2026年AI威胁态势报告：AI智能体的崛起（英文版）

AI

THREATLANDSCAPE

REPORT61

About

HiddenLayer

&

Resources2

TABLE

OF

CONTENTS04FOREWORD05

SECURITY

FOR

AI

SURVEY

INSIGHTSATA

GLANCE11

AI

THREAT

LANDSCAPE

TIMELINE26

PART

2:

RISKS

FACED

BY

AI-BASED

SYSTEMS26

AttacksonModelFoundations30

Attacks

AgainstGenAI33

AgenticSystemsSecurity39

AISupplyChainSecurity47

PART

3:

ADVANCEMENTS

IN

SECURITY

FOR

AI47DefensiveFrameworksandInitiatives51TheStateof

AIRedTeaming51NewGuidance&Legislation57

Part

4:

Predictions

and

Recommendations57Predictions

for202660

Recommendations

for

the

Security

Practitioner17

PART

1:

RISKS

POSED

BY

ARTIFICIAL

INTELLIGENCE17

RiskstoSociety20

AI-PoweredCybercrime13

WHAT’S

NEW

IN

AI3Agentic

AIrepresents

aprofoundleap

forward.

These

systems

arenolongerlimited

toresponding

toprompts.

They

can

set

goals,

calltools,interact

with

other

systems,

generate

code,initiate

transactions,

and

adapt

dynamically

to

changing

environments.Properlyharnessed,theypromiseunprecedentedoperationalefficiency,acceleratedinnovation,andentirelynewmodelsof

productivity.Butautonomychangestheriskequation.When

AI

systems

are

empowered

to

take

action,

the

attack

surface

expands

dramatically.

The

same

capabilities

that

enable

agentsto

automatebusinessprocesses

canbemanipulated

to

automate

exploitation.

The

samereasoningloops

that

drive

efficiency

can

beredirectedtowardmaliciousobjectives.

As

AI

gainsagency,adversariesgainleverage.Make

no

mistake,thedefiningAIsecuritychallengeofthisera

is

not

hypotheticalsuperintelligence.

It

is

theweaponization,manipulation,andcompromiseofautonomoussystemsbybadactors.Agentic

architecturesintroducenewlayers

of

vulnerability,including

toolpoisoning,memorymanipulation,model

contexthijacking,multi-agent

collusion,identity

abuse,

data

exfiltration

via

action

chains,

and

the

exploitation

of

decision-makingloops.

Theserisksarenot

theoretical.

They

are

emergingnow

across

commercial

enterprises

and

federal

environments,

experimenting

with

AI-driven

automation.Traditionalcybersecurityprinciplesremainessential,buttheyarenolongersufficientontheirown.Securingagentic

AIdemandscontinuous

validation

of

model

behavior,real-time

inspection

of

agent

actions,

guardrails

around

tool

access,

and

controls

thataccountforsystemscapableofindependentexecution.TheconvergenceofAIsecurityandapplicationsecurityhasneverbeenmoreurgent.Inthisyear’sreport,weexaminehowtheriseofagenticAIisreshapingthethreatlandscape.Wedetailthenovelattackpatternstargetingautonomous

systemsandanalyzehowadversariesareadaptingproven

tactics

toexploit

AI-driven

workflows.

We

sharefindings

fromsecurityand

AIleadersdeployingagentsinproductionenvironments,along

withdata-driveninsights

fromour

worksecuringenterprise

AIsystems.Finally,

wehighlightadvancementsinprotectivecontrolspurpose-builtforagenticarchitectures.Asorganizationsracetowardautonomy,securitymust

movejustas

quickly.

Innovationwithout

protection

invites

disruption.Autonomy

without

oversight

invites

abuse.Let

thisreport

serve

as

a

guide

fornavigating

the

agentic

eraresponsibly.

