In December we asked 1,026 people who build, buy, or influence AI systems a question that seemed urgent at the time: would you trust an agent to act on its own?
Nine months later we went back to 1,030 of their peers with different questions. What did the agent do wrong last quarter? Can you prove what it did last week? Whose credentials is it using?
We changed the questions because the people answering them had changed. In the first survey, most respondents were deciding whether to let an agent act at all. In this one, more than half run six or more agents, and more than half have already cleaned up after one. Asking whether someone would trust an agent stops being useful once the agent is in production and has a track record.
The answers are in The State of Agentic AI: H2 2026, which is live today with no form in front of it. This post is the short version.
The mistakes are already here
54% of respondents say an AI agent did something wrong at their organization in the past 90 days.
The most common failure was an agent triggering a workflow the team had to reverse or correct, reported by 31%. A quarter had an agent update the wrong record. 23% had one schedule a conflicting or incorrect meeting. 18% had one send an incorrect or inappropriate email, and 18% had one respond inappropriately to a customer.
In the past 90 days, what did an agent do wrong at your organization? Multi-select, n=1,028; 4% not sure.
The rate climbs with scale. 45% of organizations running one to five agents reported an incident. Among those running six to 20, it was 64%. Above 20 agents, 70%. That is roughly what you would expect from any system that does more things more often, and it is worth saying plainly because the public conversation about agents is still mostly about what they might do someday. The people in this survey are describing what theirs did in the last quarter.
One finding we are stating carefully: teams that require human approval on every agent action report incidents at a slightly higher rate (58%) than teams in an intermediate mode (54%) or teams that let agents act freely (52%). The gap is small, and the cause could run either way. Teams that have been burned may add gates afterward. A review step is also where errors get noticed, which means teams with fewer checkpoints may have incidents going uncounted. What the data does not show is approval gates preventing errors.
More rope, fewer promises
Eight questions were asked with identical wording in December and September, and they are the only basis for trend claims in the report. Read together, they describe a category getting more careful rather than more excited.
Autonomy is spreading at the edges. The share of teams letting agents act with no human approval nearly doubled, from 4.2% to 7.5%. The share requiring approval on every single action fell eight points, to 30%. Most teams, 59%, sit in the middle, where reads are automatic and writes wait for a person.
How are you building trust with your AI tools today? n=1,030.
At the same time, the confident claims softened. Fewer respondents say they fully trust an agent to run autonomously (31%, down from 37%). Fewer would let one send a customer email without a sign-off (44%, down from 49%). And “meet leadership expectations” nearly doubled as a stated reason for adopting agents, from 13.5% to 25.3%.
Put the two movements side by side and you get the state of the category in one sentence: leadership is asking for autonomy, and the people running the agents are asking for guardrails. Teams that have lived with agents since December are extending them more rope and promising less on their behalf.
Who did it, and can you prove it
If an agent did something wrong at your company last week, could you say which agent, and what it did?
53% of respondents can produce that record in full. 37% can do it partially. 10% either cannot or do not audit agent activity at all.
The number moves with how the agent gets into systems in the first place. There is no standard yet for how an agent authenticates to a mailbox or a calendar. 26% say the agent has a dedicated identity of its own, with its own email address and calendar. 21% use a service account. 14% use API credentials with no communications identity. And at 23% of organizations, the agent operates through a shared team inbox or OAuth on a human employee’s account.
That last group has the audit gap by design. Where agents have a dedicated identity, 66% of teams report full audit capability. Where they use API credentials alone, 62%. Where the agent runs on an employee’s account, 51%. When the agent acts as a person, the log shows the person.
How agents get access, and whether anyone can see what they did. Share using each method against share that can fully audit agent activity, n=1,029.
Among the 551 organizations that have not given agents an identity of their own, the reason is not indifference. 56% cite security review. 37% cite technical complexity. Only 16% say nothing has stopped them.
Security is the gate
Asked what is preventing implementation today, respondents put security approvals first (42%) and integration complexity second (40%). Engineering bandwidth, the constraint everyone assumed a year ago, was named by 24%. Capacity to build is no longer the main thing in the way. Getting through review is.
The same theme shows up from the buyer’s side. Asked what matters most when choosing an agentic AI platform, reliability (65%) and security controls (61%) lead, well ahead of cost (41%). And asked the single biggest risk of giving an agent access to a person’s email, 35% chose exposure of PII or confidential information, with another 30% choosing the agent sending something incorrect or unauthorized. Prompt injection, the risk that gets the most attention in developer circles, was named by 14%.
The buying question
67% of respondents are considering replacing a vendor or tool with an AI agent. 26% say they are considering replacing many. 41% say one or two.
The urgency has cooled since December, and we would rather say so than hide it. 38% say they are very likely to switch tools for stronger agentic capabilities, down eight points. But 93% are at least open to it, and the reasons they give are reliability, security and compliance, and better integrations. Lower cost ranks fifth.
Separately, 81% have already replaced at least one vendor or tool with in-house tooling, and 32% have replaced six or more. That question did not ask whether the replacement was an agent, so we are not claiming it was. It does say something about how willing teams are to build.
What we changed about the survey, and why
This is a standalone snapshot, not a sequel, and the report says so up front. The sample shifted: software and SaaS companies make up 48% of respondents, down from 61% in December, with more consulting firms and more companies over 1,000 employees. Eleven questions are new. Several that carried over were reworded or shown only to people who gave a certain earlier answer.
So the report compares the two waves on exactly eight questions, shown together in one section, and describes everything else as September 2026 on its own. Where an answer set doesn’t add to 100%, the missing option is named. Where a question went to a subset, the base is stated. The methodology section and the FAQ carry the details, including why we report 26% for agent identity when a looser question returned 46%.
The survey now runs twice a year. A category that rewrote its own vocabulary between quarters is not one an annual review could describe.
Three questions to ask about any agent
The report ends where the data points. Extending autonomy safely depends on being able to answer three questions about any agent you run: who it acted as, what it did, and under which approval rule. Those answers come from infrastructure choices made before the agent ever sends an email, and the audit numbers above suggest a lot of teams have not made them deliberately yet.
More than half the organizations in this survey have already had to answer “what do we do when it doesn’t work” at least once. The ones extending the most autonomy are the ones that can say exactly what happened.
Email and Contacts API 
Calendar API & Scheduler 
Notetaker API 
Agent Accounts 
Sales & CRM 
Recruiting & ATS 
Healthcare
Financial
Legal
Real Estate
Education
Field Services
Docs
SDKs
Guides
Integrations
API status
Changelog
Support
Professional Services
