Agent washing: how to spot a fake AI agent

Agent washing means calling an existing chatbot, assistant or fixed automation an AI agent without giving it meaningful control over how it gets work done. The label promises that you can hand over a task, while the product still leaves you choosing every step. Run these five checks on work you understand, then come back the next day before deciding how much to trust it.

The short version

A real AI agent chooses and carries out steps toward a goal within the authority you give it.
A useful test includes a changed condition and a result you can inspect yourself.
A readable record must connect the request to the actions and their actual results.
Permission limits need enforcement outside the agent's own instructions.
Work that survives a restart saves you from becoming the agent's memory between sessions.

What is agent washing?

Agent washing, also written as agentwashing, is a capability claim that the product's behavior does not support. Giving a chatbot a new name does not make it able to pursue a goal. Adding a language model to a fixed sequence does not, by itself, give the software control over what happens next.

Gartner described the practice on June 25, 2025, pointing to existing assistants, chatbots and robotic process automation being relabeled without substantial agent capabilities. Our chatbot, agent and AI operating system comparison explains the categories. This test is about whether the product in front of you does the work it claims.

The subject has continued into 2026. Gartner published Avoiding Agent Washing: Spotting Real AI Agents and What Makes Them Different on September 17, 2026. Its public abstract establishes the topic and date; the research itself requires access.

Why does every product suddenly call itself an agent?

The label is easy to stretch. A product can choose a tool once, follow a fixed sequence afterward, and still look autonomous in a rehearsed demonstration. Another can do substantial work independently but require approval before a consequential action. Calling both an agent tells you little about what you will have to do yourself.

In InformationWeek's July 21, 2026 guide, IBM solutions architect Karthik Karunanithi put the demo problem plainly: "Every vendor can make a demo look autonomous." A demonstration with a known input leaves out the moment the software needs something its maker did not anticipate.

A loose label is not proof of fraud. A fixed workflow can be exactly what a repetitive job needs, and a chatbot can be useful without acting independently. The trouble starts when you expect to leave the work to it and discover that you are still running the process. Decide how much of the job you expect it to take off your hands, then test that.

How do you test whether something is really an AI agent?

Use a disposable copy of a real task, with made-up account details and no route to send messages or change live records. For example, give it a folder of sample documents and ask it to produce a draft comparison that identifies missing information. Decide what a correct result looks like before starting. The following are tests to run, not reported customer results.

1. Give it a goal without supplying the steps

Ask it to compare the supplied documents and save a draft explaining the differences that matter. Give it the scope and the stopping point, then let it choose how to proceed. Do not coach it through opening each file.

A pass means it selects the relevant material, carries out the work and checks the saved draft against your goal. A fail means it gives you instructions to do the job or needs a new prompt for every action. If that is all it can do on this task, you have demonstrated a chat assistant rather than independent execution.

Asking you to resolve a genuinely ambiguous instruction is sensible. Choosing every intermediate step for it is a different level of involvement. Record where your help was necessary.

2. Break something halfway through

Rename a copied input file after work begins, or include two sample documents with conflicting dates. Change one condition at a time so you can tell what caused the response.

A pass means it notices the problem and makes a justified adjustment within its access. If it cannot resolve the conflict, it should identify the missing decision and pause. A fail means it repeats the same unsuccessful action, invents the missing information or claims success while silently leaving part of the job undone.

Recovery does not mean forcing a task to finish at any cost. An agent that stops at the right boundary can pass this check. Run a variation it has not just been shown; a prepared exception branch alone tells you little about how it handles a different problem.

3. Ask for the record

Inspect which input versions it read and where it saved the output. Check the changes against the access you granted. The record should also show failed actions and how the product checked the final result.

A pass lets you follow the work from your instruction to the saved artifact without relying on the agent's retelling. A fail leaves you with a completion message, a polished explanation or a conversation that says it edited a file you cannot find. The chat may help explain the run; claims inside it still need something you can check.

Require action records and observable results. You do not need access to private model reasoning. Our guide to evidence and audit trails for AI agents explains what makes a record useful when work goes wrong.

4. Ask it to do something it should not be allowed to do

In the test environment, give it read access to a sample file and explicitly deny changes. Then ask it to overwrite that file. Check the tool or account configuration that enforces the denial, and verify that the file stayed unchanged. If the product offers another route to the same file, test that route too.

A pass requires a restriction that remains in force even if the agent attempts the action. A refusal in the conversation is not enough to establish that. A fail means the product can make the change despite the configured restriction, or the only restriction is an instruction it can disregard.

