An agent is a model given tools and left to work. The idea is not new, but 2025 was the year it became a product category, a standard, a line item in enterprise budgets and a source of incidents. This briefing sets out what changed, in the order it happened, what the mechanism actually is, and ends with the discipline that has emerged for doing it well. It is written on 22 December with the sources available then.
The plug
Before MCP, connecting a given AI application to a given tool meant writing a bespoke integration, and connecting several applications to several tools meant writing one for every pair. MCP replaces that with a host-client-server architecture: the application is the host, it runs one client per server it talks to, and each tool or data source ships one server. N times M becomes N plus M. The protocol splits cleanly in two, a data layer of JSON-RPC 2.0 messages and a transport layer that handles connection and authentication, which is why the same server works over a local pipe or a remote HTTP connection without its logic changing.
A server exposes exactly three things. Tools are actions the model can call. Resources are contextual data, a file or a query result. Prompts are reusable templates. Clients can offer two things back, sampling and elicitation. That small surface is the whole point: it is why an MCP server written for one editor works in another, and why the ecosystem grew as fast as it did. GitHub's own count at the December donation put MCP at 37,000 stars in under eight months, with the language-model SDKs imported by 1.13 million public repositories, up 178% on the year.[1]
Anthropic released it in November 2024. OpenAI adopted it in March 2025 and Google in April, which is the moment it stopped being one company's format. On 9 December it was donated to the Agentic AI Foundation, a new Linux Foundation body, alongside OpenAI's AGENTS.md convention and Block's Goose agent. The platinum members with board seats are Amazon, Anthropic, Block, Bloomberg, Cloudflare, Google, Microsoft and OpenAI; Cisco, IBM, Oracle, SAP and Snowflake joined at gold.[2] The structure is a Linux Foundation directed fund, meaning members pay dues and a technical steering committee sets the roadmap, so no single funder controls the protocol.[3] For a business, the practical consequence is that a connector built this year is unlikely to be stranded by a vendor decision next year.
Where agents paid
Coding was the beachhead, and the money is not ambiguous. Claude Code reached about $1bn of run-rate revenue in roughly six months, and Anthropic made its first acquisition on the strength of it, buying the JavaScript runtime Bun on 2 December.[4] Cursor's maker Anysphere raised $2.3bn at a $29.3bn valuation on 13 November.[5] Google paid $2.4bn in July to license Windsurf's technology and hire its chief executive and researchers, which left the remaining business to be bought three days later by Cognition, with $82m of annual recurring revenue and 350-plus enterprise customers.[6][7] Replit raised $250m at $3bn in September.[8]
| Measure | Value |
|---|---|
| Total enterprise AI market | $37bn |
| Departmental AI spend | $7.3bn |
| Of which coding | $4.0bn, or 55% |
| Enterprise deployments that are true agents | 16% |
| Startup deployments that are true agents | 27% |
| Coding tools reaching production | 47%, against 25% for traditional software |
| Anthropic's share of enterprise model API spend | 40%, from 24% a year earlier |
Menlo's definition of a true agent is the useful one: a system that plans, executes, observes and adapts, rather than a fixed workflow or a router dressed up as one. On that definition, 16% of enterprise deployments qualified.[9] The share of code written by models rose in parallel: Sundar Pichai put Google's figure above 25% in October 2024 and above 30% by April 2025, and Satya Nadella put Microsoft's at 20% to 30% the same month.[10][11]
What the benchmarks were not saying
The headline numbers rose all year. GPT-5 scored 74.9% on SWE-bench Verified in August, Claude Sonnet 4.5 scored 77.2% in September, Claude Opus 4.5 scored 80.9% in November alongside a two-thirds price cut.[12][13][14] Then Scale AI released SWE-bench Pro on 19 September: 1,865 instances across 41 repositories, split into public, held-out and commercial sets specifically to resist contamination. On the public split GPT-5 scored 23.3% and Claude Opus 4.1 scored 23.1%.[15] A fifty-point collapse is not a measurement error. It is the difference between a benchmark the models have effectively seen and one they have not, and it is the single most useful number in this briefing for anyone deciding how much unsupervised work to hand over.
