Level : Intermediate
The limits and failures of AI agents today
By The Info Agent IA editorial team ·
AI agents still fail often for five reasons: errors that carry over from one step to the next, made-up information, traps hidden in the pages they read, costs that climb fast and websites that shut them out. None of this rules them out, but it does mean choosing carefully what you hand over and keeping control of the actions that matter.
Why an agent fails more often than a chatbot
A chatbot answers a question: if it is wrong, you read a wrong answer. An AI agent receives a goal and chains several actions on its own to reach it: searching, clicking, filling in, sending. Every step is another chance to slip, and the mistake no longer stays on the screen: it can become an action.
If you are new to the topic, our complete guide to AI agents explains how they work first. Here, we look at what breaks.
| Limitation | What happens | Your safeguard |
|---|---|---|
| Compounding errors | A small early mistake skews everything after it | Split the task, check the key steps |
| Hallucinations | The agent invents data or claims it is done | Check the result, not the report |
| Prompt injection | A booby-trapped page hijacks the agent | Limit its access, approve sensitive actions |
| Cost | One task uses many model calls | Estimate first, set limits |
| Blocking websites | Login refused, captcha, account flagged | Keep a manual plan B |
Compounding errors
An agent works in loops: it observes, decides, acts, then observes the result. Our article on how an AI agent makes decisions walks through this cycle. Its weak point is simple: each decision rests on the previous one. If the agent misreads a date at the start, it books the wrong day, then notifies the wrong person, and the whole chain unfolds with perfect apparent logic.
You also see loops (the agent repeats the same action endlessly), silent give-ups and misreadings of badly built pages. The longer the task, the more likely these accidents become.
The lesson applies to every use: an agent can succeed at the task you asked for and break something else along the way. Check the final result, not just the “done” message.
Hallucinations, agent edition
A hallucination is false information stated with confidence. In an agent, it takes particular forms: inventing an order number to fill a required field, citing a page it never actually opened, or announcing that an email went out when it is still sitting in drafts.
That last case is the trickiest. The agent’s report is itself produced by the model, so it can be just as wrong as the rest. Open the folder, the outbox or the basket to see what really happened.
Check yourself An agent tells you: 'Your appointment is confirmed for Thursday at 10am.' What do you do before writing it down?
You check the proof at the source: the confirmation email from the practice, your account on the website or your calendar. The agent’s message is a summary produced by a language model, not proof that the action went through.
Prompt injection: when a page gives orders
This is the risk most specific to agents. A language model struggles to tell its user’s instructions apart from the text it is reading. A sentence hidden in a web page or an email, for example written in white on a white background, can tell it to do something other than what you asked. That is prompt injection.
For a chatbot, the outcome is a strange answer. For an agent connected to your inbox or your accounts, it can be forwarded emails or a purchase. Browser agents such as Comet are especially exposed, because they read pages written by anyone while your sessions are logged in. Our guide to AI browser agents covers the right habits.
The best defence remains structural: a human in the loop for any payment, message or deletion, and a sandbox, meaning an isolated space where the agent can only reach what it strictly needs.
Cost: one task, dozens of calls
A question to a chatbot is one round trip to the model. An agent task is a series of calls: at each step, the agent sends the model its instructions, its history and what it has just seen. The volume of tokens, the word fragments used as the billing unit, therefore climbs quickly, and the cost follows.
Price gaps between models are huge. As of 22 October 2026, according to models.dev, the price per million tokens for input ranges from $0.10 for Claude Haiku 5.5 or GPT-6 Luna to $10 for GPT-6 Astra:
For consumers, this cost shows up differently: agent features locked behind subscriptions, credits that run out or monthly quotas. At Perplexity, for example, the assistant that acts inside Comet is not part of the free plan. Before starting a project, the AI agent cost calculator gives you a ballpark figure.
Websites that shut agents out
The last limitation is far from the least: part of the web does not want agents. On 4 November 2025, Perplexity published a post, “Bullying is not innovation” (accessed 22 October 2026), denouncing a legal demand from Amazon that Comet users be stopped from shopping on Amazon with their agent.
The issue grew in autumn 2026. In a post dated 6 October 2026 (accessed 22 October 2026), Meta acknowledges that a site owner “might reasonably worry” about personal agents, such as its own Muse agent: “load spikes, abuse, liability”. The company argues that turning away a personal agent means turning away the customer behind it, and proposes an open standard, the Personal Agent Protocol, to govern these exchanges.
Even without an explicit ban, an agent can run into anti-bot systems: captchas, identity checks, accounts flagged for suspicious activity. These protections target malicious programs, but an agent looks a lot like a program.
Short memory and long tasks
An agent only keeps what fits in its context window, the amount of text the model can handle at once. On a long task, the opening instructions, a constraint mentioned in passing or a preference expressed the day before can drop out of view. The agent then carries on confidently, but on an incomplete basis. It is better to restate the important constraints at each new step, or to write them in a document the agent rereads.
What remains uncertain
These limits explain why full autonomy is still rare, as we explain in can autonomous AI agents really work on their own?. Before delegating, put your task through its paces:
Frequently asked questions
Can an AI agent get something wrong without telling you?
Yes. An agent can skip a step, misread a page or report that a task is finished when it is not. Always check the final result, especially when it involves money, messages sent or files changed.
Is prompt injection really a danger for ordinary users?
The risk is real as soon as an agent reads pages or emails written by strangers while having access to your accounts. A hidden instruction can try to hijack it. Limit its access, use a separate profile and approve sensitive actions yourself.
Why do some websites refuse AI agents?
Site owners point to security, server load, fraud or losing direct contact with the customer. Anti-bot systems, built to stop malicious programs, also often catch agents. As a result, a task can fail even when the agent itself did nothing wrong.
Does an AI agent cost more than a chatbot?
Usually yes, because an agent makes many calls to the model for a single task and rereads its context at every step. That is why agent features are often limited to paid plans or counted in credits.