AI Agent vs Agentic AI: Four Rungs, and Where Your Vendor Actually Sits

AI agent vs agentic AI is a question thousands of people type into search engines every month, and most of the answers they get were written by somebody with a product to move. So here it is plainly. An agent is a program. Specifically, it is a model called in a loop, with tools, until a stopping condition fires. Agentic describes a property of that loop: how much of the goal, the plan and the action the model gets to choose. Not a second species of software. A dial on the one you already have.

Anthropic's engineering note on building effective agents draws the line at ownership of control flow. Workflows orchestrate models and tools through predefined code paths. Agents let the model direct its own process and tool use. Same components in both cases. The difference is who decides what happens next.

Most things sold as agentic in 2026 are workflow automation with a model in one step. That is fine. It is frequently the correct engineering decision, and I would pick it over an autonomous loop for the majority of production problems I have seen. The problem is that the word hides which one you bought, and the price does not.

AI agent vs agentic AI: a loop and a dial on it

The loop is not complicated. Call the model. Read the response for a tool call. Execute it. Append the result to the context. Repeat until the model stops asking or the budget runs out. Twenty-odd lines of Python. Every agent framework on the market is that loop plus opinions about state, retries and observability.

The interesting question was never the loop. It is what the loop is permitted to decide. Three things can be handed over, and they are separable: which tool to call next, what sequence of steps to run and what the goal is. Independent knobs. Products ship with different combinations of them set, and almost never say which.

Kevin Feng, David McDonald and Amy Zhang made the sharpest version of this point for the Knight First Amendment Institute in July 2025. Autonomy, they argue, is a deliberate design decision made by the developer, not a readout of how capable the model is. A strong model can be run at low autonomy by forcing it to check in. A weak model can be run at high autonomy inside a narrow domain, and it often is. Their five levels run Operator, Collaborator, Consultant, Approver, Observer, each defined by what the user still holds rather than by what the model can do.

I use four rungs, because four is what a buyer can hold in their head during a demo.

A regulator writing enforceable text has to put you on a rung. A marketing department has to do the opposite.

Rung one and rung two: fixed workflow, then model-chosen tools

Rung one. Fixed workflow. Code owns the graph. A model sits in one node or several, doing classification, extraction, drafting or ranking, and it never picks the next node. The human owns everything else: the sequence, the tool inventory, the goal, the stop condition. Evaluation looks like ordinary software testing with an accuracy number bolted onto each node. Failures are local and you can point at the one that broke. A very large share of the value being produced in production right now lives here, and there is nothing embarrassing about that.

Rung two. Model-chosen tool calls. The goal is fixed, the toolset is fixed, the outer loop is fixed. Inside it, the model decides which tool, with which arguments, in what order and when to stop. Function calling plus a while loop. The human still owns the goal, the tool inventory, the permission scopes, the token budget and the kill condition. What changed is that the action sequence stopped being enumerable. Your test surface is no longer a list of paths. It is a distribution.

That is what agentic means in nearly every deck I have been shown. Rung two. A fixed objective, a fixed set of tools and a model choosing the order.

Rung three and rung four: model-chosen plans, then self-directed goals

Rung three. The model owns the plan. It decomposes the task, may spawn sub-tasks or sub-agents, and may discard the plan halfway through and write a new one. The human keeps the goal and the boundary: permission scopes, spend caps, gates in front of anything irreversible. What changed is that you cannot enumerate the intermediate states even in principle. The context window has become the state machine, which is why degradation over long runs stops being a quality annoyance and turns into a reliability failure with a cost attached.

Rung four. Self-directed goals. The system decides what to work on. A standing objective, memory that persists across runs, its own triggers. The human holds the objective function, the audit trail and the off switch. Feng and colleagues call this Observer. Almost nothing commercial ships here deliberately, and the things that do tend to be research artefacts or systems with very hard physical or financial fences built around them.

The rungs are cumulative in risk. They are not cumulative in value. That asymmetry is the entire procurement problem, and no amount of adjective fixes it.

What changes in risk and evaluation at every rung

Start with the arithmetic, because it is the part that kills pilots. τ-bench, published by Shunyu Yao, Noah Shinn, Pedram Razavi and Karthik Narasimhan in June 2024, introduced pass^k: the probability that all k independent attempts succeed, as against pass@k, the probability that at least one does. Under that measure GPT-4o scored below 25% at pass^8 in the retail domain, and function-calling agents generally succeeded on under half the tasks. Sierra's follow-up, τ²-bench, extended the setup to environments where the user also holds tools and can change the shared state.

