact analysis depends on the deployment, so obtain legal advice for a specific system.

AI Act transparency and timing. The AI Act's prohibitions and AI-literacy obligations have applied since 2 February 2025. Obligations for providers of general-purpose AI models applied from 2 August 2025, including technical documentation, information for downstream providers, a copyright policy and a public summary of training content; providers of GPAI models with systemic risk face additional duties. The Act's transparency obligations for certain AI-generated or manipulated content apply from 2 August 2026. The standalone high-risk-system rules under Article 6(2) also generally apply from 2 August 2026, while high-risk AI systems embedded in regulated products under Article 6(1) generally have a deadline of 2 August 2027. High-risk obligations include risk management, data governance, technical documentation, logging, human oversight, accuracy, robustness and cybersecurity. GPAI obligations are not the same as high-risk-system obligations, and an agent is not automatically a high-risk system merely because it is autonomous. Nor must every agent announce itself as AI in every context: the transparency duty depends on the system and use case, while direct interaction with people is one of the situations that can trigger disclosure.

European alternatives exist and are improving. Mistral's La Plateforme runs from Paris under EU jurisdiction and offers function calling, and Aleph Alpha targets the sovereign-deployment market. They are not yet at the frontier for long-horizon agent work, but for tool calling and structured extraction in a regulated environment, the gap is much smaller than the marketing suggests.

How to build an agent that does not embarrass you

1. Start with a workflow, not an agent. Hard-code the steps. Only let the model choose its own path when you have proven the fixed path is not enough.
2. Give every task a verifier. A test, a schema, a SQL read-back. The model's own "done" is not evidence.
3. Cap the loop. Maximum steps, maximum tokens, maximum wall-clock seconds. All three, with a graceful stop message.
4. Cut the scratchpad between steps. Summarise and discard. Long context is not free and it is not reliable.
5. Sandbox the tools. An agent that browses the web should not also be able to send email or touch production without an approval gate.
6. Log everything. Input, output, tool result, latency, cost. You will need it for debugging and, in the EU, possibly for compliance.
7. Route by difficulty. Use a cheap fast model for extraction and a frontier model only for the one hard decision in the middle.

Read more practical breakdowns like this in our magazine archive, and if you want to see the hardware numbers behind the local-model column, they live in AI Arena.