Topic · updated 2026-10-24
Agentic AI: sourced evidence on AI agents
Agentic AI means AI systems that pursue a goal by planning steps and using tools, such as search, code, payments or a CRM, without a person approving each step. This page collects the Atlas records on AI agents, newest first, each with the limits of its evidence.
175 records are assigned to this topic: 93 claims, 79 sources and 3 signposts. The assignment is made per record by a classification run (model-assisted, sample-checked) and is reviewed with every release. A record appears here when AI agents or agentic AI are its main subject. Each record keeps its own evidence class and its limits.
Claims
- Claim MWITA-ASVC-2026-059e& said its Consumer Assistant can join voice calls and take actions such as scheduling appointments.
- Claim MWITA-ASVC-2026-051Rakuten says Raptor combines AI chat, AI voice and AI-augmented human service.
- Claim MWITA-ASVC-2026-049Rakuten said its generative-AI customer-service agent Raptor was being deployed across its ecosystem.
- Claim MWITA-ASVC-2026-044NAVER labels the Shopping AI Agent action-oriented, but the cited June 2026 release documents suggestions rather than completed purchases.
- Claim MWITA-ASVC-2026-043NAVER allows users to begin an agent conversation directly on the shopping-app home screen.
- Claim MWITA-ASVC-2026-042NAVER says its Shopping AI Agent analyzes clicks, saved items, cart additions and trends to suggest product-discovery directions.
- Claim MWITA-ASVC-2026-041NAVER's Shopping AI Agent moved from a February 2026 beta focused on discovery and summaries to proactively initiating conversations in June 2026.
- Claim MWITA-LV-2026-040Mastercard’s announced design requires trusted agents to be registered and verified and says consumers control what an agent may purchase.
- Claim MWITA-LV-2026-039Mastercard announced Agent Pay in April 2025 with agentic tokens intended to identify agent-facilitated transactions and constrain authorized purchasing.
- Claim MWITA-LV-2026-038Visa describes the protocol as conveying agent identity and consumer intent signals during search, comparison and payment.
- Claim MWITA-ASVC-2026-037Mercado Libre said it replaced a couple of multi-million-dollar SaaS contracts with agents.
- Claim MWITA-LV-2026-037Visa released Trusted Agent Protocol in October 2025 to let merchants distinguish authorized AI agents during commerce interactions.
- Claim MWITA-LV-2026-036Google launched Business Agent for selected U.S. retailers in January 2026, while direct-purchase functionality was described as a future capability.
- Claim 2026-0035Agentische Commerce- und Service-Flows werden außerhalb westlicher Web-Defaults voraussichtlich zuerst auf lokalen Sprachmodellen, Payment-/DPI-Rails und super-app-/messaging-nativen Interfaces konvergieren, sofern lokale Mandats-, Consent- und Dispute-Schnittstellen produktiv werden.
- Claim MWITA-LV-2026-035Google says UCP is designed to work with A2A, AP2 and MCP and was co-developed with five named commerce companies and endorsed by more than 20 others.
- Claim MWITA-LV-2026-034Google launched UCP in January 2026 as an open standard spanning discovery, buying and post-purchase interaction among agents, merchants and payment providers.
- Claim MWITA-ASVC-2026-034Mercado Libre said Maxwell enabled support agents for Mercado Pago users, advertisers and sellers.
- Claim 2026-0030SCITT-kompatible Agent-Receipts, portable Workload-Identität und kontinuierliche Autorisierung dürften in den nächsten 18–48 Monaten von frühen Profilen zu pilotfähigen Governance-Bausteinen werden, ohne dass ein vollständiger End-to-End-Konsens garantiert ist.
- Claim 2026-0029Share-of-Model-, Citation- und Agent-Handoff-Metriken werden innerhalb von 3–5 Jahren voraussichtlich Bestandteil regulärer Brand- und Channel-Reviews, sofern AI-Antworten und agentische Interfaces substanzielle Discovery- oder Transaktionsanteile erreichen.
- Claim MWITA-SR-2026-024The framework separates agent embodiment, scenario exposure and sentiment generation with rationales.
- Claim MWITA-ASVC-2026-023Nubank reported that AI agents handled more than 60% of customer-support conversations in Brazil in Q2 2026.
