The State of Agentic AI: H2 2026

What changed since December, and what we had to ask instead

8 questions were asked with identical wording and identical options in December and September. They are shown below, and they are the only basis for trend claims in this report. Because the sample mix shifted, we treat movements of 5 points or more as meaningful.

Trust modes

Autonomy trust

Internal automation

How AI tools are used

Workflows influenced

Motivations

The row most worth quoting: “meet leadership expectations” nearly doubled as a stated motivation, from 13.5% to 25.3%, while the share who fully trust an agent fell 6 points. Leadership is asking for autonomy. The people running agents are asking for guardrails.

Tasks trusted without approval

Vendor switching

Read together, the 8 rows describe a category getting more careful, not more excited. Autonomy is spreading at the edges: the share of teams letting agents act without any approval nearly doubled, and the share gating every action fell 8 points. At the same time, the confident claims softened. Fewer respondents say they fully trust an agent, fewer would trust one to send a customer email, and fewer say they would very likely switch vendors for stronger agentic capabilities. “Meet leadership expectations” nearly doubled as a stated motivation: leadership is asking for autonomy, and the teams running agents are asking for guardrails. Teams that have lived with agents since December are extending them more rope and promising less on their behalf.

The more important change is the one the table cannot show. 5 lines of questioning from December were replaced, because the answers they were designed to produce had become the wrong ones to ask for.

If the survey questions had to change this much between December and September, an annual review would have described a category that no longer existed by the time it published.

PART 1 · AGENT AUTONOMY

Agents are running, and they are making mistakes

54% of respondents say an AI agent did something wrong at their organization in the past 90 days. The most common failure was an agent triggering a workflow the team had to reverse or correct, reported by 31%. A quarter had an agent update the wrong record or data field. 23% had one schedule a conflicting or incorrect meeting, 18% had one send an incorrect or inappropriate email, and 18% had one respond inappropriately to a customer. 42% reported none of these, and 4% weren’t sure.

The incident rate rises with scale. 45% of organizations running 1 to 5 agents reported an incident in the past 90 days, 64% of those running 6 to 20, and 70% of those running more than 20. 36% run 1 to 5, another 36% run 6 to 20, 14% run 21 to 50, and 4% run more than 50. Only 4% run none.

One relationship in the data is worth stating carefully. Teams that require human approval for every agent action report incidents at a slightly higher rate (58%) than teams in an intermediate mode (54%) or teams that let agents act freely (52%). The difference is small and the direction could be selection: teams that have been burned may add gates afterward. What it does not show is approval gates preventing errors. It is at least as likely that a review step is where errors get noticed. The flip side is that teams with fewer checkpoints may have incidents slipping by in the background, uncounted.

By September 2026, the category had moved past pilots and roadmaps to incident logs.

Trust is graduated, and it moved

Asked how they build trust with their AI tools today, 59% of respondents describe an intermediate mode in which read operations are auto-approved and write operations require a human. 30% require approval for every action. 7.5% run what the survey calls YOLO mode, where agents act without approval, up from 4.2% in December. 4% use no trust model at all.

The tasks respondents would let an agent do without a sign-off follow a clear line between internal and external consequences. 66% would let an agent send internal reminders unsupervised. 58% would let it create tickets or tasks, 56% schedule meetings, and 46% update internal records. The number drops to 44% for sending customer emails and to 27% for changing system settings. 3% would not trust an agent with any of these.

The risks people name explain the line. Asked the single biggest risk of giving an agent access to a person’s email, 35% chose exposure of PII or confidential information and 30% chose the agent sending something incorrect or unauthorized. Prompt injection was named by 14%, loss of an audit trail by 11%. 8% said none of these concerned them.

One caution on the trust figures. 32% of respondents say they fully trust an agent to run autonomously, yet 136 of those same respondents also say every action requires human approval. Stated trust and configured trust are different measurements. Throughout this report, the trust-mode question is treated as the description of what teams actually do.

