What agentic marketing actually is, and where it breaks

The definition, and the number that should temper it

OpenAI's Computer-Using Agent, the model behind Operator, scored 38.1% on OSWorld — a benchmark of real tasks on a real computer — against a human baseline of 72.4%. That was state of the art when OpenAI published it in January 2025. Hold that gap next to the definition.

Agentic marketing is marketing work executed by AI systems that choose their own next step — which tool to call, which record to update, whether to retry — inside limits a human sets in advance, instead of following a fixed sequence a human wrote.

Anthropic's engineering team draws the line the same way, and that formulation is the one most widely reused across the field: workflows are systems where LLMs and tools are orchestrated through predefined code paths; agents are systems where LLMs dynamically direct their own processes and tool usage. The difference is not intelligence. It is authorship. You write the path at design time, or the model writes it at runtime.

That is the whole distinction. Everything below is what it costs to be on the second side of it.

Workflow, copilot, agent

Most tools sold as agentic are one of the first two. That is fine. Calling it the third is what wastes a quarter.

A useful test: if you can draw the full flowchart before it runs, it is a workflow. If the number of steps depends on what the model finds, it is an agent. A nurture sequence with an AI-written email in step three is still a nurture sequence.

The five things that have to exist before the label is honest

1. A goal and a termination condition. "Enrich these 500 accounts and stop" is a goal. "Grow pipeline" is a mood. Anthropic's guidance on agent design is explicit that agents need stopping conditions and step limits, because they operate in a loop.
2. Tool access, not just text output. The agent has to be able to call your CRM, your ad API, your warehouse. Anthropic open-sourced the Model Context Protocol on 25 November 2024 — an open protocol for connecting models to external tools and data sources — and that ended most of the argument about bespoke connector code. Google published Agent2Agent (A2A) in April 2025 for the adjacent problem: agents talking to other agents across vendors.
3. State that survives a step. The agent has to remember what it already tried. In practice that is a database or a durable execution engine, not a context window. LangGraph and Temporal both exist because agent runs crash halfway and you need to resume rather than restart.
4. Evaluation of its own output. Something has to check the result before the result becomes a CRM write. A second model call with a rubric, deterministic code, or a human. OpenAI's Agents SDK, shipped 11 March 2025, ships guardrails and tracing as first-class primitives for exactly this reason.
5. An authority boundary enforced outside the model. Spend caps, row limits, and allowed-domain lists that live in code the model cannot rewrite. A prompt that says "never spend more than $500" is not a spend cap. It is a suggestion sitting in the same channel as the attacker's input.

If a vendor cannot point at all five, what you are buying is a workflow with a model in it.

What it actually does in a GTM stack today

Support is the most mature agentic category in GTM, and the reason is unglamorous: the outcome is unambiguous and cheap to verify. Enrichment is where agents have beaten the incumbent architecture outright, because the answer to "does this company run a partner program" was never in a data provider's schema. Outbound is the fraud in the list. The sequence is fixed and the model writes strings.

Ad operations is the category where deterministic guardrails matter most, because the failure is denominated in dollars per minute. A budget agent that is wrong keeps spending while it is wrong, and the paid platforms bill continuously rather than at review time.

Notice the pattern in the pricing pages. When a vendor moves off per-seat to per-resolution, per-credit, or per-conversation, they are telling you the software does units of work now. That shift is a more reliable signal than the word "agent" on the homepage.

The failure modes, and where the fix has to live

Four of them break most production agents. They are documented, general, and boring.

Unbounded loops. An agent that can decide its next step can decide to take the same step forever, especially against a paginated API that keeps returning a next-page token. The fix is a hard step cap, a spend cap, and a wall-clock timeout, all enforced in code outside the model. Not in the system prompt.

Prompt injection. OWASP lists prompt injection as LLM01, the top risk in its Top 10 for LLM applications. It matters more for marketing agents than for chatbots because marketing agents read untrusted text by design: scraped homepages, inbound form fills, review sites, LinkedIn bios. Simon Willison's framing — the "lethal trifecta" of access to private data, exposure to untrusted content, and the ability to communicate externally — describes the average enrichment agent exactly. Your agent reads a prospect's website, holds your CRM credentials, and can send email. That is all three.

