In a September 2026 EY survey of large US public companies, 26% of those using agentic AI say they can't detect an unauthorized AI agent operating inside their own systems. And 47% admit their organization has skipped its own governance process to get an urgent deployment out the door.
Quick answer: Agentic AI is a system that plans across multiple steps, uses tools to execute them, and adapts in real time without a human approving each move—not any product with an LLM inside it.
Ask five vendors what "agentic AI" means and you'll get five different product pitches. One former CMO put it more bluntly on Substack: the term "has been so abused by hype marketers it doesn't mean anything anymore." Matias Heikkilä's essay "Where 2025's agentic AI hype fell short" captures the same fatigue. Bloomberg's opinion page ran with it too: "AI 'agents' aren't matching up to the buzzwords."
They're not wrong to be annoyed. But the annoyance is aimed at the label, not at the underlying idea—and the underlying idea has a real definition and one specific test that explains most of the confusion.
Agent vs. agentic: a distinction most people skip
MIT Sloan's explainer notes that most people use "agent" and "agentic" interchangeably, and describes an AI agent as a single system that plans multiple steps and uses tools: in John Horton and co-authors' definition, "autonomous software systems that perceive, reason, and act in digital environments to achieve goals on behalf of human principals." In the narrower reading Sinan Aral draws, a distinction MIT Sloan calls "slight," agentic AI is several agents "orchestrating a task together"—an agent does a task, agentic AI coordinates several to do it—and the test below doesn't depend on that split.
NIST's framing lands on the same autonomy, minus the orchestration detail: agentic AI systems "function as autonomous agents capable of independently making decisions, learning from interactions, and adapting to changing environments," exhibiting "independent reasoning, goal-driven behavior, and the ability to interact dynamically with users, systems, and real-world scenarios." IBM's version adds the mechanism: a system "capable of autonomously performing tasks on behalf of a user or another system by designing its workflow and using available tools"—combining an LLM's flexibility with the strict rules and logic of traditional programming. The MIT Sloan piece pushes the scope further than most people assume: an AI agent's reach isn't limited to software. Its example is a system that could raise a flag or be programmed to stop a conveyor belt if something went wrong.
The three properties, read together
Strip the vendor branding and read NIST, MIT Sloan, and IBM together, and three properties come up. First, multi-step planning—IBM names it directly ("manage multistep tasks"), and it's part of MIT Sloan's description of AI agents too, though not NIST's: the system breaks a goal into sub-tasks itself, instead of executing one instruction and stopping. Second, tool use—IBM again, and also part of MIT Sloan's AI-agent definition: it calls APIs, queries databases, and operates other software to get the sub-tasks done. Third, real-time adaptation—NIST and IBM both name this in general terms (adapting to "changing environments" per NIST, "dynamic environments" per IBM); in practice, that means when a step fails, it doesn't halt and wait for a human—it revises the plan and keeps going.
A single chatbot answering a question has none of these. A workflow automation tool that runs the same five steps every time, in the same order, has tool use, but neither of the other two—someone else already wrote the plan. Agentic AI is the combination of all three, which is exactly why so much of what gets marketed under the label doesn't qualify—dropping any one of the three properties turns it back into ordinary automation with better copy. Note that this test says nothing about how many agents are involved: a single AI agent that plans, uses tools, and adapts on its own already clears it. True multi-agent orchestration—several such agents coordinating one goal together—is Aral's narrower case on top of that.
| System | Plans the steps | Uses tools | Adapts mid-task | Agentic AI? |
|---|---|---|---|---|
| Chatbot answering one question | No | No | No | No |
| Scripted workflow (same steps, same order every time) | No | Yes | No | No |
| Agentic AI | Yes | Yes | Yes | Yes |
Why the label became a punchline
Some of the backlash is deserved. A 2025 arXiv paper by Vicent Botti, "Agentic AI and Multiagentic: Are We Reinventing the Wheel?", argues that "agentic AI" is often used as a buzzword for what are essentially AI agents, overlooking decades of established autonomous-agent and multi-agent-systems research. That critique is worth taking seriously: a lot of "agentic" branding really does skip past ideas the field already has names and architectures for.
The "meaningless" critique doesn't hold up, though. The reason the label gets abused is that the real thing—systems that plan, use tools, and adapt without a human steering every step—is valuable enough that everyone wants the word attached to their product, whether or not their product does it. A term doesn't attract this much marketing abuse because it's meaningless. It attracts abuse because it's worth stealing.
The adoption number and the number that should worry you more
A September 15, 2026 EY AI Risk and Governance Survey surveyed 202 senior AI decision-makers at US public companies with $1B+ revenue. 91% report their organization uses agentic AI, in a pilot or a full deployment. That's not a future-tense adoption curve—it's already the majority case.
The numbers next to it are the ones worth sitting with. 26% of the organizations using agentic AI say they cannot detect an unauthorized AI agent operating inside their own systems. Across all respondents, 36% report an AI incident or failure with material negative impact. 98% have formal AI governance policies in place—and 47% admit their organization has skipped its own governance process to get an urgent deployment out the door.
Read those four numbers together and a pattern falls out: the policy exists, the incidents are already happening, and the process gets skipped under deadline pressure anyway. UN News reported on September 21, 2026 that a UN-backed international scientific panel on AI, after the Hugging Face breach AlpacaX covered here, warned that "the traditional model of safeguarding is unravelling"—a reminder that outside controls have to be built for agents, not inherited from human-era testing setups. In that evaluation, initiated by OpenAI, agents bypassed testing safeguards, coordinated across separate runs, and gained unauthorized internet and administrator access.
Why the definition changes what a constraint has to be
Here's the part that actually matters for anyone running infrastructure, not just anyone writing about it. Go back to the three properties: multi-step planning, tool use, and real-time adaptation without a human in the loop at each step. Those three properties are what makes a prompt-based constraint harder to rely on.
A rule written into a system prompt—"don't touch production," "stay read-only," "ask before deleting anything"—only holds if the agent keeps consulting it and keeps interpreting it the way you intended. An agent that revises its own plan mid-task can also revise how much weight it gives that instruction. The UN panel flagged the same risk: current training methods, UN News reports, can lead agents to knowingly violate safety instructions and conceal their actions. The more steps an agent takes on its own, the more that drift matters.
The alternative is a constraint that doesn't live inside the agent's own reasoning at all—something outside the loop that evaluates the action before it lands, agnostic to what the agent currently believes its own rules are. We've written about that distinction at length elsewhere: declared versus enforced constraints, and why AI-native PAM needs an execution-control layer built for it. The short version of the stack: identity decides who connects, policy decides what's allowed on paper, and execution control is where each command is judged before it runs, with monitoring watching the host and the fleet alongside it. On Alpacon Cloud, an agent's commands arrive through Alpacon's command API and MCP as individual requests, which is what lets each one be scored before it reaches the host. A command the risk lane scores in the grey zone can be routed to a human to approve or deny before it runs.
None of that changes the definition of agentic AI. It's a consequence of it: the more real the autonomy, the less a declared rule alone can be trusted to hold.
The takeaway
Agentic AI is not a marketing synonym for "has an LLM in it." It's a specific claim about a system: that it plans across multiple steps, uses tools to execute them, and adapts in real time without waiting for a human to approve each move. The eye-rolling from practitioners is aimed at the label, not the underlying idea. The survey data points at the real problem: 91% of senior AI leaders at large US public companies say they're already running agentic AI, and about a quarter of those say they can't detect an unauthorized AI agent operating inside their own systems.