PART 2 · AGENT SECURITY AND IDENTITY

Can you prove what your agents did?

53% of respondents say their team can produce a full audit log of what their AI agents did last week and identify which agent took which action. 37% can do so partially. 4% cannot, and 6% do not audit agent activity at all.

Auditability varies with how the agent gets into systems in the first place. Among teams whose agents authenticate with a dedicated identity of their own, 66% report full audit capability. Among teams whose agents use API credentials with no communications identity, 62% do. The figure falls to 53% for dedicated service accounts, 52% for shared team inboxes, and 51% where the agent operates through OAuth on a human employee’s account. Where an agent acts as a person, the log shows the person.

This is consistent with how respondents rank what matters to their agentic AI strategy. Security and access controls rank first, with a mean score of 4.76 on a 7-item ranking, followed by reliability and failure handling (4.46), ease of integration (4.17), and compliance readiness (3.98). Observability and debugging (3.68) and cost (3.67) sit in the middle. Native access to communications data such as email, calendar, and messaging ranks last at 3.29.

Communications data access is the item closest to what Nylas sells, and it ranked last. We are publishing the ranking as it came back. The ranking measures what respondents consider strategic, and access to communications data reads to most of them as a given rather than a decision. The audit numbers above suggest it is a decision. How an agent authenticates to a mailbox determines whether anyone can later say what it did there.

How agents get access to email and calendar

There is no standard yet for how an agent authenticates to a mailbox or a calendar. 26% of respondents say the agent has its own dedicated identity with an email address and calendar. 21% use a dedicated service account. 14% use API credentials with no communications identity. 12% route the agent through a shared team inbox, and 11% through OAuth on a human employee’s account. 8% say no agent has this access yet, and 7% said not applicable or weren’t sure.

Put differently, at roughly 1 in 4 organizations, agents operate under credentials that belong to a person or a group of people. For those teams the audit gap described earlier is a design consequence, not an oversight.

Among the 551 respondents whose organizations have not given agents a dedicated identity, the blocker is clear. 56% cite security review. 37% cite technical complexity, 22% see no clear use case, 17% worry about vendor lock-in, and 15% had not considered it. 16% say nothing has stopped them.

PART 3 · ADOPTION AND BUYING DECISIONS

Where agents work

Agent activity remains weighted toward internal operations. Asked which workflows they have seen agentic AI influence, 75% of respondents named IT and internal operations. Customer support followed at 54%, sales workflows at 51%, and project and delivery management at 48%. Meeting follow-ups and documentation follow at 44%. Finance and reporting (33%) and recruiting and HR (27%) trail.

Where agents face customers, email is the dominant channel. Among the 813 respondents asked about customer-facing channels, 78% named email, 74% chat, 44% SMS, and 38% phone. 7% said none yet.

Those customer-facing agents are split on whether the customer can tell. Of 756 respondents with a customer-facing agent, 39% say it has its own visible identity, such as its own email address. 26% say it acts invisibly through a human employee’s account, and 32% describe a mix of both.

Asked where an agent identity would be most valuable, respondents chose internal operations and reporting (48%) and customer support (41%) ahead of meeting scheduling (34%), executive or administrative assistance (32%), and sales outreach (25%).

What buyers want, and what is in the way

Asked what matters most when choosing an agentic AI platform or API, with up to 4 selections, respondents put reliability first at 65% and security controls second at 61%. Performance followed at 50%, ease of integration at 46%, and cost at 41%. Compliance readiness (32%), observability or debugging (27%), integration coverage (27%), and vendor roadmap or support (14%) rounded out the list.

The blockers are the same 2 themes seen from the other side. Security approvals (42%) and integration complexity (40%) lead the list of what is preventing implementation today, followed by organizational hesitation (28%), unclear ROI (25%), and engineering bandwidth (24%). Capacity to build is no longer the main constraint; approvals and integration are. Fear of vendor lock-in was named by 15% and lack of a strong use case by 13%. A new option this wave, “Nothing, we aren’t blocked,” was chosen by 23%.

