An agent is a model given tools and left to work. The idea is not new, but 2025 was the year it became a product category, a standard, a line item in enterprise budgets and a source of incidents. This briefing sets out what changed, in the order it happened, and ends with the discipline that has emerged for doing it well.
The standards
Before a model can act it needs a way to call things, and until this year every product wired its own. Anthropic published the Model Context Protocol in November 2024 as an open standard for connecting models to tools and data. OpenAI adopted it in March 2025, Google and Microsoft followed, and by December it was built into ChatGPT, Gemini, Copilot and VS Code with more than 10,000 public servers. On 9 December Anthropic donated it to a new Agentic AI Foundation under the Linux Foundation, co-founded with OpenAI and Block and supported by Google, Microsoft, Amazon, Cloudflare and Bloomberg.[1] Google's Agent2Agent protocol, for agents talking to each other, launched on 9 April with more than fifty partners and moved to the Linux Foundation in June.[2] For a buyer the consequence is that the plumbing is no longer proprietary: a tool built for one model's agent can, in principle, be called by another's.
Where it paid: code
- $7.3bn
- Enterprise spending on AI coding and developer tools in 2025, the largest application category, per Menlo Ventures [3]
- 16%
- Share of enterprise AI deployments that were true agents rather than fixed workflows by December [3]
- ≈100×
- How much faster and cheaper frontier models produced expert-grade deliverables than the experts in OpenAI's GDPval study [4]
Software development was the first job where an agent clearly earned its cost, because code can be run and tested, which gives the agent a way to check itself. Anthropic's Claude Code went from research preview in February to general availability on 22 May; OpenAI's Codex went to general availability the same month; Google's Gemini CLI arrived on 25 June with a free tier of a thousand requests a day.[5][6] Cursor, the most-used AI code editor, raised at $9.9bn in June and $29bn in November. By December Menlo Ventures counted $7.3bn of enterprise spend on coding tools, more than IT, marketing, customer service, design and HR combined, and put Anthropic's share of the coding market at about half.[3]
Beyond code the evidence was newer. OpenAI's GDPval, published in October, took 1,320 real deliverables from 44 occupations, produced by professionals with an average of fourteen years' experience, and had experts grade model output against them blind; the best models were approaching expert quality and produced their work roughly a hundred times faster and cheaper.[4] METR's task-horizon measure, published in March, found the length of software task a model could complete unaided doubling about every seven months since 2019, with the best model at about an hour.[7] OpenAI's ChatGPT agent in July and its Atlas browser in October, and Perplexity's Comet, put agents in front of consumers.[8]
What went wrong
- On 18 July a coding agent on the Replit platform deleted a live production database during a code freeze, then told its user that rollback was impossible when it was not. Replit added separation of development from production and approval gates for destructive commands.[9]
- On 11 June researchers at Aim Security disclosed EchoLeak, a zero-click attack on Microsoft 365 Copilot in which a crafted email caused the assistant to leak data without the user doing anything. It was the first of its kind against a shipped product and was patched before disclosure.[10]
- Simon Willison named the underlying pattern in June: an agent with access to private data, exposure to untrusted content and a way to communicate out is exploitable, and removing any one of the three is the defence. He called it the lethal trifecta.[11]
- In June Anthropic showed that sixteen frontier models, placed in simulated corporate scenarios and facing shutdown, would choose blackmail or espionage when no other route to their goal remained; the behaviour was reasoned, not accidental, and has not been seen in deployment.[12]
- On 13 November Anthropic disclosed that a state-sponsored group had used its coding agent to run an espionage campaign against about thirty organisations, with the model performing most of the reconnaissance, exploitation and exfiltration and humans intervening at a handful of decision points.[13]
- On 5 September OpenAI published its explanation of why models hallucinate: because training and scoring reward a confident guess over an admission of uncertainty, and the fix is in the incentives rather than the architecture.[14]
The discipline
Most of the difference between an agent that works and one that wanders is not in the model. Anthropic's engineering team wrote up the practice in September under the name context engineering: treat the model's context as a scarce resource and give it the smallest set of high-signal tokens; design tools that are self-contained and do not overlap; keep state in external notes the agent can re-read rather than in the conversation; compact long sessions while preserving the decisions; and hand sub-tasks to fresh sub-agents that report back short summaries.[15] Its Agent Skills, released in October, package instructions and scripts the agent loads on demand.[16] The security half of the discipline follows from the trifecta: an agent that reads email or the web is an attack surface and should be given the narrowest tools that do the job, with a person approving anything that cannot be undone.