Whether

you

arebuilding,

deploying,

or

defending

autonomoussystems,

weinvite

youto

joinusinsecuring

AInot

justasatool,butasanactorinourdigital

world.Weareproudtopresentthe2026HiddenLayer

AIThreatLandscapeReport.TitoCEO&Co-Founder(UnassistedbyLLMs)

FOREWORDWeareenteringthenextphaseofthe

AIrevolution.

Whatbeganaspredictivemodelsand

generativeinterfacesisrapidlyevolvingintoautonomous,agenticsystemscapableofplanning,

reasoning,

and

acting

on

our

behalf.

In

2026,

no

mission,

enterprise,

orgovernmentagency

willremainuntouchedby

AIagentsoperatingacross

workflows,networks,andcriticalinfrastructure.4This

year’s

surveyreveals

a

growing

disconnectbetweenhow

AI

systems

arebeing

deployed

andhow

they

arebeing

secured.OrganizationsarerapidlyoperationalizingAIwithincreasingautonomy,

while

security

programs

remain

largely

optimized

for

staticmodels

and

traditional

application

controls.Foundationalsafeguards

such

as

encryption

and

secure

deployment

arenow

common,but

the

operational

controlsrequired

tomanage

agenticbehavior,provideruntime

visibility,

conduct

adversarialtesting,

and

implement

AI-specific

incident

response

remainunevenlyimplemented.AsAIsystemsgaintheabilitytoact,

integrate,andmakedecisionsindependently,thesegapsare

nolonger

theoretical;

they

arebecoming

sources

of

systemicenterpriserisk.Thatriskisamplified

by

limiteddetection

confidence

andfragmented

accountability.Nearly

one-third

of

organizationscannotdefinitivelydeterminewhethertheyexperiencedanAI

security

breach

in

the

past

year,even

as

attacks

remainsteady

orincrease

and

frequently

originate

frompublicmodels,

chatbots,andagent-enabledsystems.ShadowAI

furthererodes

control,

with

most

organizations

acknowledginguntracked

deployments

thatbypass

governance,monitoring,and

approval

processes.

In

agentic

environments,delayeddetection

and

unclear

ownership

are

not

just

inefficiencies;they

enable

autonomous

systems

to

propagate

harm

faster

than

traditional

security

models

were

designed

to

handle.At

the

same

time,AI

has

become

foundational

to

businessoperations.Mostorganizationsnowconsiderbothinternally

operated

and

third-partyAI

systems

critical

to

revenue,

customer

experience,

and

operationalresilience,

yet

confidencein

vendor

securityremainslimited.

Taken

together,

the

findingsreinforce

a

core

conclusionreflected

throughoutthis

report:AI

systems

should

be

assumed

exploitable,

notmerely

vulnerable.