Motivations are practical. Improving response time and speed leads at 67%, then improving data quality across systems at 56% and reducing manual work at 53%. Reducing costs was named by 40%. Launching differentiated features (26%) and meeting leadership expectations (25%) are nearly tied.

The vendor question

Agents have become a reason to leave a vendor. 67% of respondents are considering replacing a vendor or tool with an AI agent: 26% say they are considering replacing many, and 41% say 1 or 2. 17% say they extend existing tools instead, 11% have no plans, and 5% weren’t sure. Separately, 81% have already replaced at least one vendor or tool with in-house tooling, and 32% have replaced 6 or more; that question did not ask whether the replacement was an agent.

Asked whether stronger agentic AI capabilities would persuade them to switch tools or vendors, 38% say they are very likely to switch and 55% say they would possibly switch, which signals openness rather than intent. Among those open to it, reliability is the leading reason to switch (23%), followed by security and compliance (21%) and better integrations (19%). Lower cost (13%) and more autonomy (10%) trail. Better UX (8%) and vendor trust and support (6%) barely register.

The “very likely” share is 8 points lower than in December, and we would rather report that than combine the 2 positive answers into a single figure. The willingness to switch is broad. The urgency has cooled.

Roadmap and strategy

Among the 924 respondents who are involved in product or AI strategy at their company, 68% say agentic AI is on the product roadmap and 29% say it is under consideration. 3% say no. Asked how important it is to overall product strategy, 21% say critical and 59% say very important; 17% say somewhat, and 4% say low priority or not relevant.

On timing, a third of respondents say agentic AI has already become a baseline expectation in their market. 37% expect it within 12 months, 21% within 2 to 3 years, and 4% within 5 to 10 years. 5% do not expect it to reach that point. As individuals, 42% describe themselves as actively building agentic AI, 35% as evaluating it seriously, and 17% as experimenting informally; 6% are watching, skeptical, or not interested.

The “already” option is new this wave, so the timing figures are not comparable to December’s. In this wave, 95% of respondents expect agentic AI to become a baseline expectation in their market at some point; only 5% say it never will. The disagreement is only about when.

Conclusion

The category has moved from “will this work” to “what do we do when it doesn’t.” More than half of the organizations in this survey have already answered that question at least once, by reversing a workflow, correcting a record, or apologizing to a customer. About half can fully audit what their agents did. 7.5% trust their agents enough to skip the approval step entirely, up from 4.2% in December.

Extending autonomy safely depends on being able to answer 3 questions about any agent: who it acted as, what it did, and under which approval rule. Those answers depend on infrastructure choices made before the agent ever sends an email, and the audit figures in this report suggest many teams have not yet made them deliberately.

The next check-in fields in early 2027. The questions will change again.

NYLAS AGENT ACCOUNTS

Give every agent an identity of its own

Half of this report is about one gap: agents are running, and teams cannot always say which agent did what, or whose credentials it used. At 1 in 4 organizations, agents act through an employee login or a shared inbox. Where they do, the audit trail shows a person, not the agent.

• 66% of teams whose agents have a dedicated identity can fully audit them, against 51% where agents use an employee’s login and 62% where they use API credentials alone.
• 1 in 4 organizations run agents on borrowed credentials today.
• 56% of teams without a dedicated agent identity say security review is what stopped them.

Nylas Agent Accounts give your AI agents their own email and calendar through a single API: a complete communication identity owned by your software, not borrowed from a person. Each agent gets its own address and calendar, created with one API call, with rate limits, allowlists, and send quotas enforced per account, and Workspaces to group agents under one set of policies. In this survey, teams whose agents have a dedicated identity were the most likely to fully audit what those agents did.

Agent Accounts is generally available. The identity questions in this survey were written before its launch; the reasoning behind them is in the three posts cited in the methodology.

See how Agent Accounts works