Industry Transformation

Agentic AI in the Enterprise: When Software Starts Taking Action

How the architecture of AI deployment shifted from prompt-response assistants to autonomous agents that plan, act, and complete goals — and what it means for work, governance, and security.

Gabriele Masetti · 2026-08-18

From chatbots to coworkers

For most of the generative AI boom, enterprise software talked back. It summarized documents, drafted emails, answered questions in a chat window. It did not do anything on its own. That distinction is what "agentic AI" is supposed to erase: instead of a model producing text for a human to act on, the model plans a sequence of steps, calls tools and APIs, reads the results, and decides what to do next, often without a human reviewing each step.

In finance specifically, that means an agent that doesn't just explain what a discounted cash flow model is, but pulls the filings, builds the model, checks it against comps, and hands back a draft memo.

That shift is why 2026 has become the year enterprise software vendors stopped saying "copilot" and started saying "agent" or "digital worker." It's also why the gap between the marketing claim and the production reality has become the central story of the category. Some of this is real and measurable. A lot of it is still a pilot with a press release attached.

The frameworks doing the plumbing

Underneath the branded products sits a smaller set of open-source frameworks that most agent systems are actually built on. LangChain's LangGraph, a graph-based orchestration layer for chaining model calls, tool invocations, and conditional branches, has become the framework enterprises reach for when they need auditability: because the workflow is expressed as an explicit graph, engineers can point to a specific node where a process failed or rolled back, which matters when the process touches a general ledger or a client account.

On the simpler measure of raw GitHub star count, though, CrewAI's role-based abstraction has actually pulled further ahead of LangGraph — a reminder that developer popularity and enterprise architecture preference aren't the same thing.

CrewAI took the opposite bet: instead of exposing the graph, it gives developers a role-based abstraction — define a "researcher" agent and a "writer" agent, assign them a crew, and let them hand tasks to each other. That simplicity shows up in its growth curve: roughly 2,800 GitHub stars in January 2024, and 58,800 in September 2026 against LangGraph's 41,900.

Microsoft's AutoGen took a third path, evolving from a research prototype into an event-driven runtime; AutoGen reached a 1.0 general-availability release in early 2026 built around that architecture, aimed squarely at teams that need agents to react to asynchronous events rather than run a fixed script.

OpenAI has been consolidating its own stack around the Agents SDK and AgentKit, a visual builder for agent workflows introduced at its 2025 developer conference. In April 2026 it added native sandboxed execution, letting an agent run code or shell commands inside an isolated environment rather than the developer's own infrastructure — a direct response to the obvious question every security team asks the first time someone proposes giving a model shell access.

Notably, OpenAI has also started retiring parts of its own agent stack it launched barely a year earlier: the deprecation notice for the no-code Agent Builder went out on 3 June 2026, and Agent Builder, the Evals platform and the reusable Prompts API are all scheduled to shut down on 30 November 2026, pushing developers toward the code-first Agents SDK or ChatGPT Workspace Agents instead. That's a useful data point on its own — even the vendors are still discovering which abstractions actually hold up in production.

MCP: the plumbing everyone agreed on

If the frameworks disagree on how to build an agent, there's been unusual convergence on how an agent should talk to tools. Anthropic introduced the Model Context Protocol (MCP) in November 2024 as an open specification for connecting a model to external data sources and tools through a standard interface, instead of every vendor writing its own bespoke integration.

Adoption was fast by infrastructure-standard timelines: within about eighteen months, MCP was supported across Claude, ChatGPT, Microsoft Copilot, Cursor, and Google's Gemini tooling, and Anthropic reported more than 10,000 active public MCP servers and upwards of 97 million monthly SDK downloads.

Counts taken from outside the company land in the same range and keep climbing: a snapshot of the official MCP registry on 24 May 2026 returned 9,652 current server records, and GitHub's mcp-server topic, which held 15,926 repositories that day, lists 29,765 in September 2026. A Stacklok survey of 100 senior technical leaders, published in 2026, found 41% of their organisations running MCP servers in limited or broad production.

In December 2025, Anthropic handed governance of the protocol to the Linux Foundation's new Agentic AI Foundation, with Block, Google, Microsoft, AWS, Cloudflare, Bloomberg, and OpenAI participating — a deliberate move to make MCP look like neutral infrastructure rather than one vendor's proprietary format, the same trust-building step HTTP and TCP/IP went through decades earlier.

That same openness is also MCP's exposed flank. Because a tool's description is just text the model reads and trusts, security researchers have documented "tool poisoning" attacks, where a malicious or compromised MCP server embeds hidden instructions inside a tool's metadata that the model follows without the user ever seeing them. A 2026 disclosure identified roughly 200,000 vulnerable MCP instances across IDEs and cloud services, and a separate scan by Trend Micro found nearly 500 MCP servers exposed to the open internet with no authentication at all.

Anthropic has since shipped an Enterprise-Managed Authorization extension so IT departments can centrally control which MCP servers employees are allowed to connect to — a sign that the standard is maturing past the assumption that every tool provider is trustworthy by default.

Where finance is actually putting agents to work

Financial services has moved faster than most industries on this, partly because the workflows are already document- and data-heavy, and partly because the vendors have specifically targeted the sector. Anthropic launched ten finance-specific agent templates in May 2026, distributed as plugins through Claude Cowork and Claude Code, covering tasks like pitchbook generation, KYC screening, earnings-call review, and month-end close, with slash commands like /dcf, /comps, and /lbo meant to be fired directly from an analyst's terminal.

