For years, "AI agent" was a demo word. In 2025 and 2026 it became a desktop feature aimed squarely at people who have never opened a terminal. OpenAI launched ChatGPT agent on July 17, 2025, describing a system that operates its own virtual computer to complete multi-step tasks from start to finish (OpenAI, "Introducing ChatGPT agent"; SiliconANGLE, July 17, 2025). Anthropic followed with Claude Cowork, which launched on January 12, 2026 for non-developers and reached general availability on paid plans on April 9, 2026 (VentureBeat; The New Stack). The pitch is no longer "AI can chat." It is "AI can act on your behalf." That changes the job in front of you.

What these desk-level agents actually do

An agent differs from a chatbot in one concrete way: it takes a sequence of actions toward a goal instead of answering one prompt at a time. OpenAI says ChatGPT agent can browse the web visually, use a faster text-based browser for scraping, run code in a terminal, and call external apps through connectors, all on one virtual machine that preserves context across steps (OpenAI; SiliconANGLE, July 17, 2025). In practice that means asking it to research your upcoming meetings and draft a briefing, or download a file, process it, and save it somewhere else.

The audience data is telling. Anthropic reported that in an analysis of 1.2 million anonymized Claude Cowork sessions between May 11 and May 31, 2026, business process and operations was the largest use category at 33.4%, with content creation and copywriting at 16.4%, and said "the vast majority" of usage came from outside engineering teams (VentureBeat, reporting Anthropic figures). In other words, the heaviest users are operations leads, marketers, and analysts, not programmers.

Concretely, today's desk agents are competent at: gathering and summarizing information across many web pages; turning messy inputs like screenshots into structured spreadsheets; drafting documents and first-pass emails; and orchestrating routine multi-app chores such as pulling a file, reformatting it, and filing it. If you want to see where this fits your own stack, our roundup of AI tools maps categories to tasks.

What to delegate, and what to keep

A useful rule: delegate work that is reversible, verifiable, and bounded. Keep work that is irreversible, hard to check, or carries real consequences if it goes wrong.

Good candidates to delegate:

  1. First drafts and research syntheses you will review anyway.
  2. Repetitive data wrangling where the output is easy to spot-check.
  3. Routine scheduling and file operations with low blast radius.

Keep close to yourself:

  1. Final decisions that commit money, legal exposure, or a public statement.
  2. Judgment calls that depend on context the agent cannot see.
  3. Anything where a wrong answer is expensive and a correct-looking answer is hard to distinguish from a wrong one.

Notably, both vendors build this boundary into the product. OpenAI says ChatGPT agent "requests permission before taking actions of consequence," and users can interrupt or take over at any time (OpenAI). Anthropic says Claude asks before high-risk actions like publishing, purchasing, or sharing personal data (Anthropic, "Piloting Claude in Chrome," August 2025). Treat those permission prompts as your job, not an annoyance.

The real limits: reliability, oversight, and security

The hype is running ahead of the reliability. Gartner predicted on June 25, 2025 that over 40% of agentic AI projects will be canceled by the end of 2027, citing escalating costs, unclear business value, and inadequate risk controls; analyst Anushree Verma noted current models lack "the maturity and agency to autonomously achieve complex business goals or follow nuanced instructions over time" (Gartner press release). Gartner also flagged "agent washing," the rebranding of chatbots and RPA as agents. The lesson is not that agents fail, but that unsupervised, poorly scoped agents fail to justify their cost.

The sharper limit is security, specifically prompt injection: malicious instructions hidden inside web pages, emails, or documents that the agent reads as commands. OWASP ranked prompt injection the number-one risk in its 2025 Top 10 for LLM applications. This is not theoretical. During Anthropic's Claude for Chrome pilot, one attack was a malicious email claiming that emails needed to be deleted for security reasons; before new defenses, Claude followed it and deleted the user's emails without confirmation (Anthropic, August 2025).

Vendors are candid that this may never be fully fixed. OpenAI stated in December 2025 that prompt injection, "much like scams and social engineering on the web, is unlikely to ever be fully solved," and called it a long-term challenge (TechCrunch, December 22, 2025). Anthropic's own numbers show the shape of the problem: its Claude for Chrome mitigations cut the attack success rate from 23.6% to 11.2% in autonomous mode in August 2025, and by November 2025 Claude Opus 4.5 reached roughly a 1% success rate under an adaptive attacker given 100 attempts, which Anthropic still described as "meaningful risk" rather than a solved problem (Anthropic). The practical takeaway: never point an agent at untrusted content and irreversible permissions at the same time.

Position your job around supervising agents

If agents absorb routine execution, the durable human value moves to framing, checking, and owning outcomes. That is a role, and it is worth building toward deliberately.

Three moves to make now:

  1. Become the person who scopes agent work well: clear goals, explicit constraints, defined stopping points, and named review gates.
  2. Build verification skill in your domain, so you can catch a confident-but-wrong result faster than the agent can produce it.
  3. Own the permission boundary: decide what an agent may touch, what always needs human sign-off, and keep untrusted inputs away from high-privilege actions.

This is where the human stays indispensable, and Gartner's own framing points the same way: the projects that survive are the ones with governance and clear value, not the ones chasing autonomy. If you want to know whether your specific role is more exposed or more insulated, see job risk by role, take our AI displacement risk diagnosis, and use the results to prioritize the skills to build next.

Agents landing on your desk is not the moment your work disappears. It is the moment your work shifts from doing every step to directing, checking, and standing behind the result. The people who thrive will be the ones who treat supervision as a craft.

Sources & further reading