Rate limits and quota exhaustion. Platform APIs meter aggressively. Meta's Graph API documents per-app and per-user rate limiting with throttling behavior you have to handle explicitly. A model that retries on failure will retry into a 429 and burn the quota for every other integration sharing that app.

Silent wrong answers. The most expensive one, because nothing alerts. The agent completes, writes 4,000 rows, and 900 of them are confidently wrong. Compounding error across a long chain is the structural reason: a 95%-reliable step is 36% reliable after twenty of them. That is arithmetic, not pessimism. It is also why the 38.1% OSWorld figure matters — long-horizon autonomy is still where the loss is.

The pattern across all four: the fix is never a better prompt. It is a limit in code, a schema validation on write, an allowlist of domains, and a diff a human sees before it hits the system of record.

The cost model stops looking like SaaS

Most people budget agents like software and then get a bill shaped like infrastructure. Run the arithmetic first.

Anthropic publishes Claude Sonnet 4.5 at $3 per million input tokens and $15 per million output tokens. Say an account-research agent runs 40 tool-calling turns, and the growing conversation averages 15,000 input tokens per turn: that is 600,000 input tokens, or $1.80, plus 60,000 output tokens at $0.90. Roughly $2.70 per account. Across 5,000 target accounts, one full refresh is about $13,500 — arithmetic on published rates, not a benchmark.

Swap the model and the same run changes character. OpenAI lists gpt-4o-mini at $0.15 per million input tokens and $0.60 per million output: the same 660,000 tokens lands near $0.13 per account, about $650 for the same 5,000. Twenty times the cost between a good model choice and a lazy one, on identical logic.

Three things follow that most teams learn late. Retries are billed, so a step that fails three times before succeeding costs four times the tokens and your error rate becomes a line item. Context growth is superlinear in cost, because every turn re-sends the accumulated conversation — trimming history or summarizing at turn N is cost control, not code cleanup. And marginal cost is no longer zero, which makes volume a decision again. A per-seat tool does not care whether you enrich 500 accounts or 50,000. An agent does. That changes who has to approve the run.

The org chart changes before the headcount does

Marketing organizations have historically scaled one way: hire people, give them tools, review their output. Agentic stacks invert part of that arrangement, because the work arrives as usage on a bill rather than as output from a person.

Headcount is not the first thing that changes. The job description is. You stop producing the artifact and start specifying the acceptance criteria for it, then reviewing exceptions. Most marketing orgs have never hired for that skill. The person who can write "reject any account where the ICP rationale cites no source URL" is worth more to an agentic stack than the person who writes the best first draft.

The second change is that observability becomes a marketing requirement. If you cannot see the trace of what the agent did — which tools, which inputs, which retries, what it cost — you cannot manage it, and you will learn about problems from your CRM data quality instead of from a dashboard. The tracing features in the OpenAI Agents SDK and in LangGraph are not developer conveniences. They are the audit trail for work that used to have a name attached to it.

What not to do yet

Do not give an agent unsupervised authority over ad spend. Not because the model is bad at bid decisions, but because the blast radius is continuous and the feedback loop is slow. Have it recommend, then have a human approve the diff. A late bid change costs less than an unmonitored weekend of spend.

Do not build the core of a GTM stack on a single vendor's closed agent runtime. MCP and A2A exist precisely so tool access and agent-to-agent messaging are not proprietary. Portability of your tool definitions is worth more than any one vendor's orchestration UI.

Do not let an agent publish to a public channel without review — not the blog, not the ads, not the social accounts. Injection risk and brand risk stack in the same place, and it is the one failure your customers see before you do.

Do not use "agentic" for a scheduled job. If it runs on a cron and does the same eleven steps, that is a workflow with a model in step four. Call it an agent and nobody will know which layer to debug when it breaks.

Five questions that separate an agent from a rebranded workflow

Ask a vendor these, in this order. The disqualifying answers are in the second column.

If the answers hold up, give it one narrow job with a verifiable output, cap it, and read every trace for two weeks. Not a pilot across the funnel.