AI agents surge in capability but lack safety disclosures, MIT AI Agent Index reveals

AI Agents Advance Without Adequate Safety Frameworks

AI agents are rapidly transforming how we interact with technology, capable of planning complex tasks, writing code, browsing the web, and executing multistep workflows with minimal human supervision. Yet a comprehensive analysis by MIT CSAIL reveals a stark disconnect between their growing capabilities and the transparency around their safety. The 2025 AI Agent Index, which examined 30 deployed agentic AI systems across 1,350 data points, found that only 19% disclose formal safety policies, and fewer than 10% report external safety evaluations 1

1

4

4

. This lack of transparency becomes particularly concerning as these systems move from prototypes to digital actors integrated into real workflows involving sensitive data and meaningful control.

The researchers were deliberate about defining what qualifies as an AI agent. To be included in the AI Agent Index, systems had to operate with underspecified objectives, pursue goals over time, and take actions affecting an environment with limited human mediation 1

1

. These are not simple chatbots that merely respond to prompts. Instead, they decide on intermediate steps themselves, breaking broad instructions into subtasks, using tools, and iterating through complex processes. That autonomy makes them powerful but also raises significant stakes.

Three Categories Dominate the AI Agent Landscape

The MIT study identified three primary categories of AI agents currently deployed. Enterprise workflow agents, representing 13 of the 30 systems covered, are platforms with agentic features designed for workflow automation across business functions like HR, sales, support, and IT. Examples include Microsoft 365 Copilot and ServiceNow Agent 2

2

. Chat applications with agentic tools comprise 12 systems, primarily featuring chat interfaces with extensive tool access, including general-purpose coding agents like Claude Code and agents embedded in broader products such as Manus AI and ChatGPT Agent.

Browser-based agents, accounting for five systems, distinguish themselves through their primary interface of browser or computer use with extensive interaction capabilities. Unlike chat agents with simple web search that primarily perform retrieval and summarization, browser agents present higher risks through background execution, event triggers, and direct transactions 2

2

. Examples include Perplexity Comet, ChatGPT Atlas, and ByteDance Agent TARS. Delaware-incorporated companies created 13 of the evaluated agents, while five originated from China-incorporated organizations, and four came from non-US, non-China origins including Germany, Norway, and Cayman Islands 4

4

.

The Most Striking Pattern: Capability Over Safety

Developers prove comfortable sharing demos, benchmarks, and usability features of these AI agents, but remain far less consistent about sharing safety evaluations, internal testing procedures, or third-party risk audits 1

1

. Of the 13 agents exhibiting frontier levels of autonomy, only four disclose any agentic safety evaluations: ChatGPT Agent, OpenAI Codex, Claude Code, and Gemini 2.5 Computer Use 4

4

. Developers of 25 of the 30 agents provide no details about safety testing, and 23 offer no third-party testing data.

This imbalance matters more as agents transition from experimental tools to systems with real-world consequences. When a model simply generates text, its failures are typically contained to that single output. But when an AI agent can access files, send emails, make purchases, or modify documents, mistakes and exploits can propagate across multiple steps with damaging results 1

1

. Many indexed systems operate in domains like software engineering and computer use—environments that routinely involve sensitive data and significant control.

Privacy and Security Concerns Mount Amid Limited Oversight

The governance challenges documented in the study extend beyond missing safety disclosures to fundamental questions of control and accountability. Most agents do not disclose their AI nature to end users or third parties by default, meaning there's often no way to know whether you're dealing with a human or a bot 5

5

. This includes failures to implement watermarking for generated content or respond to websites' robots.txt files that signal no consent to scraping. The tendency of AI agents to ignore the Robot Exclusion Protocol suggests established web protocols may no longer suffice to control agent behavior 4

4

.