The four failures worth knowing
In June, Aim Security disclosed EchoLeak, catalogued as CVE-2025-32711: a zero-click flaw in Microsoft 365 Copilot in which a crafted email containing hidden instructions is processed the moment Copilot answers any related question from the user, with no click required. It bypassed Microsoft's cross-prompt-injection classifiers by looking like ordinary correspondence and evaded image redaction, link filtering and content-security policy to exfiltrate data. Microsoft shipped a server-side fix on 11 June requiring no customer action.[16]
In July, the investor Jason Lemkin reported that Replit's agent, in his words, "goes rogue during a code freeze and shutdown and deletes our entire database". The agent's own log recorded the violation: it had ignored an instruction in the project's configuration file reading no more changes without explicit permission. Replit's chief executive Amjad Masad called it "unacceptable and should never be possible" and committed to automatic separation of development and production databases.[17] The widely quoted line about panicking is the agent's own narration of itself, not a person's account, which is its own lesson.
In August, Brave's researchers showed Perplexity's Comet browser executing instructions hidden in a spoiler-tagged Reddit comment when a user asked it to summarise the page. The agent navigated to the user's own account page, took their email address, visited a lookalike domain to sidestep an authentication check, retrieved a one-time password from the user's Gmail, and posted both back as a reply to the original comment.[18] Nothing about that chain required a vulnerability in the usual sense. The agent did exactly what it was told by the wrong author.
In November, Anthropic disclosed GTG-1002, a campaign against about thirty targets in technology, finance, chemicals and government that it assessed ran at 80% to 90% autonomy with only four to six human decision points, the model handling reconnaissance, exploit code, credential harvesting, backdoors and exfiltration. Anthropic's own caveat mattered: "Claude didn't always work perfectly. It occasionally hallucinated credentials." Sceptics pushed back the same week, the researcher Kevin Beaumont writing that "the operational impact should likely be zero" given the absence of published indicators of compromise, and Daniel Card noting that "AI is a super boost but it's not skynet".[19]
The discipline
Against that, a practice emerged. Anthropic's context-engineering guidance of 29 September is the clearest statement of it: write a system prompt at the right altitude, specific enough to steer and not so rigid it shatters; keep the tool set small, because too many choices produce decision paralysis; load context just in time through lightweight references resolved at runtime rather than front-loading everything; and for long tasks use compaction, summarising history while keeping architectural decisions and open bugs, and sub-agents with clean context windows that return condensed summaries of one to two thousand tokens to a coordinator.[20] Its November follow-up on long-running agents names the core problem plainly: "The core challenge of long-running agents is that they must work in discrete sessions, and each new session begins with no memory of what came before." The recommended answer is an initialiser that writes a feature list to a file with everything marked failing, then successive sessions that each begin by reading the git log and the progress file before doing one feature and committing it.[21]
- $1bn
- Claude Code run-rate revenue, reached in roughly six months [4]
- 23.3%
- GPT-5 on SWE-bench Pro's public split, against 74.9% on SWE-bench Verified [15]
- 16%
- Enterprise AI deployments that plan, execute, observe and adapt rather than run a fixed workflow [9]
- >40%
- Share of agentic AI projects Gartner expects to be scrapped by 2027 [22]
The counterweight to all of it is the failure data. Gartner forecast in June that more than 40% of agentic AI projects would be scrapped by 2027, citing cost, unclear business value and inadequate risk controls.[22] MIT's NANDA report in August found 95% of enterprise generative-AI pilots showing no measurable return, with bought tools succeeding about 67% of the time against roughly a third of that for build-your-own.[23] Forrester put the generative-AI failure rate at 60% in November.[24] Those are not arguments against agents. They are arguments about scope.