Run the numbers yourself. A component at 90% per-attempt success, with independent attempts, lands at 0.9 to the eighth power. That is 43% across eight consecutive runs. Not 57%, a figure that circulates in secondary write-ups of this benchmark and does not survive a calculator. Rung one gives you one such draw per node with code catching the rest. Rung two gives you a chain of them whose length you do not control. Rung three gives you a chain of chains. Nothing about the model got worse. The exposure changed.

Evaluation has to change shape with it. Rung one: unit tests plus per-node accuracy. Rung two: trajectory logging, replay and a pass^k target instead of a headline accuracy number. Rung three: budget ceilings, irreversibility gates and review of plans rather than only outputs. Rung four is not an evaluation problem at all. It is a governance one, and if you are treating it as an eval you have already lost.

Security tracks the same curve. The OWASP Top 10 for Agentic Applications, published on 9 December 2025, runs ASI01 through ASI10 and includes Tool Misuse and Exploitation at ASI02, Identity and Privilege Abuse at ASI03 and Memory and Context Injection at ASI06. Excessive agency, which used to be one line item in the LLM list, is now the structural root of most of the catalogue. Note the rung dependence. ASI02 goes live the moment you reach rung two. ASI06 mostly needs rung three, because it needs persistent memory to poison.

LangChain surveyed 1,340 practitioners between 18 November and 2 December 2025. 57.3% had agents in production, up from 51% the year before. Quality was the top blocker for about a third of them. 89% had observability in place. And 59.8% still evaluate by human review. That last number is the honest tell. If a person reading transcripts is your evaluation strategy, your system is on rung two whatever the deck says, because nobody reads transcripts for a fleet that sets its own goals.

Why agentic in a vendor deck usually means rung two

Gartner put a number on this in June 2025: over 40% of agentic AI projects will be cancelled by the end of 2027, on escalating cost, unclear business value or inadequate risk controls. The same analysis named the practice. Agent washing, meaning the rebranding of assistants, RPA and chatbots without substantial agentic capability. Gartner's estimate was that roughly 130 of the thousands of vendors in the category were doing anything genuinely agentic. Anushree Verma, the senior director analyst quoted in the release, said most propositions lack significant value or return, because current models do not have the maturity and agency to autonomously achieve complex business goals or follow nuanced instructions over time.

Here is something you notice reading Chinese policy text first-hand rather than in translation. On 8 May 2026 the Cyberspace Administration of China, the National Development and Reform Commission and the Ministry of Industry and Information Technology jointly issued 《智能体规范应用与创新发展实施意见》, implementation opinions on the regulated application and innovative development of agents. The Chinese term is 智能体, a noun. Intelligent body. There is no adjectival form of it. You cannot say agentic in Mandarin the way an English slide says it, so the document is forced to say something specific instead. It defines 智能体 as a system with autonomous perception, memory, decision-making, interaction and execution capability, then builds a 分类分级 framework, classified and tiered by application scenario and potential impact, with filing, testing and product recall for sensitive sectors and self-assessment, reporting and platform management for low-risk ones. Nineteen named application scenarios. A regulator writing enforceable text has to put you on a rung. A marketing department has to do the opposite.

There is a second contrast that is hard to miss living in Shenzhen. The IFR's World Robotics 2025 report counted 295,000 industrial robots installed in China in 2024, about 54% of global installations, pushing the installed stock past 2.02 million units, with domestic manufacturers outselling foreign ones in their home market for the first time at 57% share. Shenzhen's own embodied intelligence action plan for 2025 to 2027 targets a cluster above 100 billion yuan and more than 1,200 firms. Nobody in that industry sells a six-axis arm as agentic. They sell it with a payload, a reach, a repeatability figure in hundredths of a millimetre and a safety category you can look up. The software people, often in the same buildings on the same industrial parks, sell an adjective.

The strongest argument against the ladder

The best case against me is academic rather than commercial. Ranjan Sapkota, Konstantinos Roumeliotis and Manoj Karkee published a conceptual taxonomy in May 2025, revised through that September, arguing the split is real and structural. AI agents in their framing are modular, task-specific systems built on models plus tool integration and prompt engineering. Agentic AI is something else: multi-agent collaboration, dynamic task decomposition, persistent memory and coordinated autonomy. On that account it is a phase change rather than a rung, and the change brings failure modes single agents do not have. Coordination deadlock. Error amplification, where one agent's mistake becomes another agent's premise. Memory poisoning that propagates across a fleet instead of dying with one session. A smooth spectrum hides all of that, and a buyer thinking in rungs will underestimate it.