Anthropic has said financial institutions make up roughly 40% of its top 50 customers by revenue, and has named Goldman Sachs, Citi, Visa, and AIG among adopters — though "adopter" in these announcements usually means a paid enterprise contract, not that every analyst at the firm has an agent doing their model-building.

The banks themselves are describing more incremental, bounded use. JPMorgan has said its private banking arm uses AI systems to screen overnight market activity, client positions, and research so bankers can spend more time with clients, and has attributed a 20% increase in gross sales in that unit partly to the tooling — a bank-reported figure, not an independently audited one.

The firm has also said it plans to deploy agents capable of running autonomously for an hour or two, up from the two-to-three-minute sessions typical of current tools, which is itself a tell about where the technology actually is: today's production agents are mostly still short-horizon.

Morgan Stanley, separately, is opening its stock-plan administration platforms — Shareworks and Equity Edge — to external AI agents run by its corporate clients, starting with a handful of early accounts and planning to extend access to its roughly 3,400 administration clients over the following year.

ServiceNow has published one of the more concrete before-and-after numbers in the category from its own internal finance operations: a sales employee's query to the finance team that used to take an average of four days to resolve now gets resolved in about eight seconds, using an agent workflow with built-in security guardrails. That's a real, specific, internally-measured result rather than a hypothetical — though it's also ServiceNow measuring ServiceNow, which is worth keeping in mind when reading any vendor's own case study, including this one.

The reliability problem nobody has solved

The honest caveat running under all of this is that agents are still unreliable in ways that matter more as autonomy increases. Academic benchmarks make the gap concrete. Tau-bench, a 2024 benchmark built around realistic multi-turn customer service tasks in airline and retail domains, found that the strong models of that year managed barely half of tasks correctly on a single attempt, and that consistency across repeated attempts at the same task — a metric called pass^k — was dramatically worse, with success rates falling toward 25% when a model was asked to solve the same task reliably eight times in a row.

The researchers behind it traced a recurring failure pattern: a single small error early in a multi-step process — a rounding mistake, a misread field — propagates forward and invalidates every downstream action, because each step depends on the accuracy of the last. That compounding-error dynamic is exactly why a finance workflow with a dozen dependent steps is a harder target for full autonomy than a single-turn question-answering task.

The benchmark has since been rebuilt twice. τ²-bench (Barres and coauthors, arXiv:2506.07982, June 2025) let the user act on the environment as well as the agent and added a telecom domain, where the agent has to talk a customer through a fix it cannot perform itself; τ³-bench followed in early 2026 with audited tasks, retrieval-based knowledge work, voice, and a banking domain. Raw scores climbed with each generation — the top of the τ²-bench text leaderboard — retail, airline and telecom combined — now sits in the mid-eighties, led by Alibaba's Qwen3.5-397B-A17B at 87.9% pass^1 — but the pattern the researchers documented did not go away. Success still falls as the same task is repeated, and telecom, the domain that depends on the user doing what the agent says, stayed the hardest of the three for every model the paper tested.

At the organizational level, a widely cited MIT study published in mid-2025 ("The GenAI Divide," based on interviews with 52 executives, a survey of 153 leaders, and analysis of roughly 300 public deployments) found that 95% of enterprise generative AI pilots were producing no measurable profit-and-loss impact. The same research found a sharp split in approach: pilots built around a specialized outside vendor succeeded roughly two-thirds of the time, versus about one-third for projects enterprises tried to build entirely in-house — external partnerships succeeding, in the report's own phrasing, at roughly twice the rate of internal builds — a pattern that tracks with why Salesforce, ServiceNow, Microsoft, and Anthropic are all selling pre-built agent templates rather than just raw model access.

Klarna's public reversal is the sector's most-cited cautionary tale, and it's worth being precise about what actually happened. In February 2024, the buy-now-pay-later company said its AI assistant was handling the equivalent workload of 700 customer service agents and had taken over 75% of chat volume within a month of launch.

By 2025 the company was walking that back, with CEO Sebastian Siemiatkowski telling reporters that using cost as a too predominant evaluation factor had hurt service quality, and Klarna began rehiring human agents to handle the emotionally charged and multi-step cases the AI struggled with. The company's current position isn't a retreat from automation — its assistant still handles roughly two-thirds of inquiries and Klarna cites genuine gains like 82% faster response times — but a shift to a deliberately hybrid model where humans catch what the agent can't.

That's the pattern showing up across the industry: full autonomy gets tried, quality problems surface on the hard cases, and a human-in-the-loop layer gets reinserted, usually quietly.

Where this leaves enterprise buyers

The practical read for 2026 is that agentic AI is real but narrower than the category's marketing suggests. The frameworks and protocols — LangGraph, CrewAI, AutoGen, the Agents SDK, MCP — have converged enough that building an agent is now a solved engineering problem in a way it wasn't two years ago. What hasn't converged is confidence in letting those agents run unsupervised on anything with financial or reputational consequences.

The deployments that are actually working share a pattern: narrow scope, bounded autonomy windows measured in minutes rather than hours, a human checkpoint before anything irreversible happens, and evaluation infrastructure — Microsoft's Copilot Studio, for instance, now explicitly treats its own grading models as something that needs its own testing and monitoring, on the theory that an agent is only as trustworthy as the system judging its output.

Gartner's forecast that 40% of enterprise applications will carry some task-specific agent by the end of 2026, up from under 5% in 2025, is probably directionally right. Whether those agents are drafting the KYC file for a human to check, or actually clearing the transaction themselves, is the distinction that will determine whether this era of enterprise software looks like genuine productivity gain or another entry in the pilot graveyard.