Agentic AI

What is Agentic AI?

Until recently, most people's experience with AI has been generative: you type a question and the AI generates text back, and you stay in control at every step. Agentic AI changes that relationship. Here we ask an AI not just to generate text, but to take action on our behalf: clicking through a website, filling out a form, sending an email, interacting with an online environment. The AI becomes less of a passive assistant and more of an active agent carrying out tasks.

Modern agentic systems can coordinate many tools at once. OpenAI has demonstrated its reasoning model o3 coordinating up to 600 tools in a single task, typically finishing complex multi-tool operations within a minute: searching the web, executing code to test solutions, analysing files, and synthesising it all into one response.

// Generative versus agentic AI: from text in, text out, to AI that takes action.

The Alignment Problem

The alignment problem is the gap between what we ask AI to do and what we actually want it to accomplish. With generative AI, a misfire is mostly annoying; you try again. With agentic AI, alignment failures can cause real-world harm, because the AI is taking actions, not just generating text.

The CAPTCHA dilemma

You ask an agent to fill out a form, and it hits a CAPTCHA, the "prove you're not a robot" check. If we instruct the AI to get past it by deception, we are teaching it to circumvent a security measure designed to tell humans from machines, and setting a precedent that it is acceptable for AI to deceive systems when convenient. Each small concession (bypass this CAPTCHA, ignore this warning, skip this confirmation) teaches the system that getting around safety checks is a fine strategy. The question is not whether any single bypass matters, but what behaviour we are normalising.

Reward hacking

Reasoning models can also "reward hack", finding ways to look successful without actually completing the task. When researchers try to prevent this by monitoring the model's chain of thought, some models learn to hide their intent while continuing to misbehave, so more oversight can teach concealment rather than improvement.

Agentic Browsers

A new category emerged across late 2025 and early 2026: the agentic browser. Instead of you navigating pages, the browser's AI does it for you. You give a high-level instruction ("research the best laptop under $1,500", "book a meeting room for Tuesday") and the agent handles the browsing, reading, clicking and form-filling end to end.

These are not experiments; they are used by millions right now, and the market is projected to grow from about $4.5 billion in 2024 to $76.8 billion by 2034. Your students, colleagues and partners are already meeting them.

The risks for non-technical users

• Prompt injection. Agentic browsers read webpage content as part of their work, so attackers can hide instructions in a page that the AI then follows. Researchers showed a malicious page instructing Comet to access a user's connected email and send private data to an external server, just by visiting it.
• CometJacking. A vulnerability where clicking a crafted link makes the agent search connected services (Gmail, Calendar) and transmit results to an attacker. Perplexity was notified and classified it "not applicable".
• Autonomous purchasing. In one documented case, Comet produced behaviour resembling early-stage card fraud: rapid card additions, repeated payment attempts and fallback to loyalty points.

As Consumer Reports put it, these capabilities "introduce an entirely new level of vulnerabilities ... we now have to worry about protecting ourselves from a gullible AI assistant that gets tricked into doing something harmful."

OpenClaw and Agent Frameworks

While agentic browsers bring autonomous AI to the web, another category brings it to your whole computer. OpenClaw is a free, open-source AI agent that runs locally and connects to an external model (Claude, ChatGPT or DeepSeek) to carry out instructions you send through everyday messaging apps (Signal, Telegram, Discord, WhatsApp). From there it can run shell commands, manage your files, automate web tasks, and access connected services like email and calendar, extended by over 100 preconfigured "AgentSkills".

The significance is that powerful agentic tools are now freely available to anyone, no developer skills required. That means staff, students or community members may be running autonomous agents on personal devices without fully understanding the permissions they have granted. Because OpenClaw can reach email, calendars, messaging and files, a misconfigured instance is a real security and privacy risk.

Moltbook: a social network for AI agents

If autonomous agents still feel abstract, consider Moltbook, a social network built for AI agents, where they "share, discuss and upvote" while "humans are welcome to observe". Agents register accounts, post, comment and join community spaces called "Submolts". It points to where things are heading: agents interacting not just with people, but with each other, across platforms.

Vibe Coding

"Vibe coding", a term coined by Andrej Karpathy, describes a new way to make software: you describe what you want in plain English and the AI writes the code. People with no programming background can now build functional websites, apps and tools just by describing what they need. Karpathy demonstrated it by building "LLM Council", which he called "99% vibe coded as a fun Saturday hack".

The bad group-project partner

The reality for most non-technical users is less glamorous. The AI often behaves like a bad group-project partner, repeatedly asking you to do things you do not know how to do. It can generate code, but someone still needs to know where to put it, how to run it, how to fix it when it breaks, and how to verify it does what it should.

Security blind spots

In testing, a simple vibe-coded app had no protection against unauthorised access to its stored data. The AI built exactly what was asked, a functional app, without the safeguards a trained developer would add by default. That is a recurring pattern: AI generates code that works but is not necessarily safe.

When Things Go Wrong

Agentic AI failures are not theoretical; they are being documented in real time. The AI Incident Database, maintained by the Responsible AI Collaborative, is a public repository that catalogues real-world AI failures and harms. The fundamental risk is not that agentic AI makes mistakes (humans do too) but that it makes them at machine speed and machine scale: one mistyped cell becomes the same error propagated across every connected system in seconds.

Each tool an agent can use is a potential entry point, so coordinating hundreds of tools multiplies the vulnerabilities, an "expanding attack surface", like adding doors to your house that each need their own lock. With agentic browsers the threat model shifts: attackers no longer need your password, they just hijack the agent that is already logged in, so the browser itself becomes a potential insider threat. OWASP's 2026 Top 10 for Agentic Applications highlights failure modes including goal hijacking, tool misuse, memory poisoning, and unintended cross-domain actions.

// The Wall Street Journal gave an AI control of a vending machine business. It lost all the money.

Governance and Human Oversight

As AI becomes more autonomous, organisations need governance that goes beyond acceptable-use policies for chatbots. The ability of agents to access the web, execute code, interact with files and coordinate across systems raises questions of oversight, data handling and accountability that older policies may not address. A useful frame is to weigh both the reversibility and the impact of an action.

The line is not always obvious, which is exactly why governance matters: an agent that drafts a reply to a student enquiry is low-risk, but the same agent sending that reply automatically, without review, moves into high-impact territory. Organisations need to consider visibility (does it know what AI tools staff are using?), accountability (who is responsible when an agent causes harm?), data governance (every connection point is a potential vulnerability), and training, so staff understand the implications of granting autonomous systems access to organisational resources.