71% of Enterprise 'Agents' Are Just Chatbots: The Agent-Washing Reckoning Is Here

Here's a sentence I heard at VB Transform last month that I haven't been able to shake. Bryan Silverthorn, Amazon's Director of Autonomy at AGI, stood on stage and said: "Stop asking if it can do something impressive once. Ask if it can do it correctly 1,000 times in a row."

The room went quiet. Not the polite quiet of a keynote audience checking Slack. The quiet of several hundred people simultaneously realising they couldn't answer that question about their own products.

Silverthorn was describing a gap that everyone in enterprise AI knows exists but few are willing to name publicly: almost nobody is shipping real agents. They're shipping chatbots and calling them agents. And the numbers that dropped in the weeks since VB Transform have turned what felt like an uncomfortable observation into something closer to an indictment.

TL;DR

VentureBeat's latest Pulse survey found that 71% of enterprises admit fewer than a quarter of their deployed "agents" are true multi-step workflows. The rest are chatbots with a better LinkedIn headline. Meanwhile, 88% of organisations have already had an AI agent security incident, only 5% of pilots reach production, and Gartner says roughly 130 of the thousands of vendors calling themselves "agentic" are telling the truth. Agent-washing isn't just embarrassing marketing. It's creating dangerous expectations about what these systems can actually do.

How bad is the labelling problem, actually?

VentureBeat's Pulse survey of 101 enterprises, published 15 July, asked organisations to assess their own portfolios honestly. The result: 71% said a quarter or fewer of their deployed "agents" are true multi-step orchestrated workflows. Nine percent said literally zero. Not one in ten. None. Every single thing they'd labelled an agent was a single-prompt chatbot wrapper.

Only 3% of enterprises reported that more than three-quarters of their agents do genuine multi-step work.

Think about what that means. The industry has spent two years telling boards, customers, and regulators that autonomous AI agents are transforming operations. Conference keynotes overflow with agent demos. Vendor funding rounds announce "agentic platforms" at valuations that assume widespread deployment. And yet when you ask enterprises, anonymously, with no incentive to lie, they tell you that seven out of ten of their so-called agents are basically ChatGPT with a login screen.

I don't think this is a question of technical capability, or not mostly. The models can do the work. Claude, GPT-5.6, Gemini: they're all capable of tool calling, planning, and multi-step execution when they're wired up properly. The problem is that wiring them up properly is hard, and the market incentive to call something an agent long before it deserves the label is enormous.

So we've got agent-washing. Gartner called it out directly: of the thousands of vendors self-describing as "agentic AI," only about 130 are the real thing. The rest are rebranding existing chatbots, RPA bots, and AI assistants, often at a 10x price premium, without adding any substantial agentic capability. Gartner also predicts over 40% of agentic AI projects will be cancelled by the end of 2027, and honestly that number feels low to me given what we're seeing on the ground.

Is this just a branding problem, or is it actually dangerous?

The thing about agent-washing is that it's not just annoying. It's dangerous.

When a business believes it has deployed an autonomous agent, something that plans and executes multi-step tasks and recovers from failures and operates across tools, but actually has a single-turn chatbot, the gap between expectation and reality isn't just disappointing. It creates operational risk. Someone assumes the "agent" is handling something. It isn't. Nobody notices until something breaks.

And things are breaking. Gravitee's State of AI Agent Security 2026 report surveyed 919 executives and practitioners and found that 88% of organisations have already experienced confirmed or suspected AI agent security incidents. In healthcare, it's 92.7%. Only 21% have runtime visibility into what their agents are actually doing. More than half of all deployed agents operate without any security oversight whatsoever.

You start to see how these dots connect. If 71% of "agents" aren't real agents, and 88% of organisations have had security incidents involving agents, and only a fifth can see what their agents are doing, then a lot of those incidents are happening inside systems nobody understood well enough to secure.

What happens when these 'agents' meet the real world?

The reliability picture is just as bleak. VentureBeat's evaluation survey found that half of companies had shipped an agent or LLM feature that passed all internal evaluations and then failed in a customer-facing setting. Only 5% fully trust automated evaluation. And Cisco's Jeetu Patel shared the number that Silverthorn cited at VB Transform: 85% of enterprises are piloting AI agents, but only 5% have reached production.

That's not a pipeline. That's a cliff.

More than a quarter of enterprises (27%) have no real-time way to stop a runaway agent before the bill arrives. 51% want a hybrid control plane by year-end, combining provider-native tooling with their own governance layer. Only 6% are comfortable handing full control to a provider-managed service. These are not the signals of a market that trusts what it has built.

So what actually counts as a real agent?

I'd argue it needs at least five things: multi-step autonomous goal pursuit, dynamic planning that adapts to intermediate results, diverse tool use across different systems, failure recovery that doesn't just give up, and persistent context that survives across interactions. A chatbot that answers "what's my order status?" by calling one API is useful. It is not an agent. Calling it one confuses everyone, including the people budgeting for it.

Where does the fix come from?

There are two ways to read all this data. The pessimistic read: the agent market is a house of cards and most of it will collapse. The optimistic read: the 5% who are doing this properly have an enormous advantage while everyone else is still stuck at the labelling stage.

I lean towards the second read, but with a caveat. The advantage doesn't come from having better models. It comes from having a runtime that enforces what an agent is.

This is where platforms matter. Not platforms in the "we have an AI feature now" sense. Platforms where multi-step orchestration, permissions inheritance, and audit trails are baked into how the thing executes, not bolted on afterwards. You can't agent-wash your way through a governed platform. If the runtime requires your "agent" to actually complete a sequence of actions across multiple systems with full logging and permission checks, there's no clever demo that hides the fact it's just a prompt wrapper. The platform exposes what's real because the platform itself requires the work to be done.

Silverthorn's "1,000 times in a row" test becomes a lot more feasible when the environment you're running in was designed for repeatable execution, not just text generation. When every action leaves an audit trail. When permissions are inherited from the user who triggered the workflow, not from a shared API key that someone hardcoded six months ago and forgot about.

The agent-washing reckoning is already here. The VentureBeat numbers make that pretty clear. What comes next, I suspect, is a sorting: the platforms and vendors who can demonstrate multi-step reliability will pull away from the ones who can't. And the enterprise teams who audit their own portfolios honestly (who are willing to call a chatbot a chatbot) will be the ones who actually get agents into production, because they'll stop wasting time celebrating demos and start solving the hard problems that make demos into systems.

The takeaway

If your "agent" can't survive Silverthorn's test, if you can't answer yes to "does this work correctly 1,000 times in a row?", you don't have an agent. You have a demo. That's fine. Demos are useful. Just don't connect them to production data, don't give them write access to anything, and for God's sake don't put "AI Agent" in the project name until it's earned it.