“The vast majority of people are using AI as a chatbot for simple interactions that approximate next-generation search. This is super useful but dramatically underrepresents the full capability of AI. On the complete other end of the spectrum, agent swarms represent possibly the ultimate form factor of what agents will do inside of our workflows.” – Aaron Levie – Box CEO
The strategic gap in enterprise AI is no longer access to a capable model. It is the distance between asking a system for an answer and giving it responsibility for a bounded result. A chatbot compresses search, drafting and explanation into a convenient interface. An agent changes the operating model by interpreting an objective, selecting actions, using tools, checking intermediate results and escalating when uncertainty or authority limits are reached. The distinction matters because productivity gains from assistance are usually local, while workflow automation can alter how an organisation allocates labour, control and accountability.1
Levie’s position reflects an adoption pattern visible across business. Employees often begin with low-risk interactions: summarising documents, rewriting messages, finding information or generating first drafts. These uses are valuable because they require little integration and preserve human judgement. They also make AI easy to evaluate through personal experience. Yet they leave the underlying workflow intact. The worker still gathers inputs, decides what matters, moves information between systems and accepts responsibility for the final action. The model accelerates a task without necessarily changing the chain of work.
The next stage introduces agency. An agent can be assigned a goal such as resolving a support case, preparing a procurement recommendation or monitoring a software deployment. It may need to retrieve records, apply policies, call an application programming interface, compare alternatives and request approval before committing an irreversible step. McKinsey describes agents as systems capable of planning and executing multiple steps in a workflow, rather than merely producing a response to a prompt.1 That capability moves the central question from ‘What can the model write?’ to ‘What work can the organisation safely delegate?’
From answers to delegated outcomes
The economic distinction is significant. A chatbot mainly increases the output of an existing employee, while an agent can coordinate a sequence that previously crossed several roles and software systems. The gain may come from lower waiting time, fewer hand-offs and continuous monitoring rather than from faster text generation. In a mature deployment, the user supplies an objective and constraints, not a detailed sequence of instructions. The system then performs routine orchestration while people focus on exceptions, judgement and relationships.
That promise should not be confused with autonomy without limits. An agent is useful only when its authority, information and success criteria are clearly defined. A system that can edit a document is different from one that can send it externally; one that can recommend a payment is different from one that can execute it. Risk rises with the sensitivity of the data, the reversibility of the action, the breadth of connected tools and the speed at which decisions propagate. The relevant design unit is therefore not the model alone but the model, tools, permissions, workflow and oversight mechanism operating as one system.
Agent swarms extend this logic by distributing a complex objective among specialised agents. One may gather evidence, another may test an assumption, a third may plan execution and a fourth may review the proposed result. In theory, parallel work can reduce latency and allow each component to operate within a narrower role. In practice, coordination creates new failure modes. A mistaken assumption can be copied across the group, conflicting instructions can produce circular work and a weak reviewer may approve an error generated by another agent. Safety cannot be inferred simply by checking each component in isolation.
Adoption is ahead of transformation
Current enterprise adoption supports a more measured reading of the opportunity. McKinsey reported that 23 percent of respondents said their organisations were scaling an agentic AI system in at least one function, while a further 39 percent had begun experimenting with agents; most scaling remained limited to one or two functions.1 The figures indicate substantial interest but not universal operational maturity. They also suggest that experimentation is easier than redesigning the processes, data access and governance needed for dependable deployment.
This helps explain why chatbot use can appear ubiquitous while agentic transformation remains uneven. Chatbots fit existing procurement, security and user habits. They can often be introduced through a browser or workplace application, with a human reviewing the output. Agents demand deeper integration with identity systems, records, permissions, audit trails and escalation procedures. They also expose process weaknesses that conversational interfaces can conceal. If ownership is unclear, data is inconsistent or approval rules are undocumented, automation does not remove the problem; it turns the ambiguity into a machine-speed operational risk.
The most credible early use cases are consequently narrow, measurable and reversible. Internal knowledge retrieval, software testing, service triage, document classification and routine reconciliation can provide useful evidence without granting unrestricted authority. Leaders can compare completion time, error rates, rework, escalation frequency and user satisfaction before expanding the system. A staged approach also makes it possible to identify whether value comes from the agent itself or from process improvements that would have been beneficial regardless of the technology.
The governance problem
Security becomes more difficult when agents can act through a user’s credentials. NIST has highlighted risks including unauthorised access, data exposure, privilege expansion and unintended actions in agentic architectures.5 A connected agent may read email, access files, query customer systems and communicate externally. If malicious instructions are hidden in retrieved content, an agent may treat them as legitimate guidance, a threat commonly described as indirect prompt injection. The danger is not limited to a poor answer; it can involve a sequence of authorised-looking actions with real consequences.14
Multi-agent systems magnify the governance challenge because authority can move through delegation chains. A parent agent may ask a specialist to investigate, the specialist may invoke another service and the resulting output may influence a consequential decision. Every hand-off introduces questions about identity, scope and accountability. Organisations need explicit permissions, time-limited access, comprehensive logs, approval gates for high-impact actions and a reliable means of stopping agents and revoking their credentials. Human oversight must be operational rather than ceremonial: a nominal shutdown button is not meaningful if the system has already acted faster than people can review it.
