Cloud assistants, computer use and shared standards are changing how AI gets work done. Here is what matters before you give an agent access to your apps.
Updated 5 November 2026
Ask an AI to explain a spreadsheet formula and you get an answer. Give an agent a tightly defined assignment and it may open the spreadsheet, inspect the data, apply a change and check the result. That extra ability to act is useful, but it also changes what can go wrong.
Recent announcements show where the technology is heading: agents that keep working in the cloud, operate software, and reuse tools and instructions across platforms. For businesses and everyday users, the practical question is how much responsibility to delegate and how to verify the work.
What makes an AI system agentic
An AI agent uses a model to choose steps and tools while pursuing a goal. A fixed automation follows a route its developer has already specified. An agent can adjust its route after seeing new information. Products often combine both approaches, so “agentic” describes a range of capabilities rather than a guarantee of complete autonomy.
A simplified agent loop looks like this:
- Understand the assignment. Identify the goal, constraints and available information.
- Choose a next step. Decide whether to search, calculate, inspect a file or ask a question.
- Use an authorized tool. Carry out the selected operation.
- Inspect the result. Check what happened and revise the approach if needed.
- Finish or pause. Return evidence of completion, or stop for clarification or approval.
There is no requirement that every agent be a team of agents. Start with the simplest design that works. Anthropic’s engineering guidance makes the same distinction between predefined workflows and model-directed agents, while warning that extra complexity can add cost and delay.
The latest developments worth watching
Persistent assistants are becoming real products
At its 29 September 2026 DevDay, OpenAI introduced dots, agents designed to take on ongoing responsibilities. The same announcement described cloud-based Codex work and reusable development environments with shared settings and permissions.
Anthropic followed with the Claude Duet research preview on 21 October 2026. Its announcement describes a virtual machine and browser that allow work to continue after the user closes their device. Tasks include preparing briefs, scheduling and building dashboards. Access begins through a waitlist for eligible US subscribers.
This changes the interaction: a user can hand over a bounded task, leave, and return to a result or an approval request. Persistent access also makes it important to know which accounts are connected and what information the agent retains.
Computer use is joining developer platforms
OpenAI’s September DevDay announcement also described computer use in its Agents API, alongside tool calling, tool search and multi-agent capabilities. That gives developers a route to agents that interact with software as part of a larger application.
Computer use matters when a task reaches an interface that cannot be handled through a suitable integration. A sensible implementation should still prefer a narrow, well-defined tool when one exists. Clicking the right button requires understanding the screen, and a changed layout can introduce another point of failure.
Open infrastructure is getting a shared home
On 22 October 2026, the Agentic AI Foundation announced four additional projects:
- Agent Skills packages reusable instructions, scripts and resources for specialized tasks.
- Open Responses defines common interfaces for applications working with different model providers.
- OpenEnv provides a framework for environments used in agent training and evaluation.
- OpenSandbox provides infrastructure for running AI applications in controlled environments.
This was a governance announcement, not the simultaneous invention or launch of all four technologies. The practical direction is clearer, however: developers are working toward shared components for teaching agents, connecting models, testing behavior and controlling execution. A foundation membership or open specification does not, by itself, prove that a deployment is secure or that every product works with every other product.
How agents connect to tools and one another
Two names appear often in this area. Model Context Protocol, or MCP, standardizes connections between AI applications and external tools or data. For example, a compatible server can expose a document search function so an assistant can retrieve relevant information.
Agent2Agent, or A2A, addresses communication between agent applications. It can support handing a task to another agent and exchanging results. MCP and A2A solve different integration problems. Neither removes the need to authenticate users, restrict access or check whether a particular action is authorized.
For a small business, the useful outcome could be a research assistant collecting approved material and passing it to a separate reporting workflow. The business still needs a clear owner for the final result. Adding another agent does not provide independent verification if both repeat the same incorrect source.
Where agentic AI can help today
The best starting points have a clear finish line and an output a person can inspect. Consider these pilot tasks:
- Research: compare three products using official specifications, attach source links and flag missing information.
- Software maintenance: investigate a reported bug in an isolated copy of a project, propose a fix and show test results.
- Office work: turn an approved set of meeting notes into a draft action list, keeping uncertain owners or dates visibly unresolved.
- Customer support: retrieve the relevant policy and prepare a reply for review before it reaches the customer.
These are example assignments, not claims that every agent product supports each workflow. Check the actual integrations, permissions and availability before choosing a tool.
Security must sit outside the prompt
An agent can encounter instructions inside a web page, document or tool response. A malicious source might try to persuade it to reveal private data or perform an unrelated action. This is prompt injection, and more tool access can increase the damage a successful attack causes.
OWASP’s MCP security guidance recommends narrow permissions, isolated execution, validation and human approval for sensitive actions. Useful safeguards include:
- Give the agent only the accounts, folders and operations the task needs.
- Keep credentials out of prompts and use protected authentication mechanisms.
- Show the recipient, content, amount and destination when asking for approval.
- Review tools and their updates, and record actions for later inspection.
As one product example, Anthropic’s 23 October Duet safety article describes separate action checks and credential isolation. It also acknowledges that safeguards can miss something or flag harmless content. Treat such controls as layers of protection, not proof that mistakes are impossible.
A practical way to start
Choose one low-risk task you already understand. Define what a successful result looks like, what the agent may access, and which actions need your approval. Start with preparation and review before allowing changes to live systems.
Measure completed, correct work rather than impressive-looking activity. Record the cost, elapsed time, corrections and human review required. Test missing information and tool failures as well as the happy path. Decide when the agent should stop instead of retrying.
The latest agentic AI tools offer more ways to carry out work across software. Their value depends on whether you can give them a clear assignment, constrain their access and verify the outcome. A small task completed reliably is a better foundation than a large task whose results nobody checks.
Comments