Securing

AIin

an

agentic

erarequires

a

shift

awayfromone-timecontrolsandpolicyassertionstoward

continuousaccountability,runtimemonitoring,enforceablegovernance,

third-party

assurance,

and

securitymechanismsdesignedforsystemsthatevolveandactbeyondhuman-in-the-loop

oversight.state

that

AI

projects

are

critical

orimportanttorevenue

generationoverthenext18months.say

AIiscritical

orimportant

to

customer

experience,

and

96%

to

core

business

operations,raising

theimpactof

AIsecurity

failures.oforganizationsreportthat

most

or

all

internallyoperatedAI

modelsare

criticaltobusiness

success.report

that

embedded

third-party

AI

modelsarealso

business-critical,

extending

risk

beyond

internal

deployments.88%78%97%92%SECURITY

FOR

AI

SURVEY

INSIGHT

S

AT

A

GLANCEAI’sCriticalRoleinBusiness

Success56Top

Sourcesof

AI

Attacks◉

Criminalhacking

groups—52%◉

Third-partyserviceproviders—45%◉

Freelancehackers—38%◉

Competitors—35%◉

State-sponsoredactors—31%TopMotivations

for

AI

Attacks◉

Financialgain

—50%◉

Sensitivedataexfiltration—

48%◉

Businessdisruption—

42%◉

Modeltheft

—

39%◉

Competitiveadvantage—

27%reportuncertainty,indicatingpersistent

gapsinmonitoring

and

detection

as

AIsystems

gain

autonomy.say

attacks

on

AI

systems

haveincreased

or

remained

the

samecompared

to

theprevious

year.Third-partyapplicationsAttackson

agentsInference

attacks

on

predictive

models31%71%Malware

in

models

pulled

frompublicrepositoriesAttack

oninternalorexternal

chatbot69%RisingAttacks—With

Uneven

Detection

Confidenceoforganizations

definitely

know

whether

they

experienced

anAI

securitybreachin

thepast12months.Sources

&Motivations

of

AI

AttacksAttack

Vectors

for

AIBreaches35%14%31%13%6%ChallengesinSecuring

Agentic

AI◉

76%reportthatshadowAI—unapprovedoruntrackedAIdeployments—isadefiniteorprobableproblem,

