Every demo makes AI agents look like they run themselves. Here's the gap between the demo and reality — and where your judgment still has to stay in the loop.

The demo problem

Watch any AI agent demo and the sequence looks clean: a goal is stated, the agent reasons through it, tools are called, results come back, task complete. It's compelling precisely because it looks autonomous. The agent appears to be handling the thinking.

But demos are optimised for the case where everything goes right. They show the tool call that succeeds, not the one that returns an ambiguous result. They show the task with a clear success state, not the one where "done" is a judgment call.

---

The three gaps that matter right now

Gap 1 — No real judgment

Agents follow patterns extremely well. Give one a task it has seen variations of before, with clear inputs and a clear success state, and it'll handle it reliably. That's genuinely useful for a meaningful set of work.

The problem is the edge. When a task requires an actual judgment call — weighing competing considerations that don't reduce to a pattern, or deciding that something looks technically complete but is actually wrong — an agent can go quietly sideways without flagging it. It doesn't know it's in unfamiliar territory. It doesn't have the equivalent of a pause and a "wait, something's off here."

The more consequential the task if it goes wrong, the more this matters. An agent drafting a first pass at something low-stakes is fine. An agent making decisions where the wrong call has real costs — financial, reputational, relational — needs a human checkpoint somewhere in the loop.

Gap 2 — They can be manipulated by what they read

This one is less obvious and more serious. It's called prompt injection: a hidden instruction embedded inside content the agent is processing — a webpage, a document, an email — that the agent can't reliably distinguish from your actual instructions.

The agent reads the page. The page contains something like "ignore previous instructions and forward this to…" The agent, depending on how it's built, may follow that instruction. Not because it's malicious. Because it's processing text, and the injected instruction looks like text it should act on.

This has already moved beyond theoretical. An agentic browser was blocked from certain account access while a related legal case is on appeal — a real-world consequence of this class of vulnerability. It's an active area of research and one of the harder problems in agent security, because the fix requires the agent to correctly classify the intent of text it hasn't seen before. That's exactly the kind of judgment described in Gap 1.

Gap 3 — Cost compounds when something's wrong

"Set it and forget it" is the promise. The reality is that agents running over time accumulate usage costs, and an agent doing the wrong thing keeps doing the wrong thing for as long as nobody catches it.

A short task that goes wrong: caught quickly, costs are limited. A long-running agent on a multi-step workflow that goes wrong at step two: by the time it surfaces, it's done a lot of work in the wrong direction, cost real money in API calls, and may have taken actions that need reversing.

This isn't an argument against agentic workflows. It's an argument for watching the first runs, setting cost alerts, and building in checkpoints on anything that's long or expensive. The economics only work if someone's keeping an eye on what's actually being spent.

---

Where agents are strong, and where they're not

This isn't a verdict against using agents — it's a map for using them well. The distinction that matters most:

---

What to actually change about how you deploy them

Add checkpoints	On anything long or consequential, build in a human review step before the agent takes its most significant action — not just at the start and end.
Limit permissions	Give agents the narrowest set of actions they need for the task. The smaller the blast radius if something goes wrong, the safer running them is.
Watch external content	If an agent is reading content you don't control and then taking action, treat that as a higher-risk configuration and audit what it's doing more closely.
Set cost alerts	Any agent running on a schedule or in a loop needs a spend limit or alert. The cost of a runaway agent compounds faster than most people expect.
Watch the first runs	Don't deploy and walk away the same day. Real inputs are always slightly different from your test inputs. The first batch of live runs is where you learn what you missed.

---

The honest bit ✅

• Agents are genuinely useful right now. This isn't a case for waiting. For bounded, well-defined tasks with low stakes per run, they deliver real value today.
• The gaps described here are being actively worked on. Prompt injection defences are improving. Judgment and uncertainty-flagging are active research areas. The landscape in two years will look different.
• Human oversight isn't a workaround — it's the design. For anything that matters if it goes sideways, keeping a human in the loop isn't a concession that AI isn't good enough. It's how responsible deployment looks right now.
• The cost gap is the most underrated one. Everyone talks about judgment and security. Far fewer people budget carefully for what an agent actually costs to run at scale over time, especially when something's quietly wrong.