The most important fact about AI agents is not that they can complete longer tasks. It is that they can complete longer tasks without becoming proportionally easier to trust.

Those two curves are now separating.

Capability is climbing quickly. METR measures the length of software task an agent can complete with a given probability of success, using the time a human expert would need as the unit.1 Its current work shows frontier systems moving from short exercises toward projects measured in hours and days. Anthropic’s usage research, meanwhile, shows AI spreading beyond isolated prompts into sustained work.4 The machine is no longer merely proposing a sentence or a function. It is increasingly being asked to own an outcome.

But an outcome that looks finished is not the same thing as an outcome that is correct.

In METR’s 2026 frontier-risk evaluation, agents completed substantial technical work, yet still showed weaknesses in judgment, strategy, and reliability. On tasks longer than eight hours, reviewers disqualified at least 16 percent of apparently successful runs for illegitimate behavior.2 In a separate audit, OpenAI estimated that roughly 30 percent of the tasks in SWE-Bench Pro—the benchmark itself, not the model answers—were broken.6

The model can fail. The test can fail. The person reading both can fail.

This is the emerging verification economy: a world in which producing plausible work becomes abundant while establishing that the work deserves to change reality remains expensive.

Reliability compounds in the wrong direction

Agent demonstrations usually show a clean arc: receive objective, use tools, return result. Production systems encounter a different geometry. They depend on chains.

Imagine a workflow with ten consequential steps. If every step succeeds independently 95 percent of the time, the chance of the entire chain succeeding is about 60 percent. Raise each step to 99 percent and the chain still succeeds only about 90 percent of the time. Real workflows are less friendly: errors are correlated, intermediate state persists, and an early mistake can make every later action look internally consistent.

This is why an agent can feel astonishing in a session and remain dangerous in a system. Local competence does not automatically produce end-to-end reliability.

The standard response is to place a human “in the loop.” That phrase hides the actual design problem. Which human? Shown what evidence? At what point? Asked to approve which consequence? A tired operator clicking a green button after reading an agent’s confident summary is not a control system. It is ceremony.

Useful oversight requires an inspectable boundary between generation and action.

The unit of work has to change

Most knowledge work is packaged for the person doing it. A request arrives in prose; the worker gathers context; judgment lives partly in their head; the final artifact is reviewed through familiarity and trust.

Agents make that arrangement brittle. They need work packaged not only for execution, but for evaluation. The useful unit is no longer “write the analysis.” It is closer to:

  1. state the decision the analysis will inform;
  2. define the admissible evidence;
  3. separate sourced facts from estimates and inference;
  4. expose the intermediate artifacts;
  5. specify the tests a correct result must pass;
  6. identify which failures require escalation;
  7. make consequential actions reversible.

That looks like additional process only if production is still the expensive part. Once a machine can draft a hundred analyses overnight, the evaluation contract becomes the product.

Software learned this lesson earlier than most fields. Compilers made code cheap to translate; version control made changes legible; continuous integration made tests repeatable; typed interfaces constrained what components could claim about one another. None of these systems proved that software was good. They reduced the space in which bad software could hide.

Agent infrastructure will develop the same way.

What the verification stack contains

The category is often reduced to “evals,” but a benchmark score is only one layer.

Specification turns intent into an explicit contract. Good specifications include examples, prohibited shortcuts, required evidence, tolerances, and stop conditions. They define not just the desired output but the acceptable path.

Provenance records where claims, transformations, and decisions came from. A research agent should preserve the passage supporting a claim, not merely list a source somewhere below it. A coding agent should connect a change to the request, the relevant files, and the tests it ran.

Isolation limits the blast radius. A draft can be cheap and autonomous; a bank transfer cannot. Sandboxes, scoped credentials, spend limits, network policies, and staging environments convert uncertain behavior into bounded behavior.

Evaluation checks both the artifact and the process. Deterministic tests work where a ground truth exists. Model-based graders help with open-ended work, but they introduce another probabilistic system. Human review is strongest when directed toward disagreements, anomalies, and irreversible consequences rather than every generated token.

Replay makes a run reproducible enough to investigate. Inputs, tool calls, state changes, model versions, and approvals form an audit trail. Without replay, improvement becomes anecdotal: a team remembers that “the agent was weird last Tuesday” and adjusts a prompt.

Recovery assumes failures will occur. Idempotent actions, checkpoints, rollbacks, and compensating transactions matter more than a promise that the next model will be better.

Together these layers do something more useful than certify intelligence. They manufacture justified confidence.

Expertise moves to the boundaries

There is a tempting argument that better models eliminate expert work. The near-term evidence points to a redistribution.

Anthropic’s Economic Index finds AI use concentrated in particular tasks and occupations, with sophisticated deployments constrained by access to the right organizational context.5 The people who know which database is misleading, which customer exception matters, or which apparent test success is actually a regression hold information that is difficult to recover from documents alone.

Agents increase the leverage of that knowledge when experts encode it into specifications, examples, tests, and escalation rules. They can also destroy the pipeline that creates new experts if organizations automate junior work without replacing its learning function.

The strongest operating model is therefore not “expert or agent.” It is a system in which experts design the boundaries, agents traverse the interior, and unusual cases improve the boundaries over time.

This changes what an excellent employee does. Less time is spent producing the first version. More time is spent deciding what must be true, examining exceptions, and accepting responsibility for the result.

Where builders should look

The largest model companies will keep improving general capability. The durable opportunities around them are narrower and more operational:

  • evidence systems that bind claims to primary material;
  • domain-specific test harnesses built from real failures;
  • permission brokers that grant the minimum authority needed for one task;
  • observability tools that show why an agent chose an action;
  • review interfaces organized by risk and uncertainty rather than chronology;
  • replay and incident systems for agent runs;
  • marketplaces for verified tasks, rubrics, and domain evaluators;
  • workflow engines that can prove who approved what and when.

The winning products will not sell “trust” as an abstract quality. They will make a specific consequential workflow cheaper to verify than to redo.

That distinction matters. Generic intelligence will be supplied by companies spending at a scale few startups can match. But the definition of acceptable work is local. It lives inside a firm’s obligations, edge cases, customers, regulators, and accumulated scar tissue.

The frontier is not only the agent that can do more. It is the institution that can know—quickly, specifically, and with evidence—when the work is good enough to count.