butonly34%partner

externally

for

detection.◉

93%use

open-weight

models

from

repositories

such

asAWS,

Azure,

andHuggingFace,increasing

exposure

to

supplychainrisk,

yet

fewer

thanhalfreport

consistently

scanninginbound

models

for

malicious

content

or

integrity

issues.Top

Third-Party

GenAIApplicationsinUse◉

ChatGPT—77%◉

MicrosoftCopilot—68%◉

Gemini—57%◉

Claude—

32%◉

Salesforce—27%41%

58%28%North

America58%

Europe41%Asia31%South

America28%

Africa20%Unknown10%31%GLOBAL

ORIGINS

OF

AI

ATTACKSHowever,

53%

report

that

their

organizationhas

optednot

to

disclose

an

AI

incident

due

to

reputationalconcerns.85%53%ofleadersagreethatcompanies

should

be

legally

requiredtodisclose

AIsecuritybreaches.Disclosure,

Transparency,andRegulatoryPressure20%7Time

andResourcesDevoted

to

AI

Security◉

Onaverage,professionalsreportspending46%oftheirtimeaddressing

AIriskandsecurity.◉

91%haveaddedbudgetfor

AIsecurityin2025.◉

However,

only

58%

allocate

10%

ormore

of

AI

spending

torisk

and

securitymitigation,

suggestingunderinvestmentrelativetodependency.TopFrameworksUsed

toGuide

AISecurity◉

Gartner

AITrust,Risk,andSecurityManagement—57%◉

GoogleSecure

AIFramework—56%◉

IBMFrameworkforSecuringGenerative

AI—53%◉

NISTAIRiskManagementFramework—48%◉

Databricks

AISecurityFramework—41%8Buildingrelationships

betweenAIandsecurity

teamsCreatinganinventoryof

AImodelsDeterminingsourceof

origin

for

modelsScanningandauditing

AImodelsExtending

detection

&response

to

AIassetsOnly

29%

have

a

dedicated

AIincidentresponseplan.Only

19%reportperforming

manualorautomated

AIred

teaming.have

implemented

an

AI

governancecommittee

or

executive

structure.report

clearly

defined

AI-related

roles

between

security

and

data

scienceteams.of

organizationsreportinternal

debate

or

conflict

overAI

security

control,highlightingtheneedforclearerteam

alignments.SECURITYMEASURES

&GAPS

IN

AGENT

IC

AI

DEFENSE83%73%68%Governance,Frameworks,and

AccountabilityMostCommon

AI

SecurityPractices50%54%58%29%32%32%19%SurveyHighlights◉

1in8

AIbreachesarearesultof

AIagents◉

Over1/3rdof

AIbreachesarearesultof

AI

chatbots◉

GovernanceExists-ButIt’sChaotic•83%have

governancecommittees,

73%reportconflict,andonly68%haveroleclarity◉

Open-weight

models

are

the

top

source

of

AI

breaches•Malwareinpublicrepositoriesaccountsfor35%ofbreaches,

yet93%oforganizationsstillusethemAI

CriticalityAIprojectsratedcriticalorimportanttorevenue

generationOrganizations

saying

all

ormost

operated

AImodels

are

criticaltobusinesssuccess

YEAR-

OVER-YEARExposure

&DisclosureOrganizationsidentifying

shadow

AI

as

aknown

orprobablerisk

2025

2026Organizations

admittingtheywithhelddisclosure

due

to

backlashconcernsOrganizationsreporting

theyprobably

don’tknow,

don’tknow,

orhaveno

waytoknowifan

AIbreachoccurred

33%

26%

97%

89%Visibility

&DetectionOrganizations

definitively

know

that

they

have

experiencedan

AI-specificbreachOrganizationalDynamicsOrganizationsreportinginternaldebateorconflictover

AIsecurityinitiatives

45%

67%

53%

61%

88%

96%

76%

73%

76%

74%

本报告来源于三个皮匠报告站（）,由用户Id:619989下载,文档Id:1236342,下载日期:2026-05-259Risksrelatedtotheuseof

AIEvolution

of

risks

faced

by

AI-

basedSystemsPoisoningattacksInference

attacks(Model

evasion

&

theft)AI

supply

chain

attacks(Modelhijacking:

serialization

vulnerabilities

&

graph

backdoors)GenAIprompt

attacks(Guardrailbypass,

indirectprompt

injection,

promptobfuscation)Attacksagainstagenticsystems

AI

THREAT

LANDSCAPE

IN

A

NUTSHELL10◉

AnthropiclaunchesClaude3.7Thinking◉

OpenAIlaunchesGPT-4.5andDeepResearch◉

Storm-1516

disinformation

operation

targets

elections

inGermany◉

Basilisk

Venom

attack

shows

how

hidden

promptscancreatebackdoorsinmodels◉

OWASPstartstheir

AgenticSecurityInitiative◉

Cloud

Security

Alliance

releases

Agentic

AI

ThreatModelingFrameworkMAESTROo-

MAR

◉

OpenAIadoptsMCPacrossitsproducts◉

MicrosoftintegratesagentsintoCopilotStudio◉

Googlereleases

Gemini

2.5Pro

-thinkingmodel

with

advancedreasoningo-

APR

◉

Salesforcereleases

Agentforce3.0◉

ResearchersatCyLabdemonstratedata

poisoningattacks

with0.1%ofpoisoneddataset◉

CVPR

2025papers

takebackdoor

and

evasion

attacksonmodelstothenextlevel◉

HiddenLayerdemonstratesTokenBreak-amethodtobypass

guardrailmodels◉

Asana

discloses

amajor

cross-tenantbreach

caused

byabugintheirMCPserver◉

Backslash

Security’s

research

finds

hundreds

of

misconfiguredMCPservers◉

HiddenLayerpublishesthe

APE

taxonomy

forclassificationofpromptattackso-

MAY◉

Anthropiclaunches

Claude

4

andmakes

Claude

Code

generallyavailable◉

MS

announcesnative

support

forMCP

on

Windows

11◉

DockercreatesMCPcatalogue◉

HiddenLayer’s

researchersdemonstrate

parameter

abuseinMCPservers◉

MITRE

proposes

a

defender-focused

framework

SAFE-AI◉

The

first

AISBOM

generator

toolunveiled

atRSA

2025conference

AI

THREAT

LANDSCAPE

TIMELINE

2025AIMilestones,RisksPosedby

AI,RisksFacedby

AI,SecurityInitiativesMicrosoft

introduces

Agent

Flows-An

AI

workflow

automation

in

Copilot

StudioGooglelaunchesMCPToolboxforDatabasesGoogle

introduces

Agent2Agent

protocol

for

inter-

agentcommunicationTeenagerdiesafterconfidingsuicidalthoughtsto

ChatGPTPaper

“Machine

Unlearning

Failsto

Remove

DataPoisoning”publishedatICLR2025Researchersprove

simpleinterference

can

fool

trafficsignrecognitioninself-drivingcars◉

Anoveluniversalbypassforallmajor

LLMsunveiled

byHiddenLayer◉

InvariantLabs

discoversMCP

vulnerability

that

allowsfor

tool

poisoning

attacks◉

SpiderLabspublishes

AgentIn

theMiddle-

a

techniqueofabusing

A2Aprotocol◉

ModelSigningProjectv1.0releasedbyOpenSSFAI/ML

WorkingGroup◉

OpenAIlaunches

Operator

-

one

of

the

first

AI

agents◉

ServiceNowlaunches

AI

Agents&Orchestrator◉

Googleagreestoinvest$1billioninto

Anthropic◉

A

studypublishedinNatureMedicinerevealsmedical

LLMshighlypronetopoisoning◉

Modelgenealogytechniquecalled

ShadowGenes

publishedbyHiddenLayer◉◉◉◉◉◉JANFEBJUN11◉

AWSintroducesKiro

AI-anagenticIDE◉

Cognitionacquires

Windsurf

AIIDE◉

MicrosoftcreatesDataverseMCPServer◉

Microsoft

introduces

EdgeCopilot-anAImodefortheEdgebrowser.◉

PerplexityAIintroducesComet-a

browserwithanintegrated

AIassistant◉

Man

dies

by

suicide

after

receiving

encouraging

messagesfromChatGPT◉

Vinciworksreports

over

50

casesinvolving

fakelegalcitations

generatedby

AI◉

CERT-UAdiscovers

LAMEHUG,an

infostealerthat

reliesonLLM◉

HiddenLayer

demonstrateshiddenpromptinjectionsthatcanhijack

AIcodeassistants◉

Critical

RCE

Vulnerability

found

in

mcp-remote

package◉

Coalition

for

Secure

AIpublishesPrinciples

for

Secure-by-Design

AgenticSystems

AUG◉

OpenAIreleasesGPT-5◉

ManhospitalizedaftertrustingChatGPTadvice◉

Man

murders

his

mother

and

kills

himself

after

ChatGPTfuelshisparanoiddelusions◉

Anthropic

releases

report

detailing

the

first

fully

automatedcybercrimecampaign◉

Anthropic’sReporthighlights

theuse

of

AIinromancescams

and

remote

worker

fraud◉

The

firstknown

AI-poweredransomware,PromptLock,

isdiscoveredbyESET◉

HiddenLayerunveils

VISOR

-

a

technique

ofmodifying

modelbehaviorusingimages◉

HiddenLayerdemonstratespersistent

logical

backdoors◉

Major

supply

chainbreach

through

Salesloft’sDrift

AIchatbot

impacts

hundreds

of

businesses◉

S1ngularity

becomes

the

first

known

supply

chain

attack

that

scans

forandleverageslocallyaccessibleLLMs

SEP◉

AnthropiclaunchesClaude4.5Sonnet&Opus◉

OperalaunchesNeonagenticbrowser◉

Googleintroduces

AgentPaymentProtocol◉

Nvidiaintendstoinvest$100billionintoOpenAI◉

ASML&Mistral

AIenterstrategicpartnership◉

Disinformation

campaign

spreads

deepfakes

targetingMoldova’selection◉

HiddenLayerunveilspractical

code

assistant

AI

viruses◉

Koi

discovers

the

firstmaliciousMCP

serverin

the

wild

OCT◉

OpenAIlaunchesChatGPT

Atlasagenticbrowser◉

Amazon

Bedrock

AgentCore

becomes

generally

available◉

Researchersprove

that

even

aslittle

as

250malicious

documentscanpoisonLLMs◉

TheVirus

InfectionAttack

(VIA)