I concede the failure modes completely. I still think the ladder is the more useful instrument, for two reasons.

First, topology is orthogonal to autonomy. You can build a five-agent system that sits entirely on rung one: a fixed graph, fixed handoffs, every node a model call with no discretion over what comes next. That system is multi-agent in the Sapkota sense and strictly less autonomous than a single coding agent that writes and revises its own plan. Counting agents does not measure agency. The taxonomy folds a topology decision into an autonomy decision, and buyers pay for the confusion.

Second, even granting the category, it does not generate an action. Being told a product is agentic AI rather than an AI agent tells me nothing about what to test, what to gate or what to budget. Being told it sits on rung three tells me I need spend ceilings, trajectory replay, irreversibility gates and a pass^k target instead of an accuracy number. Categories produce feelings. Rungs produce a test plan.

The one genuine wrinkle is that the rungs move under your feet. METR's Time Horizon 1.1 update, published 29 January 2026, put the post-2023 doubling time for 50%-success task length at 130.8 days, revised down from 165.3 days under the earlier methodology, with Claude Opus 4.5 measured at a 320-minute horizon on a confidence interval running from 170 to 729 minutes. METR itself warns that measurements above 16 hours are unreliable with the current task suite, so read the top of that chart with your hand over one eye. But if the trend holds even loosely, work that is uneconomic at rung three in 2026 is routine in 2027. That is an argument for declaring your rung and revisiting it on a schedule, not for refusing to name one.

The plumbing settled faster than the vocabulary

On 9 December 2025 Anthropic donated the Model Context Protocol to the Agentic AI Foundation, a new directed fund under the Linux Foundation co-founded with Block and OpenAI, alongside Block's goose and OpenAI's AGENTS.md, with support from Google, Microsoft, AWS, Cloudflare and Bloomberg. MCP was running at roughly 97 million monthly SDK downloads and around 10,000 active servers at the time of the handover. Tool calling is now a standard with neutral governance, implemented by everyone who matters.

Which means rung two is becoming infrastructure. Anybody can wire a model to a tool registry this quarter, in an afternoon, using code they did not write. The engineering that used to justify the premium is turning into a dependency, and the only thing left to charge for is the claim about how much the thing decides on its own.

So the incentive points one way and the regulation points the other. The Chinese file wants a tier declared before you ship. Every deck I have read wants you to stay one rung vague, upward. Those two pressures are now aimed at the same product line, and the first vendor to write rung two, by design on slide three is going to find out whether honesty reads as a feature or a disqualification.

Tools referenced

LangGraph, reviewed here: LangGraph review.

Temporal, reviewed here: Temporal review.

OpenAI Agents SDK, reviewed here: OpenAI Agents SDK review.

AgentScope, reviewed here: AgentScope review.

Dify, reviewed here: Dify review.

Langfuse, reviewed here: Langfuse review.

Sources

Anthropic, Building Effective AI Agents: https://www.anthropic.com/engineering/building-effective-agents

Feng, McDonald & Zhang, Levels of Autonomy for AI Agents, Knight First Amendment Institute (July 2025): https://knightcolumbia.org/content/levels-of-autonomy-for-ai-agents-1

Yao, Shinn, Razavi & Narasimhan, tau-bench and the pass^k metric (arXiv:2406.12045): https://arxiv.org/abs/2406.12045

Sapkota, Roumeliotis & Karkee, AI Agents vs. Agentic AI: A Conceptual Taxonomy (arXiv:2505.10468): https://arxiv.org/abs/2505.10468

Gartner, Over 40% of Agentic AI Projects Will Be Canceled by End of 2027 (25 June 2025): https://www.gartner.com/en/newsroom/press-releases/2025-06-25-gartner-predicts-over-40-percent-of-agentic-ai-projects-will-be-canceled-by-end-of-2027

CAC, NDRC and MIIT, 智能体规范应用与创新发展实施意见 press Q&A (8 May 2026): https://www.cac.gov.cn/2026-05/08/c_1779979789738376.htm

METR, Time Horizon 1.1 (29 January 2026): https://metr.org/blog/2026-1-29-time-horizon-1-1/

Linux Foundation, Formation of the Agentic AI Foundation with MCP, goose and AGENTS.md: https://www.linuxfoundation.org/press/linux-foundation-announces-the-formation-of-the-agentic-ai-foundation