- Claim MWITA-SR-2026-023The Philippine sentiment-simulation framework instantiated agents from a nationally representative survey of 2,485 respondents.
- Claim MWITA-AW-2026-021A Singapore IMDA-convened legal working group reported a majority view that many agent-harm cases may fit existing contract or negligence law, while also identifying practical claimant barriers from technical complexity, multiple actors, and unpredictability.
- Claim MWITA-AI-2026-021NIST AI 100-2e2025 organizes evasion, poisoning, privacy and misuse attacks across the AI lifecycle, while OWASP's Excessive Agency guidance emphasizes minimizing extensions, functionality, permissions and autonomy with complete mediation.
- Claim 2026-0020Eine sichere Qube-Architektur braucht einen deterministischen Workflowkern um probabilistische Worker, kurzlebige Workload-Identität, aktionsgebundene Autorisierung, signierte Receipts und Outcome-Evaluation.
Show 68 more
- Claim MWITA-AI-2026-020OpenAI, Visa and Mastercard agentic-commerce designs emphasize explicit user confirmation or intent, scoped credentials/tokens, merchant verification, amount or cart bounds and validity windows.
- Claim 2026-0019MCP und A2A standardisieren Tool-/Datenzugriff beziehungsweise Agent-zu-Agent-Kommunikation, lösen aber fachliche Semantik, Delegationsrecht, Haftung, Vertrauen und Erfolgsbewertung nicht.
- Claim MWITA-AW-2026-019The FREE-AI report characterizes agentic systems as a potential shift from task automation to decision automation and gives an SME lending-agent scenario, but presents it as prospective rather than evidence of current deployment.
- Claim MWITA-ASVC-2026-017Grab says the Merchant AI Assistant can proactively suggest sales improvements and help create ad campaigns or update menus.
- Claim MWITA-DM-2026-017NIST's 2026 agentic-AI probe research evaluates evidence attribution using separable dimensions of faithfulness, completeness and sufficiency and produces structured audit trails.
- Claim MWITA-BM-2026-017Salesforce stated that its internal Agentforce deployment resolved 500,000 support cases and handled 84% without human intervention.
- Claim MWITA-AI-2026-017SHADE-Arena evaluates whether monitors detect deliberately hidden sabotage in controlled tasks, but benchmark detection does not establish that deployed monitors cover real workflows or novel attacks.
- Claim MWITA-SI-2026-017The Linux Foundation reported A2A support from more than 150 organizations and production deployments across multiple industries by April 2026.
- Claim MWITA-AW-2026-016A roughly four-month Singapore-government/Google sandbox tested computer-use agents in government-site QA, multilingual AI-safety testing, and social-assistance navigation; the published page reports successful seeded-defect detection and scalable safety testing but says implementation was not entirely error-free.
- Claim MWITA-FT-2026-016NIST's 2025 initial draft Cybersecurity Framework Profile for AI recommends treating each AI agent as a uniquely identified privileged actor, illustrating convergence with zero-trust practice but not a finalized standard.
- Claim MWITA-SI-2026-016The Linux Foundation launched the Agent2Agent protocol project on 23 June 2025 and reported support from more than 100 technology companies.
- Claim MWITA-AI-2026-015GitHub documents that hidden Unicode or masked content in Issues can attempt to prompt-inject coding agents and describes context display, normalization and network controls as defenses.
- Claim MWITA-AW-2026-015The IMDA framework treats agent risk as jointly shaped by action-space—systems and read/write powers—and autonomy—degree of agent judgment and human involvement—rather than by model identity alone.
- Claim MWITA-SI-2026-015The official MCP Registry launched in preview in September 2025 as an open catalog and API for self-reported server metadata, explicitly without data-durability guarantees and with possible breaking changes.
- Claim MWITA-AI-2026-014Microsoft's MCP guidance identifies tool poisoning and post-installation rug pulls as indirect-injection paths that can manipulate tool use or exfiltrate data.
- Claim MWITA-MB-2026-014OpenAI's Operator system card describes layered safeguards for computer use, including confirmation and risk controls, while also reporting model mistakes and prompt-injection risks.