is

introduced

at

NeurIPS2025◉

Deserialization

vulnerability

in

Keras

(CVE-2025-49655)isdisclosedbyHiddenLayer◉

CoSAIpublishes

AIIncidentResponseFramework

v1.0

NOV

◉

AnthropicreleasesClaudeOpus4.5◉

Googlelaunches

Antigravity-anagent-firstIDE◉

ReleaseofClawdbot(nowOpenClaw)-a

free,open-

sourcepersonal

AIassistant◉

Anthropicunveils

the

first

AI-driven,large-scale

cyber

espionagecampaign◉

Google

details

several

strains

of

novel

AI-poweredmalware◉

UK

consumers

warned

over

AI

chatbots

givinginaccurate

financial

advice◉

HiddenLayer

publishes

EchoGram-a

vulnerabilityundermining

AI

guardrails◉

GoogleGemini3DeepThink◉

Mistral

AIlaunchedtheMistral3family◉

OpenAIreleasesGPT-5.2◉

GoogleaddsMCPsupportforGoogleservices◉

WIRED

enquiryuncovers

one

of

the

firstinstances

ofdeepfake-as-a-service◉

Sexualized

deepfake

content

generated

with

Grokfloods

xAI◉

The

Chameleon’s

Trap

campaignusesphishing

emails

withhiddenpromptinjections◉

HiddenLayerresearchersport

ShadowLogicbackdoorinto

agentic

settings◉

Checkmarx

reveal

model

confusion

attacks

on

HuggingFace◉

OWASPformallylaunchestheir

AIBOMProject◉

OWASPreleasesTop10for

Agentic

Applications◉

NISTreleasespreliminary

draft

of

their

Cyber

AIProfileDEC,

2025

-

EARLY

JAN,

2026

JUL12

WHAT’S

NEW

IN

AIAyearhaspassedsinceourpreviousAIThreatReport,andthelandscapeofgenerativeAIhasshiftedsignificantly,withthepaceof

improvements

through2025matching,andinsomecasesexceeding,thatofthepreviousyear.Amongthesedevelopments,

themost

significantinclude

theevolutionofdeepreasoningmodels,alongside

smaller,highly

specializedEdge

AImodels,and

therapidpopularizationofagentic

AIsystems.2025InflectionPointsGenerative

AImodelshave

continued

to

growin

scale,

capability,

and

versatility,

and

over

thepast

12months,haveintroducednewcapabilitiessuchasreasoningandself-improvement.

Thesecapabilitieshavebecomecentral

tohowmodern

foundationmodels

operate.What

began

with

early

reasoning

models

such

asDeepSeek

and

OpenAI’s

O1

has

since

led

to

moreadvanced

foundation

models

like

OpenAI’s

GPT-5.2,

Google’sGeminiDeepThink,andClaudeOpus4.6

that

explicitlyallocate

inferencetimeto

reason

through

complex

problems

before

producingananswer.Thiscapacityforpausingandreflection

affects

how

LLMshandle

mathematical

proofs,

scientific

questions,andsituations

where

nuance

matters.While

edge

AI

may

lack

the

breadth

and

flexibility

of

cloud-based

systems,it

benefits

from

deep

specialization

tailored

tothespecificdomains

inwhich

it

isdeployed,

including

healthcare,

finance,

defense,

and

transportation.

They

also

offerbenefits

that

are

criticalinmany

environments,particularlyincriticalinfrastructure,includingimprovedprivacy,low-latencyresponses,andofflineoperation.Inaddition

tobuildinglarger

general-purposemodels,

thereis

also

a

trend

ofimproving

small,

specializedmodels

designed

for

deploymentin

smartphones,

autonomous

vehicles,IoT

sensors,andotherembeddedsystems.Theseso-calledtinymodels,compactenoughto

runentirelyon-device,

have

becomeincreasingly

desirable

as

organizations

shift

from

centralizedcloudinfrastructure

towardlocal,

or

edge-based,

deployment.ExtendedReasoningMulti-DomainProblem-SolvingGPT-5.2,Gemini3,Opus

4.6DeepSeekR1&OpenAIO1EmergentReasoningStructured

InferenceEarlyReasoningModelsNextGenerationModels13TypeDeveloperNameDescriptionInitialReleaseDateMultipurposeuser

