Through 2025, the dominant product category in AI shifted from conversational chatbots that answered a single prompt at a time to agents capable of planning multi-step tasks, browsing the web, calling external tools, and taking sustained action toward a goal with minimal ongoing human input. OpenAI launched Operator in January 2025, a system that could control a web browser to complete tasks like filling out forms or making reservations, while Anthropic had introduced 'computer use' capability for its Claude models in October 2024, letting the model view a screen and control mouse and keyboard actions directly.
The mechanism enabling broader agentic adoption was less any single model's raw capability than an interoperability standard: Anthropic released the Model Context Protocol (MCP) in November 2024, an open specification for how AI models connect to external data sources and tools in a standardized way, replacing the custom, one-off integration code that had previously made connecting an AI model to a company's internal databases or software systems a slow, bespoke engineering project for every new tool. Competitors including OpenAI and Google adopted MCP or compatible standards through 2025, turning what began as one company's proposal into a shared industry convention.
Chinese startup Manus, launching its agent product in March 2025, drew significant attention for demonstrating autonomous multi-step task completion — booking travel, conducting multi-source research, and generating deliverables — with less direct human supervision at each step than prior agent products had required, intensifying competitive pressure on U.S. labs to ship comparably autonomous capabilities rather than incremental chatbot improvements.
Enterprises building on agentic workflows gained real productivity in narrow, well-defined domains — code generation and review, customer-service ticket triage, research synthesis — while facing a new category of failure mode largely absent from single-turn chatbots: prompt injection attacks, where malicious instructions hidden in a webpage or document an agent processes could hijack its subsequent actions, and cascading errors where an agent's mistake early in a multi-step task compounded rather than being caught before execution.
Coverage emphasized the most visually striking agent demonstrations — an AI booking a restaurant reservation, completing a multi-step purchase — over the harder and less photogenic question of reliability at scale: benchmark studies through 2025 found agents completing complex, multi-step real-world tasks successfully only a minority of the time without human correction, a gap between demo capability and production reliability that shaped how cautiously enterprises actually deployed agents versus how the technology was marketed.
Developer tooling built specifically for agentic coding, including Anthropic's Claude Code and competing products from other labs, found faster and more consistent enterprise adoption than consumer-facing browsing agents, because software development offered a narrower, more verifiable task domain — a passing test suite or successful compile — where an agent's output could be checked automatically rather than relying on human judgment for every action.
Liability and accountability frameworks lagged the technology's deployment: when an autonomous agent made an erroneous purchase, sent an incorrect communication, or took an action a human would not have authorized, existing consumer protection and contract law offered incomplete guidance on whether the deploying company, the AI lab, or the end user bore responsibility, a legal ambiguity that remained largely unresolved through the year even as agent deployment expanded.
Products moved from chat answers toward agents that browse, click, code, and execute multi-step tasks with tool access. Reliability, permissioning, and audit trails became the product questions. 'Autonomy' entered enterprise procurement checklists beside accuracy.
Security researchers warned of prompt injection and cascading failures when agents hold credentials. Workflow software vendors raced to embed agent loops. The shift reframes AI from oracle to intern with superpowers — useful, unsupervised only at peril.
Permission scopes and human-in-the-loop design are the new UX. A wrong click by an agent is not a typo — it can be a wire transfer. The shift forces software to grow accountability features chat never needed.
The lasting inheritance is architectural: MCP and similar interoperability standards adopted in 2025 now function as basic infrastructure comparable to how HTTP or REST APIs standardized web communication decades earlier, meaning the specific companies that popularized agents in 2025 matter less to the technology's trajectory than the open protocols that let any AI system plug into any tool — the standardization, not any single flagship product, is what determined how the agentic era actually took shape.
Century Signals note: Major agent-product launches and research previews; enterprise security advisories; contemporaneous product journalism. Editorial judgment about what still structures the present — not a comprehensive history.