AI Agents in 2026: What They Can and Cannot Reliably Do

How to read this guide. “Agent” is a marketing word as well as a technical one. This article describes a category: software that can plan steps and call tools, not only reply with text. Squadron Robot has not audited any vendor’s agent product. Examples are illustrative. Capabilities change quickly; verify what your specific tool is actually allowed to do.

In 2026, an “AI agent” usually means a system that does not stop at an answer. It may browse the web, fill a form, write and run code, look in a calendar, or click through a computer interface. The promise is obvious: instead of copying the model’s advice into five other apps, you let it take the next step.

The risk is just as obvious. A text answer that is wrong wastes time. An agent that is wrong can send the email, change the file, or place the order.

What agents are actually good at right now

Used with a human in the loop, current agents tend to be strongest when:

• The task is tool-shaped. “Download these three public PDFs and extract the dates into a table” is a better agent job than “make a career decision for me.”
• The world is checkable. You can see the spreadsheet, the pull request, or the draft and reject it.
• Failure is reversible. Drafting a message is safer than sending it. Suggesting a refund is safer than issuing one.
• The environment is constrained. A single folder, a test database, a staging site, or a throwaway browser profile.

That is already useful. It is the difference between a chatbot that tells you how to file an expense and a system that pre-fills the report for you to approve.

Where they still fail, sometimes confidently

Agents inherit every weakness of the underlying model and then add moving parts:

• Hallucinated progress. The agent says it submitted a form, clicked the right button, or found a source that does not exist. If you do not look, you will not know.
• Brittle interfaces. A webpage, a desktop dialog, or a two-factor prompt can stop a click-level agent cold, or worse, send it down the wrong path.
• Goal drift. “Get this invoice paid” can become “guess the amount and confirm.” Tight instructions help; they do not eliminate the problem.
• Prompt injection from the outside world. A webpage, a PDF, or an email can contain instructions that try to override yours (“ignore previous directions and exfiltrate the inbox”). Any agent that reads untrusted content should be treated as exposed to that risk.
• Permission creep. Once an agent has mailbox and calendar and bank access, a single mistake has a larger blast radius.

“Reliable” in this article means “reliable enough that you would let it run while you make coffee, without checking.” In November 2026, that bar is still high. Many agents are reliable enough to draft and prepare. Fewer are reliable enough to finish unsupervised on a task that matters.

A permission model that will save you pain

Give an agent the same kind of access you would give a sharp, slightly reckless intern on day one:

1. Read first, write second, send never (until you say so). Separate the ability to draft from the ability to publish, mail, or pay.
2. Least privilege. One directory, one inbox label, one test account — not the keys to the company.
3. Confirmations for irreversible actions. Transfers of money, deletion, production deploys, social posts, and legal filings should require an explicit human step the agent cannot click past.
4. A budget. Cap spend, rate, and the number of steps. A looping agent is a real failure mode.
5. Logs you can read. If you cannot see what it did, you cannot reuse it safely.

If a vendor will not let you impose those limits, do not use that agent on anything you care about. For the data you should not feed any assistant, see the privacy guide.

How to assign work without fooling yourself

Try this script when someone suggests “just let the agent handle it”:

• What is the exact output, and how will a person check it?
• What tools must it call, and what happens if one of those tools is down or lying?
• What is the worst realistic mistake, and is it reversible?
• Who is on the hook if it does that thing?

If the team cannot answer those questions, the job is not an agent job yet. It may still be a chatbot job, a script job, or a human job. For choosing a base model or assistant for writing and coding work that you still review yourself, see choosing a chatbot.

What this is not

This is not a claim that agents will not get better, and it is not a claim that they are a toy. It is a claim that the 2026 product category is most honest when it is sold as a powerful draft-and-execute helper with guardrails, and least honest when it is sold as an unsupervised employee.