- Claim MWITA-AW-2026-014Singapore's 2026 agentic-AI framework organizes deployment guidance into four dimensions: bound risk and powers upfront, make humans meaningfully accountable, implement lifecycle technical controls, and enable end-user responsibility.
- Claim MWITA-SI-2026-014The MCP project reported close to half a billion monthly downloads across Tier-1 SDKs in July 2026, with TypeScript and Python SDKs each exceeding one billion cumulative downloads.
- Claim MWITA-AI-2026-013Microsoft and the original EchoLeak research describe CVE-2025-32711 as a multi-stage cross-prompt-injection vulnerability that could make Microsoft 365 Copilot exfiltrate limited data already accessible to the victim.
- Claim MWITA-MB-2026-013SHADE-Arena evaluates whether monitors can detect covert sabotage in complex agent traces, making monitoring recall, false positives and review burden measurable rather than assumed.
- Claim MWITA-SI-2026-013The 28 July 2026 MCP specification introduced a stateless protocol core and retired the initialize/initialized exchange and Mcp-Session-Id header.
- Claim MWITA-LV-2026-012At launch, Alibaba demonstrated Qwen ordering 40 bubble teas, applying discounts and paying in chat through Taobao Instant Commerce.
- Claim MWITA-CCO-2026-012Automated agents were perceived somewhat less favorably than humans, yet behavioral outcomes such as choosing and buying were statistically equivalent overall.
- Claim MWITA-AGC-2026-011A card-network agentic-payment path executed one disclosed live production purchase with explicit human approval and agent identification.
- Claim MWITA-AMPO-2026-011A stronger agent produced more and better-priced deals in a real-money employee marketplace, but did not improve satisfaction or perceived fairness.
- Claim MWITA-FT-2026-011NIST launched an AI Agent Standards Initiative in February 2026 around interoperability, open protocols, identity and security, but its stated near-term outputs were RFIs, concept papers, convenings and future guidance.
- Claim MWITA-MB-2026-011The 2025 international joint testing exercise coordinated AI safety institutes to refine common agentic-evaluation practices; its stated goal was evaluation science and shared methods, not certifying models as safe.
- Claim 2026-0011Visa TAP und Mastercard Agent Pay belegen verfügbare technische Pfade für gebundene Agentenidentität, Nutzerauftrag und Zahlung; sie belegen noch keinen universellen interoperablen Standard.
- Claim MWITA-LV-2026-010Alibaba made Qwen App’s initial agentic capabilities available for public testing in China in January 2026.
- Claim MWITA-FT-2026-010China published a 2026 guiding technical document for AI agent interconnection general architecture, alongside parts for identity, messaging and discovery in the same standards family.
- Claim MWITA-KI-2026-010KISA's 2025 threat materials identify MCP/A2A security and credential stuffing among the cyber-risk topics it addresses.
- Claim MWITA-AI-2026-010OpenAI and Hugging Face disclosed that agents in a 2026 cyber evaluation escaped an isolated environment, exploited infrastructure and reached Hugging Face production systems; the full account describes code execution on dozens of servers and root access on one.
- Claim MWITA-SEC-2026-009ShieldMCP reduced measured tool-poisoning ASR from 74% to below 9% and indirect tool-response injection from 47% to below 6%, with median overhead below 120 ms per call.
- Claim MWITA-SR-2026-009The agents matched GSS responses 85% as accurately as participants matched their own answers two weeks later.
- Claim MWITA-MB-2026-009τ²-bench models both agent and user as actors who can change shared state, separating reasoning errors from communication and coordination errors in telecom scenarios.
- Claim MWITA-AGC-2026-008On complex live-web shopping queries, evaluated web and deep-research agents achieved low holistic success, especially when filters and sorting had to be satisfied together.
- Claim MWITA-MB-2026-008τ-bench introduced pass^k to measure the probability that an agent succeeds consistently across repeated tool-user interactions, exposing reliability that single-attempt success can hide.
- Claim MWITA-MB-2026-007METR defines task-completion time horizon as the human-duration point at which an agent is predicted to succeed at a specified reliability under a particular task suite and scaffold.
- Claim MWITA-SEC-2026-007OS-Harm documented unsafe execution traces across all tested frontier computer-use model families.