There is also a debate about whether swarms are the ultimate form factor or simply one design pattern among several. More agents do not automatically produce more intelligence. Coordination overhead, duplicated work and correlated errors can outweigh parallelism. A single well-integrated agent with clear tools and strong evaluation may outperform a swarm assembled primarily to signal sophistication. The decisive test is not the number of agents but whether the architecture improves outcomes under realistic constraints, including incomplete information, adversarial inputs, changing policies and failures in connected systems.
The strategic implication for technology leaders is to treat agent deployment as an organisational redesign programme. Begin with a process whose objective, owner and risk boundary are explicit. Separate recommendation from execution, grant the minimum necessary access and record every material action. Evaluate not only average performance but also rare failures, escalation quality and recovery after interruption. As capability expands, preserve a clear human hierarchy for decisions that affect money, rights, safety, reputation or access to sensitive information.
The movement from conversational assistance to delegated workflows will be consequential because it changes where judgement sits. Chatbots make intelligence easier to access; agents attempt to make action easier to coordinate. The opportunity is substantial, but the transition will be durable only when autonomy is matched by authority controls, measurable accountability and processes designed for intervention. Adoption statistics show that organisations are beginning this shift, while the security and governance evidence shows why scaling it responsibly requires more than connecting a model to more tools.1,5,7
References
1. The state of AI in 2025: Agents, innovation, and transformation – 2025-11-05 – https://www.mckinsey.com/capabilities/growth-marketing-and-sales/our-insights/the-state-of-ai-2025
2. The State of AI: Global Survey 2025 – 2025-11-05 – https://www.mckinsey.com/capabilities/quantumblack/our-insights/the-state-of-ai-2025
3. www.mckinsey.com › ~ › mediaThe state of AI in 2025 Agents, innovation, and transformation – https://www.mckinsey.com/~/media/mckinsey/business%20functions/quantumblack/our%20insights/the%20state%20of%20ai/the-state-of-ai-in-2025-vf.pdf
4. Seizing the agentic AI advantage – 2025-06-13 – https://www.mckinsey.com/capabilities/quantumblack/our-insights/seizing-the-agentic-ai-advantage
5. INSTRUCTIONS (16×9 aspect ratio) – NCCoE – NIST – https://www.nccoe.nist.gov/sites/default/files/2026-05/Cyber-AI-Profile-Working-Session-Extending-Tech-Content-Slides-Slido.pdf
6. The state of AI in 2025: Agents, innovation, and transformation – 2026-08-25 – https://www.mckinsey.com/capabilities/quantumblack/our-insights/the-state-of-ai?field_insight_category_target_id=481&page=,,3
7. Agentic AI Risk-Management Standards Profile – CLTC Berkeley – 2026-04-22 – https://cltc.berkeley.edu/publication/agentic-ai-risk-profile/
8. NIST AI Risk Management Framework: Agentic Profile – Lab Space – 2026-04-02 – https://labs.cloudsecurityalliance.org/agentic/agentic-nist-ai-rmf-profile-v1/
9. CAISI RFI Regarding Security Considerations for Artificial … – https://cltc.berkeley.edu/wp-content/uploads/2026/03/AISI_Response_AI_Agents_RFI.pdf
10. AI at work but not at scale – 2025-12-10 – https://www.mckinsey.com/featured-insights/charts/ai-at-work-but-not-at-scale
11. [PDF] NIST RFI Response: Security Considerations for Artificial … – https://futureoflife.org/wp-content/uploads/2026/04/FLI_NIST_RFI_Response_Security_Agents.pdf
12. Agents, innovation, and transformation | Loïc Cadiot – LinkedIn – 2025-12-06 – https://www.linkedin.com/posts/loic-cadiot_the-state-of-ai-in-2025-agents-innovation-activity-7402990406814085120-7BeO
13. Agentic AI Governance: NIST Standards for Autonomous … – 2026-03-22 – https://labs.cloudsecurityalliance.org/research/governance-nist-ai-agent-standards-agentic-governance-v1-csa/
14. action – https://www.federalregister.gov/documents/full_text/html/2026/01/08/2026-00206.html
15. The State of AI: Global Survey 2025 – McKinsey – 2026-08-25 – https://www.mckinsey.com/capabilities/quantumblack/our-insights/the-state-of-ai?page=57&onlycontent=1
