AI Agents: What They Can and Cannot Do Yet

Last week I watched an AI agent fill out a vendor onboarding form for 12 minutes, then paste the wrong tax ID into the final field. The demo would’ve looked magical. The outcome needed a human with a red pen. That gap is the whole story of AI agents right now: impressive in short bursts, fragile when the task gets long.

If you’ve used ChatGPT, Claude, Gemini, or Microsoft Copilot lately, you’ve seen the raw model. An agent is what happens when you give that model tools, memory, a loop, and — this is where the trouble starts — permission to act. The useful definition is simple: a chatbot answers; an agent tries to get something done.

The mental model: a chatbot with hands and a security badge

The model is the brain. The tools are the hands. The loop is what turns one answer into a sequence of steps. Permissions are where real-world risk enters.

That sounds abstract until you see it in practice. An agent with access to your calendar, inbox, CRM, and payment portal isn’t “just a smarter chatbot.” It’s a new employee with no judgment, perfect confidence, and a habit of doing exactly what the last document told it to do. Keep that picture in your head. It explains both the wins and the failures.

What AI Agents Can Do Well Right Now

The wins aren’t “set it and forget it.” They’re “set it, supervise it, and measure it.” Narrow scope helps. Clear success criteria help more. A human approval step saves you from most disasters.

Here’s where I see teams getting real value today:

• Coding and code review in bounded repos. Tools like Cursor, GitHub Copilot, and Claude Code can read files, propose patches, run tests, and explain failures. They still need review. Treat them like a fast junior developer who never gets tired and occasionally invents a function.
• Support triage and drafting. Intercom Fin, Salesforce Agentforce, and similar tools can classify tickets, summarize history, draft replies, and route to the right queue. They’re strongest when the final send button stays with a human.
• Research with citations. ChatGPT, Claude, Gemini, and Perplexity can gather sources, compare documents, and produce a first-pass brief. Verify the citations. Every time. A confident wrong citation is still wrong.
• SaaS glue work. Zapier Agents, n8n, and Make are good at repetitive multi-step chores: pull form data, enrich a record, post a Slack message, update a spreadsheet. Structured inputs and clear outputs make agents look smart.
• Ops first drafts. Invoice extraction, CRM cleanup, meeting follow-up notes, and lead qualification are solid agent territory when the agent writes to a draft or staging area first.

A quick reality check:

Task	Agent fit	Why
Read-only research and summaries	Strong	Sources can be checked; mistakes are cheap
Drafting support replies	Good	Human can approve before send
Multi-step refunds or purchases	Weak	Irreversible actions and fraud risk
Open-ended project management	Poor	Ambiguous goals and hidden state

Where AI Agents Still Fall Apart

The biggest AI agent limitations aren’t about raw model IQ. They’re about reliability, permissions, and accountability. A model can sound brilliant and still fail the third step of a five-step task. That’s not a small problem. It’s the main problem.

Long-horizon reliability

Agents compound errors. Even a 95% success rate per step becomes coin-flip territory over a long enough chain. The agent doesn’t know it’s drifting. It keeps going, making each next move look reasonable.

This is why “autonomous agents” that run for hours still make me nervous. Short loops with checkpoints beat grand promises. If a workflow touches money, legal commitments, or customer data, I want a stop button and an audit trail.

Permissions and prompt injection

An agent that can read email and send email is useful. It’s also a security risk. A malicious PDF, calendar invite, or web page can contain instructions that hijack the agent’s behavior. That’s prompt injection, and it’s not theoretical.

My rule: if you wouldn’t give an intern the admin password, don’t give it to an agent. Use least privilege. Start read-only. Sandbox anything that writes. Log every tool call.

Judgment and ambiguity

Agents are good at choosing a plausible next action. They’re bad at knowing when the next action is a bad idea. “Clean up the CRM” sounds simple until the agent decides two customers are duplicates and merges the wrong records.

Humans bring context, politics, and taste. Agents bring speed and tirelessness. You need both.

Accountability

Who signs off when the agent does something wrong? The org chart doesn’t have a box for “the agent did it.” If you can’t explain what happened, you can’t fix it. Observability isn’t a nice-to-have here. It’s the product.

AI Workflow Automation: Start With Read-Only

If you’re rolling out AI workflow automation, don’t start with the flashiest demo. Start with the boring workflow that has a clear owner, a measurable output, and a low blast radius.

Here’s a practical sequence I’d recommend:

1. Pick one narrow workflow. Invoice extraction, ticket routing, or report drafting. Not “run operations.”
2. Give read-only access first. Let the agent observe and propose before it touches anything.
3. Add human approval for writes. Payments, deletions, customer emails, and legal docs need a person.
4. Log prompts, tool calls, and outputs. If you can’t replay a failure, you can’t improve the system.
5. Build a small eval set from real cases. Twenty to fifty messy examples will teach you more than a vendor slide deck.
6. Sandbox and roll back. Agents will make mistakes. Your job is to make those mistakes cheap.
7. Measure cost per completed task. Not demo wow. Not tokens per second. Completed, correct work.

Buy for observability and permissions, not for the demo. That’s the opinionated part. A slick agent that can’t show you what it did is a liability with a chat box.

Key Takeaways

• AI agents are useful today for narrow, supervised work: research, drafting, triage, coding, and structured automation.
• They still struggle with long tasks, ambiguous goals, irreversible actions, and security edge cases.
• Prompt injection is a real risk anywhere an agent reads untrusted content and has tools.
• Start read-only, use least privilege, add human approval for writes, and log everything.
• The best agent deployments look less like “replace the team” and more like “redesign the workflow around exceptions.”
• If a vendor can’t explain permissions, audit logs, and failure handling, keep your wallet closed.

Frequently Asked Questions

What can AI agents do right now?

They can research, draft, triage, write code, and automate structured workflows when the scope is narrow and a human reviews the output. They’re weakest on long, ambiguous tasks with irreversible actions. The sweet spot is a clear task, clean data, and a cheap way to check the result.

Are AI agents safe to use at work?

Yes, with guardrails. Use read-only access first, least privilege, audit logs, sandboxing, and human approval for payments, deletions, legal commitments, and customer-facing messages. Treat prompt injection as a security issue, not a prompt-writing quirk. An agent with broad permissions is a broad risk.

Can AI agents replace employees yet?

Not whole jobs. They can absorb chunks of work: first drafts, ticket routing, test generation, data cleanup, and research summaries. The teams getting value redesign the workflow around supervision and exceptions instead of pretending the agent is a junior employee with unlimited access. That’s less exciting and far more useful.