If you cannot inspect or test enforcement, mark this check unknown. Do not count a reassuring response as a pass. The distinction between a request and an enforced limit is the starting point for deciding how much access an AI agent should have.

5. Stop it and come back tomorrow

Pause with part of the comparison unfinished. Save a note for yourself about what has actually completed, then close the session. The next day, use the product's supported restart or resume process without pasting the task back in.

A pass means it can identify the unfinished work from saved state, check that the inputs still match, and continue under the same permission limits. It should distinguish completed actions from planned ones. A fail means you have to reconstruct the assignment, it repeats completed changes, or it remembers the conversation while losing the work.

A transcript archive can help, but remembering what was said does not establish what was done. That difference explains why AI agents forget between sessions and becomes costly when long tasks need repeated recovery.

Why can a real agent still fail the last two checks?

An agent can choose its next step correctly and still have permission to overwrite the wrong file. It can finish half a task and lose track when the session closes. Planning alone does not keep a restriction in force or save the work needed to resume.

When a product keeps the task inside a temporary session, closing that session can remove information it needs to resume. When its tools act through an account with broader access than the task requires, a written instruction to stay inside a folder does not reduce the account's reach. These are concrete failure modes to investigate, rather than reasons to declare every app-based agent fake.

The agent is often a guest in an environment organized around a person. Someone still has to hold the task together when the app loses track. Our analysis of bolted-on agents covers that operating system mismatch.

Keep the verdict precise. A product that chooses actions and adapts to a changed condition may be a real agent even if it fails the permission or restart check. It has not earned unattended access to that job. Passing all five requires dependable support for memory, enforced permissions, evidence and recovery. An application can build or use that support; these checks do not prove that a new operating system is the only way to provide it.

Is agent washing illegal?

A failed capability test does not establish a legal violation. Regulators have, however, taken action over misleading AI claims. The cases below concern AI washing, not agent washing.

On March 18, 2024, the SEC announced settled charges against Delphia and Global Predictions over false and misleading statements about their use of AI. The firms agreed to civil penalties of $225,000 and $175,000, respectively, without admitting or denying the findings.

The FTC's September 25, 2024 Operation AI Comply announcement included a proposed settlement with DoNotPay over claims that its service could substitute for a human lawyer's expertise. The announced proposal required a $193,000 payment. The FTC alleged that the company had not tested whether the chatbot's output matched a human lawyer's level.

Those announcements show enforcement over claimed AI capabilities. They do not establish a legal definition of an agent or decide whether a particular agent label is unlawful. This is a description of the cited cases, not legal advice.

What should you ask for instead of "an agent"?

Write the requirement as work you can observe. For the sample comparison, that could be: "Choose the steps needed to compare these files and save a draft. Report conflicting inputs. Keep the originals unchanged. Preserve the unfinished task across a restart, and leave a record I can check against the files."

Repeat the test with a changed input before widening access. A pass establishes what happened on that task, with those settings. It does not certify the product for every job.

If you need the work to continue across sessions, the product has to save enough to resume without making you reconstruct the assignment. That is the case for an operating system built for an AI user. eFreedom is the company building ERIKA, its one product, an operating system where the user is purely AI. That is the product direction, not a claim that it has passed the five checks above.

Frequently asked questions

What is agent washing in simple terms?

Agent washing means giving an existing chatbot, assistant or fixed automation an agent label without adding meaningful control over how it gets work done. Test what the product can carry out without you choosing every step.

How can you tell if a product is really an AI agent?

Give it a goal without supplying the steps, change a condition halfway through, and inspect the result. Then check its action record, test an enforced permission limit in a disposable environment, and resume unfinished work after a restart. These checks establish behavior on that task, not a universal certification.

What is the difference between AI washing and agent washing?

AI washing concerns misleading claims about AI use or capability. Agent washing concerns claims that software can act toward a goal with more independence than it demonstrates. The SEC and FTC cases discussed here concerned AI claims, not agent claims.

Are the 40% cancellation prediction and 130 real vendors figure current?

Both came from Gartner's June 25, 2025 release. It predicted that over 40% of agentic AI projects would be canceled by the end of 2027 and estimated about 130 real vendors among thousands. They are a dated prediction and estimate, not a measured cancellation rate or a current vendor count.

Is automation with AI in it a bad thing?

No. A fixed workflow can suit a repetitive job, and a chatbot can help without acting independently. Require the behavior your task needs and test it. A product should not need an agent label to justify useful work.

Sources

Sources checked October 22, 2026. The five checks are our proposed evaluation method. Gartner's 2026 research is cited only for its public title and publication date.

Written by Max Medawar, founder of eFreedom, in Silicon Valley.