Agentic future: one word, two claims, only one is buildable

Agentic future

Anthropic's Building effective agents, published December 2024, drew the line the term now sits on. In a workflow, code fixes the control flow. In an agent, the model decides what to do next and which tool to call, and keeps going until it decides it is done. That is the whole distinction. Everything else — memory, planning, multi-agent choreography — is implementation detail hanging off those two sentences.

Where the word came from, and when

The word is older than the hype. The current usage compressed into about twelve months.

• March 2024 — Andrew Ng's letter in The Batch popularises "agentic workflow" and names four patterns: reflection, tool use, planning, multi-agent collaboration. His headline number: on HumanEval, GPT-3.5 zero-shot scored 48.1% and GPT-4 zero-shot 67.0%, but GPT-3.5 wrapped in an iterative agent loop reached as high as 95.1%. The loop mattered more than the model.
• October 2024 — Gartner puts agentic AI at number one in its Top Strategic Technology Trends for 2025. The term leaves engineering and enters procurement.
• 25 November 2024 — Anthropic ships the Model Context Protocol, making tool and data access portable across agents instead of bespoke per-integration glue.
• December 2024 — Anthropic's workflow/agent distinction gives the field a definition precise enough to argue with.
• 23 January 2025 — OpenAI ships Operator on its Computer-Using Agent model, which scores 38.1% on OSWorld against a human baseline of 72.4%.
• 19 March 2025 — METR publishes its time-horizon measurement: the length of task a frontier model completes at 50% reliability has roughly doubled every seven months since 2019.

Those last two numbers are the honest frame. The plumbing arrived fast. Reliability on long, messy tasks is improving, and is still nowhere near a competent human on a bad day.

Two meanings. Label them.

"Agentic future" is used for two different claims, and conflating them is how budget gets wasted.

Meaning 1 — the forecast. A projected state of the economy in which AI agents perform a large share of knowledge work. This is the keynote version. It has no delivery date, no falsifier, and no unit of measurement. I have raised $50M and sold into enough boardrooms to recognise a slide when I see one. You cannot build against this.

Meaning 2 — the architecture. A description of how software is being rebuilt: from deterministic pipelines where a human or a cron job triggers each step, to loops where a model picks the next tool call from a set it has been given, under caps the code enforces. This one is checkable. Open the repository. If for step in steps: is in your code, you have a workflow. If the next step comes back from the model, you have an agent.

I write about meaning 2 only. Took Metadata.io from $0 to $15M ARR building marketing automation, hold 6 patents in AI-driven marketing, and am now building a zero-human company on agents that run in production and send me the bill. Meaning 1 does not survive contact with an invoice.

What it is not: an AI workflow

The neighbouring term people reach for is "AI workflow," sometimes labelled "AI automation" or sold as RPA with a model bolted on. An AI workflow calls a model at fixed points in a path somebody else decided. Prompt chaining, routing, parallel fan-out with an aggregator — all workflows.

They are the right answer far more often than anyone selling agents will admit: cheaper, testable, and they fail in ways you can reproduce. Put an agent in that slot and you have bought nondeterminism and a token bill in exchange for a branch you could have written yourself.

It is also not AGI, and it is not a copilot. A copilot waits for a human to approve each move. An agent does not.

A worked example: account research

Take the first thing most GTM teams build. Input: a company domain. Output: three lines in the CRM saying what the company sells, roughly what tier it buys at, and one timing signal.

The workflow version hits the homepage, hits /pricing, regexes for a dollar sign, writes the row. Then pricing moves behind a "Talk to sales" button, which is most of the market, and the row comes back empty every night until someone notices.

The agent version gets four tools — fetch URL, site search, read job postings, write CRM — and a goal. It decides there is no pricing page, checks the careers page instead, finds eleven open sales roles, and writes "enterprise motion, hiring hard." Nobody coded that branch. That is the difference, and that is also the risk: fetched pages are untrusted input, and prompt injection on a page the agent reads is a documented failure mode, not a theoretical one.

Price it before you build it. At Claude Sonnet's published $3 per million input tokens and $15 per million output tokens, a 40-turn run averaging 15,000 input and 1,500 output tokens per turn costs 600,000 input and 60,000 output tokens: $1.80 plus $0.90, so $2.70 per account. Five thousand accounts is $13,500. That is arithmetic on a scenario, not a measurement — your turn count is the variable that decides whether this is viable, which is why I argue for a margin meter before you price anything.

Does it qualify?

Unbounded loops are the most common production failure in agent systems, and the fix is not a better prompt. It is a hard step cap, a wall-clock timeout, and a spend ceiling enforced in the harness, where the model cannot reason its way past them. Task completion gets measured the way SWE-bench Verified measures it — 500 human-validated GitHub issues, pass or fail — not by reading transcripts and feeling good.

Three more tests. Does it have tool scopes narrower than the credentials it runs under? Does it degrade to a safe no-op when a tool returns garbage, rather than inventing the answer? And is a human reading the output, or approving each call — because if it is each call, you have built a very expensive form.

Last one, and it is the one I would hold the line on: spend authority. An agent that can read your CRM, your ad accounts and your data warehouse is useful today. An agent that can move money is a different risk class, and the browser-driving variety that would have to click the buttons is still the weakest link in the stack at 38.1% on OSWorld. Read access first. Write access with a diff and a reviewer. Spend, later, if at all.