assistantGoogleProjectMarinerAnexperimentalChromeextensioncapableofbrowsing

websites

andreasoningacrossbrowsercontent.Prototypeintroduced

inlate2024Multipurposeuser

assistantOpenAIOperatorOneof

the

first

AIagentsbuilt

tonavigate

websitesandcomplete

tasksonbehalfofusers.Nowfullyintegratedintothe

ChatGPTagent.January2025Multipurposeuser

assistantOpenAIDeepResearchModelfocusedoninformationretrievalanddata

analysis,

capable

ofperformingmulti-stepresearch

formorecomplex

tasks.Now

unifiedintoaChatGPTagent.February2025Multipurposeuser

assistantGoogleGemini2.5Introducedagenticandreasoningcapabilities.March2025Multipurposeuser

assistantAnthropicClaude

4Sonnet

&OpusModels

withagenticcapabilitiesandextended

thinking.March2025Multipurposeuser

assistantAnthropicClaude

4.5SonnetFurtherevolutionofreasoningandagentic

features.September2025Multipurposeuser

assistantAnthropicClaude

4.5OpusFurtherevolutionofreasoningandagentic

features.November2025Multipurposeuser

assistantGoogleGemini

3

&Gemini3Deep

ThinkImprovedagenticandreasoningcapabilities.December2025AgenticbrowserMicrosoftEdgeCopilotAImodeforEdgebrowser.July

2025AgenticbrowserPerplexity

AICometAbrowserwithanintegrated

AIassistantandPerplexity’s

AIsearch

engine.March2025AgenticbrowserOpenAIChatGPTAtlasAbrowser

withabuilt-inChatGPTagent.October2025AgenticbrowserOperaNeonAbrowser

withagenticcapabilities.December2025CodingassistantCognitionWindsurfAgenticIDE.November2024;acquiredbyCognition

in

July2025CodingassistantAnthropicClaude

CodeTerminal-first

AIcodingassistant

thatdeeplyunderstands

full

codebasesusingagenticsearchto

scan

andinterpret

entire

projects

withoutmanual

fileselection.February2025The

conversation

around

autonomous

AI

agents

gained

momentum

in2024,

but

itwasn’t

until2025that

things

truly

began

to

take

shape.

The

shift

from

experimental

demonstrations

toproduction-grade

systems

occurredrapidly,asmajorvendorsexpandedAIcapabilitiesbeyondquestionanswering

into

autonomous

task

execution.AI

agents

vary

widely

in

form

and

function,

with

applicationsspanning

a

broad

range

of

use

cases.

Forthe

purpose

ofsimplicity,twoprimarycategoriesofAIagents

emerged

in

2025:general-purpose

agents,which

are

multifunctional,

desktop-integrated

assistants,

and

application-specificagents,

designed

to

operate

withinnarrowly

defined

softwareenvironments.Belowareafewhigh-profilepioneeringexamples,asseveralbusinessesacrosssectorsfollowedwiththereleaseoftheirown

solutions.

H

DD

N

AYE14TypeDeveloperNameDescriptionInitialRelease

DateCodingassistantOpen

AICodexagentCloud-basedsoftwareengineeringagent.May

2025CodingassistantAWSKiroAgenticIDE.July2025(preview),

November2025(GA)CodingassistantGoogleAntigravityEnablesdeveloperstodelegate

complex

coding

tasks

to

autonomous

AIagents.November2025AIautomationframeworkn8nGmbHn8nAnAI

workflowautomation

framework

thatevolvedintoan

agenticsolution.Late2024

-

early2025AIagentplatformServiceNowAI

AgentOrchestratorAcentralmanagementsystemfor

AI

agents

specializedinIT

servicemanagement,HR,CRM,andriskmanagement.January2025AIautomationframeworkMicrosoftAg