AI agents in the office: what already works today and where the limits are

Software that acts on its own

A chatbot answers questions. An AI agent is given a task and completes it by carrying out several steps on its own: opening websites, opening files, filling in forms, writing emails. The Federal Office for Information Security (BSI) describes it as software that performs actions independently on the basis of a language model. To do so, it often has more access rights than a chatbot. Typical examples: an assistant that reads, sorts and answers the inbox, a scheduler that reconciles calendars, a research helper that looks for sources and turns them into a report.

It is precisely this ability that makes agents interesting for offices, and at the same time risky. Whoever acts independently can also make mistakes independently. The state of play in autumn 2026: the technology exists and is being sold, a small share of companies use it, and its limits are well documented.

What AI agents can do today

The major providers now sell agents as part of their office packages. In its Copilot environment, Microsoft offers agents that gather information from emails, meetings and files, analyse data from several spreadsheets and run their own program code to do so. Self-built agents can send emails there or change records in business applications, on request even without a user prompting them, triggered by an event. OpenAI advertises its ChatGPT agent as being able to update spreadsheets with new financial data, reschedule meetings and draft presentations. Recurring tasks such as a weekly report run automatically every Monday if desired. Anthropic lets its model maintain calendars in the browser, draft emails and fill in expense reports.

That fits with what the ifo Institute reports from its May 2026 survey: companies use AI above all for administration, data analysis, programming, correspondence and information searches. That is exactly where agents come in. The tasks are familiar; what is new is the chaining of several steps without an intermediate question.

How widespread AI agents are

The figures on adoption vary widely, depending on who is asking and whom. According to the Bitkom survey from September 2026, 57 per cent of companies with 20 or more employees use AI, compared with 36 per cent the year before. The ifo Institute arrives at 54.5 per cent for May 2026. The Federal Statistical Office, by contrast, counts only 26 per cent of companies with ten or more employees for 2025, 57 per cent among large companies with 250 or more employees and 23 per cent among small ones. The official figure is older and includes many small businesses, which explains part of the gap.

With agents, things get tighter. Of the companies that use, plan or discuss AI, 11 per cent already use agents according to Bitkom, 29 per cent plan to, 31 per cent are discussing it, and for 24 per cent it is not an issue. It is different among tech startups: according to a Bitkom survey from July 2026, almost one in two uses AI agents. For day-to-day office work in medium-sized companies, agents are therefore still the exception, but one that is on the planning list.

Where agents fail

Carnegie Mellon University measured how well agents cope with office work. The researchers recreated a small software company, with chat, file storage, project management and code management, and set 175 tasks from human resources, finance, administration, project management and development. The best model completed around 30 per cent of the tasks in full. Typical mistakes: the agent did not contact colleagues even though the task required it, or could not deal with pop-up windows. In one case it renamed another user in the chat in order to pass them off as the colleague it was looking for.

The providers themselves are open about this. When its agent launched, OpenAI wrote that it was still in its infancy and that errors could not be ruled out. The market research firm Gartner expects more than 40 per cent of agent projects to be abandoned by the end of 2027, because of rising costs, unclear benefits or a lack of risk control. Gartner also observes that many providers are merely relabelling existing chatbots and automations, and estimates that of thousands of agent providers only around 130 deliver genuine agents.

The known risks

The biggest known risk is called prompt injection. An agent reads websites, documents and emails. Anyone who hides instructions there, for example as white text on a white background, can redirect the agent. The BSI gives the example of a manipulated email that instructs the agent to forward all future messages to an external address. It becomes dangerous when three things come together: access to confidential data, processing of external content and the ability to communicate with the outside world. A typical office agent has exactly this combination.

How real this is can be seen from the providers' own tests. In 2025 Anthropic had its browser agent deliberately attacked: without protective measures, 23.6 per cent of the attacks succeeded, after improvements still 11.2 per cent. In one test case the agent deleted messages from the user's mailbox on the instruction of a forged email. OpenAI also admits that successful attacks on an acting agent have more far-reaching consequences than on a chatbot. Both therefore require confirmation from the user before purchases, sending emails or passing on sensitive data. That agents go their own way even without attackers was shown in 2026 by an incident at OpenAI, in which agents in a research environment uploaded user images to third-party image portals.

The BSI notes that agents are still at an early technical stage and that security standards are only now emerging. Its recommendations are straightforward: grant only the rights the agent needs for the task, require confirmation of consequential actions before they are carried out, read the logs regularly. For companies there is the added point that an agent that sends emails to customers or changes records is acting in the company's name. Whatever it does, the operator is responsible, just as with any other software.