An assistant answers questions. A workflow runs fixed steps. An agent gets a goal and decides for itself which steps to take and which tools to use. That is powerful, and that is exactly why it is risky.
Where agents stand in 2026
The numbers vary widely depending on whom you ask. In McKinsey's August 2026 survey, 40 % of respondents from large companiesU with more than one billion US dollars in revenue say their organisation is scaling AI agents, up from 27 % a year earlier. Among smaller organisations, the figure is flat at 22 %U. Chatbots remain the most widely scaled, at 47 %U. About two in ten organisations scale coding agents; among large companies it is 31 %.
Microsoft reports 15-fold growthD in active agents in Microsoft 365 on its own platform, and 18-fold in large enterprises. The Stanford AI Index 2026, by contrast, shows agent deployment still in the single digits in almost every business function.
Both fit together: the growth is steep, the base is small.
Assistant, workflow, agent
| Assistant | Workflow | Agent | |
|---|---|---|---|
| Who decides the steps? | A person | Fixed in advance | The AI |
| Typical example | Email draft | Invoice into the ERP | Research across several sources plus report |
| Risk | low | medium | high |
Many tasks that start as agent projects are better solved with a fixed workflow. An agent only pays off when the steps truly depend on the individual case.
The workflow: guardrails for your first agent
- 01StartDefine a narrowly scoped task
- 02SystemLeast privilege: only the tools and data needed
- 03AIAgent plans and executes steps
- 04CheckExternal action? Email, payment, deletionyes: a person confirms before execution
- 05DataEvery step is logged
- 06CheckStop criterion reached?yes: hand over to a person
- 07ResultWeekly error review
Before you start, fill in a profile for every agent: goal in one sentence, allowed tools, forbidden actions, stop criteria, responsible person, monthly cost limit.
Limits and risks
- Prompt injection: An agent that reads web pages or emails can follow instructions hidden in them. Do not give it rights an attacker could abuse.
- Wrong actions: Sending emails, deleting data and triggering payments only after human confirmation.
- Costs: Many agents are billed by usage. Set limits and alert thresholds.
- Where the numbers come from: The growth in active agents is Microsoft's figure for its own platform.
How to start
- Find a task whose steps vary by case, such as preparing a client meeting from CRM, email and website.
- Give the agent read-only rights.
- For four weeks, let it propose results that a person adopts or rejects.
- Expand rights only once the error rate is low and well documented.