Even more troubling, some systems offer no documented way to stop an agent from running. Alibaba's MobileAgent, HubSpot's Breeze, IBM's watsonx, and automations created by n8n lack documented stop options despite autonomous execution 5

5

. For enterprise platforms, sometimes the only option is to stop all agents or retract deployment entirely. Twelve out of 30 agents provide no usage monitoring or only notices once users reach rate limits, making it impossible to track how much compute resources these systems consume—a critical concern for organizations managing budgets.

Autonomy Levels Vary Dramatically Across Systems

The study found that levels of autonomy vary considerably across different agent types. Chat-first assistants like Anthropic Claude, Google Gemini, and OpenAI ChatGPT maintain the lowest autonomy levels, operating through turn-based interactions where they execute a single set of actions and wait for the next user prompt 2

2

. On the higher end, browser agents like Perplexity's Comet offer limited opportunities for mid-execution intervention, performing tasks autonomously once prompted with users unable to easily intervene until completion.

Enterprise platforms present a split picture when it comes to agent autonomy. During the design phase, users manually configure triggers, actions, and guardrails using visual canvases, though some offer AI assistance with this process. Once deployed, these agents often operate at higher autonomy levels, triggered by events like new emails or database changes without human involvement during actual task execution 2

2

. Such agents include Glean, Google Gemini Enterprise, IBM watsonx, Microsoft 365 Copilot, n8n, and OpenAI AgentKit.

The Reality Check: Productivity Gains Remain Elusive

Despite the hype surrounding AI agents, the productivity gains promised by these systems have yet to materialize consistently. Large language models power AI agents just as they do chatbots and most mainstream AI products, but the implementation differs significantly. While an AI chatbot takes in questions and responds with answers, an AI agent takes in instructions and responds by following them—though without consciousness or true intelligence .

The core issue is that AI agents struggle to deliver on their fundamental promise. Agents operating in web browsers often cannot solve CAPTCHAs, fail to navigate sites properly, or routinely get stuck on certain steps, making them more frustrating than convenient. Even when they work, they usually don't save time, typically taking longer than humans would for the same tasks while still requiring significant human supervision . Users might need to click pop-up ads that agents cannot close or input passwords needed to proceed. If adding groceries to an online cart takes only a few minutes manually, an agent doing it in twice the time while requiring monitoring offers questionable value.

Market Concentration and Dependency Risks

The AI agent ecosystem reveals troubling concentration among a handful of providers. Most agents function as harnesses or wrappers for foundation models made by Anthropic, Google, and OpenAI, supported by scaffolding and orchestration layers 4

4

. This creates a series of dependencies that prove difficult to evaluate because no single entity bears complete responsibility for the system's behavior. Twenty-three of the evaluated agents are closed-source, while only seven developers open-sourced their agent framework or harness.

Among the five Chinese-incorporated agent makers, one has a published safety framework and one has a compliance standard. For agents originating outside China, 15 point to safety frameworks like Anthropic's Responsible Scaling Policy, OpenAI's Preparedness Framework, or Microsoft's Responsible AI Standard, while ten lack safety framework documentation entirely 4

4

. Enterprise assurance standards prove more common, with only five of 30 agents having no compliance standards documented.

What This Means for the Future of Agentic AI

The researchers expect these governance challenges—including ecosystem fragmentation, tensions over web conduct, and absence of agent-specific evaluations—to gain importance as agentic capabilities increase 5

5

. According to consultancy McKinsey, AI agents have the potential to add $2.9 trillion to the US economy by 2030, though enterprises aren't yet seeing substantial returns on their AI investments 5

5

.

The MIT AI Agent Index does not claim that agentic AI is universally unsafe, but it demonstrates that as autonomy increases, structured transparency about AI agent safety has not kept pace 1

1

. The technology accelerates while the guardrails remain harder to see. For organizations considering deployment, the absence of clear regulation and accountability frameworks means they must conduct their own rigorous assessments of risks versus benefits. As these systems become more integrated into workflows handling sensitive data, the need for standardized disclosure practices and robust safety protocols becomes increasingly urgent.