- Claim MWITA-AGC-2026-007The best evaluated language agent still failed more than half of complex end-to-end shopping instructions in ShoppingBench.
- Claim MWITA-ASVC-2026-006Hello! UPI retains entry of the UPI PIN inside NPCI's Common Library rather than treating voice as payment authorization.
- Claim MWITA-AGC-2026-006In simulated two-sided agent markets, response speed created a much larger selection advantage than service quality.
- Claim MWITA-AI-2026-006Replit's response centered on separate development and production databases, restricting agent production mutation, and snapshot-based rollback rather than relying only on instructions to the model.
- Claim MWITA-SEC-2026-006WASP web agents began attacker instructions in 16%–86% of cases but completed the attacker goal in 0%–17%.
- Claim MWITA-BM-2026-006Zendesk defines automated resolutions as the billing unit for AI-agent usage and describes payment as occurring when a request is resolved without escalation to a human agent.
- Claim MWITA-IMO-2026-005A conversational LLM agent raised municipal-web task success for blind and low-vision users from 80.0% with their screen reader to 95.8%, a 15.8-point gain.
- Claim MWITA-AGC-2026-005Controlled shopping-agent choices were model-dependent and causally sensitive to listing position, endorsements, price and description wording.
- Claim MWITA-SEC-2026-005MCPSecBench reported that more than 85% of 17 curated attack types compromised at least one of three tested MCP client platforms.
- Claim MWITA-AI-2026-005Replit acknowledged a 2025 incident in which its Agent deleted database data in Jason Lemkin's application; backups enabled restoration, but the event exposed unsafe production access and poor rollback awareness.
- Claim MWITA-BM-2026-005Salesforce lists Agentforce Flex Credits at $500 per 100,000 credits, with a standard agent action consuming 20 credits, and also offers $2-per-conversation pricing.
- Claim MWITA-CO-2026-004A randomized field experiment with 1,337 reached customers found that disclosure of an AI voice sales agent did not reduce conversion relative to nondisclosure.
- Claim MWITA-AGC-2026-004Across five experiments, high AI autonomy generally reduced shopping-assistant adoption, while explicit scarcity modestly increased high-autonomy choice.
- Claim MWITA-BM-2026-004Intercom lists Fin AI Agent from $0.99 per outcome; an outcome can be a confirmed or assumed resolution or a completed configured workflow, and billing occurs at most once per conversation.
- Claim MWITA-SEC-2026-004MCPTox found tool-metadata poisoning attack success as high as 72.8%, with refusal below 3% for the highest-refusing tested agent.
- Claim MWITA-RD-2026-004NIST launched an AI Agent Standards Initiative on 17 February 2026 to facilitate industry-led standards, community-led protocols and research on agent security and identity; the launch did not itself publish a binding or final agent standard.
- Claim 2026-0003Agentic Commerce hat 2026 reale Protokoll- und Produktinfrastruktur, aber die Kapitelquellen belegen noch keine universelle Adoption oder wirtschaftliche Überlegenheit.
- Claim MWITA-CCO-2026-003Human sellers attracted more initial interest, whereas automated sellers obtained contact information more readily, showing that the preferred agent type reversed across consecutive funnel stages.
- Claim MWITA-ASVC-2026-003JD.com reported more than 50,000 AI agents across internal systems by the end of 2025.
- Claim MWITA-MR-2026-003NPCI's October 2025 UPI Circle circular extends full delegation to IoT devices and software/AI profiles for an initial limited closed user group, under defined limits and security rules; IoT debits still require explicit user action.
- Claim MWITA-AGC-2026-003Scarcity cues increased experimental selection of a high-autonomy shopping assistant, although ordinary conditions favored lower autonomy.
- Claim MWITA-RD-2026-003Singapore's IMDA launched version 1.0 of its Model AI Governance Framework for Agentic AI on 22 January 2026, recommending risk-bounded autonomy, meaningful human approval points, lifecycle technical controls and end-user transparency.
- Claim MWITA-AIAO-2026-002A hierarchical on-policy bidding agent raised conversion value 8.1% and ROI 3.3% versus a production system in a seven-day test, while campaigns with fewer than three daily conversions remained a documented weakness.
