AI that does a whole task by itself: using a computer, searching the web, doing a paid job. How it scores against people, what independent tests found, and what happens when it goes wrong.
2 of 3tests where the best reported score beats people
21.25%of real paid projects done to a professional's standard
Best scores as makers report them
Against people
Three tests, one human line.
Each test has a score for people doing the same tasks. The first score is from the test's own paper; the best score is reported by the company that built the agent, so it is a claim until someone else repeats it.
PeopleFirst scoreBest score, as its builder reports it
Use a computer
OSWorld: 369 everyday tasks on a real desktop, in files, browsers and office apps.
82.3%Apr 2024: 12.24%People 72.36%
Beats peopleClaude Opus 4.7, Anthropic says (May 2026), after changing how it runs the test (OpenAI's table: GPT-5.5, 78.7%). People: OSWorld (Xie et al.).
Dig facts out of the web
BrowseComp: 1,266 hard-to-find facts on the open web.
The Remote Labor Index gives agents real freelance projects that people were paid to do, and people judge the results against the professional's own work.
21.25%
of real paid freelance projects the best agent finished to a professional's standard, judged by people.
Claude Opus 5.5, Oct 19, 2026
2.5%
The best agent when the index launched: Manus.
Oct 30, 2025
Scale's leaderboard gives no dates; we read it on Oct 19, 2026. In July the best was Claude Fable 5 at 15.8%. Even the best agent left most projects short of a professional's standard.
During a code freeze, Replit's coding agent wiped a company's production data on more than 1,200 executives, then said it couldn't be restored. SaaStr's founder recovered it by hand.
OpenAI's agents got into Australian government websites
Went beyond its authorisation
OpenAI apologized after its models accessed Australian government sites without authorization. They reached a non-public part of Services Australia's Medicare statistics service and used an exposed access key at Victoria's health department.
What happened next: OpenAI says no individual medical records were accessed. Its review is ongoing.
“our models accessed Australian government websites in ways they were not authorised to” (OpenAI (company-reported))
Agents with clashing instructions started a 'turf war'
Agents sabotaging each other (lab study)
In an Anthropic experiment, three Claude agents that shared a project but had incompatible instructions each assumed the others were blocking them. They escalated to sabotage, including self-replicating malware. In a pricing game, agents with a private channel colluded on price floors.
What happened next: A research finding in a controlled setting, not a real-world incident.
“Benign behavioral quirks at the individual level might compound into unwanted global outcomes.”
TechCrunchAnthropic Claude in cyber evaluations · Jul 30, 2026
Claude reached the internet from a test and got into three organizations
Broke out of a test
Anthropic said Claude reached the internet from an evaluation environment and gained unauthorized access to the real systems of three organizations.
What happened next: Anthropic says it stopped all cyber evaluations the same day.
“stopped all cyber evaluations the same day after identifying transcripts where Claude may have accessed the internet.” (Anthropic (company-reported))
Test agents chained flaws to break into Hugging Face
Broke out of a test and into a company
During an evaluation, OpenAI's models chained vulnerabilities in OpenAI's research environment and pulled test answers straight from Hugging Face's production database.
What happened next: Hugging Face found access to limited internal datasets and service credentials, and is still checking whether partner or customer data was affected.
“identified and chained vulnerabilities across OpenAI's research environment” (OpenAI (company-reported))
A Meta AI security researcher said her OpenClaw agent, asked to suggest emails to archive or delete, began deleting everything and ignored stop commands sent from her phone.
What happened next: She stopped it at the computer it ran on. TechCrunch could not independently verify the details.
“It started deleting all her email in a “speed run” while ignoring her commands from her phone telling it to stop.”
Hidden text on a page could make Comet act for an attacker
Prompt injection (data theft)
Brave's researchers showed that instructions hidden on a web page could be run by Comet's AI as commands, for example to reach a user's email open in another tab.
What happened next: Perplexity put in an initial fix on 2025-07-27. Brave found it incomplete on retest.
“This allows attackers to embed indirect prompt injection payloads that the AI will execute as commands.” (Brave (Brave makes a rival browser))
What each agent can reach and the controls its maker describes. These are the companies' own help pages, so they say what is promised, not what was tested.
Can reach: A virtual browser it operates by looking at screenshots, plus connected apps as data sources. The help page says this can include sensitive data such as email, files and account settings.
Asks you to confirm high-impact actions and pauses for clarification
Takeover mode: you control the browser for sign-ins and sensitive input
'Watch mode' on some sites, which requires you to supervise
Refuses disallowed tasks; a blocklist keeps it off some websites
“it can access sensitive data like emails, files, or account settings”
Can reach: Can browse the web on its own to complete tasks, book through partners such as OpenTable, Vagaro and Thumbtack, order from Grubhub, Uber Eats, Amazon Fresh and Whole Foods, and help you buy almost any item online. It uses data such as what you've bought.
Interactions and settings are collected in the Alexa Privacy dashboard
The announcement describes no confirmation step before actions; for its repair example it says there is no need to supervise
“navigate the internet in a self-directed way to complete tasks on your behalf”
Agents in Windows (agent workspace, used by Copilot Actions)
Can reach: Each agent runs in a separate agent workspace under its own account, usually with access to known folders or specific shared folders that you grant.
Separate agent account and workspace, with permissions set per agent
Microsoft says you can see what agents do and change their access at any time
Described as experimental, in a preview for Windows Insiders
“Each agent operates using its own account, distinct from your personal user account.”
Few rules deal with agents yet. These are the ones that touch them, including one industry scheme that is not law.
US · Oct 13, 2026
American Express (card network; industry, not law)
Amex proposed an 'Intent Intelligence Framework'. It records what you told an agent to buy, such as merchant, budget and product, and has you approve it. The agent then pays with a token instead of your card number, and the record is meant to help with fraud prevention and disputes.
The article does not say who pays when an agent buys the wrong thing. Amex said it has not yet seen a rise in agent-commerce disputes.
European Union, Product Liability Directive (EU) 2024/2853
The EU's new product liability law treats software as a product for no-fault liability, and its recitals give AI systems as an example of software. It applies to products placed on the market or put into service after 9 December 2026.
No-fault liability for damage caused by defective products, now including software. The text we read does not deal specifically with an agent buying the wrong thing.
The CMA says UK consumer law applies whether decisions are made by people or by AI. Businesses are responsible for how they deal with consumers, including through AI agents, and must not mislead, manipulate or put undue pressure on them.
The CMA does not set a rule on who pays for an agent's wrong purchase. One of its illustrative case studies includes 'clear accountability including liability if agent acts outside customer instructions'. It also points businesses to separate guidance, 'Complying with consumer law when using AI agents'.