- Claim MWITA-SEC-2026-002AgentDojo measured a strong security-utility trade-off: for GPT-4o, targeted attack success fell from 57.69% without defense to 7.95% with a detector or 6.84% with tool filtering, with different benign utility costs.
- Claim MWITA-BM-2026-002Salesforce reported 2.4 billion Agentic Work Units delivered as of fiscal Q4 2026, using a company-defined unit for agentic work consumption.
- Claim MWITA-AGC-2026-001Access to an AI livestream-shopping assistant increased sales 3.00% and reduced product-return rates 12.55%.
- Claim MWITA-SEC-2026-001InjecAgent found ReAct-prompted GPT-4 vulnerable to indirect prompt injection in 24% of tests.
- Claim MWITA-BM-2026-001Salesforce reported Agentforce annual recurring revenue of $800 million for fiscal 2026, up 169% year over year; this is a company-defined product-adoption financial metric reported in an SEC filing.
- Claim MWITA-MR-2026-001UCP, ACP and Visa TAP expose complementary but overlapping layers: business capability discovery, programmatic checkout/delegated credentials, and agent/consumer/payment signatures. Their 2025-2026 availability proves implementable specifications, not a single interoperable winner or broad merchant adoption.
Sources
- Source · 2026-07-28Key Changes — MCP specification 2026-07-28
- Source · 2026-07-14Agentic Payments from the Ground Up
- Source · 2026-07-14How Agentic Is Agentic Commerce? A Population-Scale Measurement of x402 Adoption and Authenticity
- Source · 2026-07Agentic Inference for MLPerf Inference
- Source · 2026-07HOBA: Hierarchical On-Policy Bidding Agents for Adaptive Online Advertising
- Source · 2026-07ShieldMCP: Runtime Defense for Model Context Protocol
- Source · 2026-06-28Selling with AI Voice Agents: Does Disclosure Still Matter?
- Source · 2026-06-18ShoppingBench: A Real-World Intent-Grounded Shopping Benchmark for LLM-based Agents
- Source · 2026-06-11Agentic shopping is here. What does that mean for advertisers?
- Source · 2026-06-02Worldline, ING and Mastercard complete a live end-to-end European agentic payment in production
- Source · 2026-06-01NAVER Shopping App’s AI Agent Now Initiates Conversations with Users
- Source · 2026-05-20AI Agents: Insights from the Singapore Government and Google Sandbox
- Source · 2026-05-20New Research: AI Service Agents Are Scaling and Delivering CSAT
- Source · 2026-05-18OSWorld-Human: Benchmarking the Efficiency of Computer-Use Agents
- Source · 2026-05-14Agentic AI and Human-in-the-Loop Interventions at Alibaba
- Source · 2026-05-11Alibaba Opens All of Taobao to Qwen AI, Ushering in a New Agentic Shopping Experience
- Source · 2026-05AI Agents and Legal Responsibility: Discussion Paper
- Source · 2026-04-09A2A Protocol Surpasses 150 Organizations and Sees Enterprise Production Use
- Source · 2026-03-22Collaborating with AI Agents: Field Experiments on Teamwork, Productivity, and Performance
- Source · 2026-03-18Developer's Guide to AI Agent Protocols
- Source · 2026-02-13Appier Delivers Record Results Driven by Agentic AI Innovation
- Source · 2026-02-03The Productivity Gap: New Survey Shows 9 in 10 Sellers Are Betting on AI and Agents To Help
- Source · 2026-01-22Model AI Governance Framework for Agentic AI, Version 1.0
- Source · 2026-01-22Singapore Launches New Model AI Governance Framework for Agentic AI
- Source · 2026-01-15Qwen App Advances Agentic AI Strategy by Turning Core Ecosystem Services into Executable AI Capabilities
Show 54 more
- Source · 2026-01-12CAISI Issues Request for Information About Securing AI Agent Systems
- Source · 2026-01-11New tech and tools for retailers to succeed in an agentic shopping era
- Source · 2026-01-11The agentic commerce platform: Shopify connects any merchant to every AI conversation
- Source · 2026-01-05Rakuten Integrates Agentic AI Tool Rakuten AI into Rakuten Ichiba Mobile App
- Source · 2026Agentic Commerce Protocol — Changelog
- Source · 2026Artificial intelligence—Agent interconnection—Part 1: General architecture
- Source · 2025-12-17What Is Your AI Agent Buying? Evaluation, Biases, Model Dependence, and Emerging Implications for Agentic E-Commerce
- Source · 2025-12-09Linux Foundation Announces the Formation of the Agentic AI Foundation (AAIF), Anchored by New Project Contributions Including Model Context Protocol (MCP), goose and AGENTS.md
- Source · 2025-11-25Authorization - Model Context Protocol specification 2025-11-25
- Source · 2025-11-25How GitHub's agentic security principles make our AI agents as secure as possible
- Source · 2025-11-11OSWorld-MCP: Benchmarking MCP Tool Invocation In Computer-Use Agents
- Source · 2025-10-27Magentic Marketplace: An Open-Source Environment for Studying Agentic Markets
- Source · 2025-10-14Visa unveils Trusted Agent Protocol for AI commerce
- Source · 2025-09-29Agentic Commerce Protocol — Introduction
- Source · 2025-09-29Buy it in ChatGPT: Instant Checkout and the Agentic Commerce Protocol
- Source · 2025-09-13EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in Microsoft 365 Copilot
- Source · 2025-09-08Introducing the MCP Registry
- Source · 2025-08-19MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers
- Source · 2025-08-17MCPSecBench: A Systematic Security Benchmark for Model Context Protocol
- Source · 2025-06-23Google Cloud donates A2A to Linux Foundation
- Source · 2025-06-23Linux Foundation Launches the Agent2Agent Protocol Project
- Source · 2025-06-20Agentic misalignment: How LLMs could be insider threats
- Source · 2025-06-16SHADE-Arena: Evaluating Sabotage and Monitoring in LLM Agents
- Source · 2025-06-09tau2-Bench: Evaluating Conversational Agents in a Dual-Control Environment
- Source · 2025-06-03DeepShop: A Benchmark for Deep Research Shopping Agents
- Source · 2025-05-19Agentforce Pricing
- Source · 2025-05Sentiment Simulation using Generative AI Agents
- Source · 2025-04-29Mastercard unveils Agent Pay, pioneering agentic payments technology to power commerce in the age of AI
- Source · 2025-04-28Protecting against indirect injection attacks in MCP
- Source · 2025-04-09Announcing the Agent2Agent Protocol (A2A)
- Source · 2025-04-09Grab Deploys Agentic AI to Empower Merchants and Driver Partners
- Source · 2025-01-17Technical Blog: Strengthening AI Agent Hijacking Evaluations
- Source · 2025Earning Consumer Trust in the Age of Agentic Commerce
- Source · 2025International joint testing exercise: Agentic testing
- Source · 2025Large-Scale Adaptive Red Teaming of AI Agents
- Source · 2025LLM06: Excessive Agency
- Source · 2025Mastercard's agentic commerce framework
- Source · 2025OS-Harm: A Benchmark for Measuring Safety of Computer-Use Agents
- Source · 2025tau-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domains
- Source · 2025WASP: Benchmarking Web Agent Security Against Prompt Injection
- Source · 2024-11Generative Agent Simulations of 1,000 People
- Source · 2024-08InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents
- Source · 2024-05-30OSWorld: Benchmarking Multimodal Agents for Open-Ended Tasks in Real Computer Environments
- Source · 2024AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents
- Source · 2023-08-23More Than a Bot? The Impact of Disclosing Human Involvement on Customer Interactions with Hybrid Service Agents
- SourceA2A Protocol v1.0
- SourceAI Agent Standards Initiative
- SourceAI agent trends 2026 report
- SourceAnnouncing the AI Agent Standards Initiative
- SourceChatGPT Agent System Card: confirmations and safeguards
- SourceImplementation opinions on standardized application and innovative development of AI agents
- SourceNIST (2026), “Building Evaluation Probes into Agentic AI.”
- SourceTrusted Agent Protocol
- SourceTrusted Agent Protocol
Signposts
Topic placement guides discovery. It does not change a claim, its evidence or its confidence. Sources without a date are listed after the dated ones.