Agent washing: how to tell a real autonomous agent from a rebranded chatbot before you sign

What is agent washing, and why did Gartner count only about 130 real vendors?

Agent washing is the practice of dressing up existing software, chatbots, RPA scripts, virtual assistants, in the language of autonomous agents without adding the underlying capability. The word does the selling; the product stays the same. Gartner named the pattern directly and estimated that only about 130 of the thousands of vendors claiming to be agentic actually are (RCR Wireless³). The distinction matters because the two categories fail differently. A chatbot that overpromises frustrates users. An “agent” trusted with consequential work it cannot safely perform creates real exposure.

The cost of getting this wrong is already visible in the forecast. Gartner predicts more than 40% of agentic AI projects will be canceled by the end of 2027¹, pointing to escalating costs, unclear business value, and inadequate risk controls. Read that list as a buyer, not a headline: two of the three failure modes are things you can screen for before you sign. Unclear value and weak controls are questions you ask in procurement, and the vendors who cannot answer them are usually the ones who leaned hardest on the label.

What four capabilities does a real AI agent have that a chatbot doesn’t?

Strip away the marketing and an autonomous agent is defined by what it can do, not what it can say. A chatbot responds inside a conversation; an agent pursues a goal across steps, tools, and systems, and stays accountable while it does. Four capabilities separate the real thing from a rebrand. Use them as a checklist, because a genuine agent clears all four, and most agent-washed products fail at least one, usually the last.

• Goal-directed action: it plans and executes multi-step work toward an objective, rather than answering one prompt at a time.
• Tool use with real effect: it can call tools and take actual actions in your systems, not just describe what someone should do.
• Bounded, reversible autonomy: its actions have limits and an undo path, so a wrong move is contained rather than catastrophic.
• Verifiable accountability: it produces an independently checkable record of what it did, so you can confirm actions without taking the vendor’s word.

How do you test whether an AI agent can actually prove what it did?

The first three capabilities are about power, can it act? The fourth is about trust, can it prove it acted correctly? Put that question at the top of your evaluation, because it is the one agent washing cannot fake. A chatbot in a costume can be scripted to look goal-directed in a demo. What it cannot produce is a record of its actions that you can verify yourself, without trusting the dashboard that generated it. “Independently verifiable” has a precise meaning: a third party, or you, can confirm the agent did what it claims using evidence the vendor cannot quietly alter after the fact.

This is where most “agent” pitches quietly downgrade. Ask how you would prove, three months from now, that a specific action happened as recorded, and watch whether the answer is a verifiable receipt or a screenshot. Internal logs are better than nothing, but logs a vendor controls prove very little when something goes wrong. The stronger answer is a cryptographically signed, tamper-evident trail: each action carries its own proof, anchored so that after-the-fact edits are detectable. RankShield’s helix is built around exactly this, an agent that can prove what it did, not merely assert it. Make “can it prove its actions?” the first line of your buyer’s test, not the last. See the deeper treatment on verifiable AI security.

What does agent washing cost the buyer who gets it wrong?

It costs more than a disappointing demo, because the failure shows up after you have already built around the tool. The visible cost is the cancelled project: Gartner’s expectation that more than 40% of agentic initiatives will be scrapped by the end of 2027¹ is, in part, agent washing coming due, software that could never do the autonomous work its label promised, discovered only once real tasks and real budgets were riding on it. By then you have paid twice, once to adopt and integrate, and once to unwind and replace, plus the opportunity cost of the months in between.

The less visible cost is risk you cannot see until it fires. An agent-washed product trusted with consequential work, moving money, changing records, acting in your systems, without genuine bounds or a verifiable trail, is exposure disguised as productivity. When something goes wrong, the same missing capability that made it agent-washed, no independently checkable record, means you cannot even reconstruct what happened cleanly. That is why the verifiability question is not a nice-to-have at the bottom of an evaluation; it is the single screen that most reliably separates the tools that will survive contact with production from the ones that will become the cancelled 40%. Screening for it in procurement is far cheaper than discovering its absence during an incident.

Is the vendor a real agent or a chatbot in a costume?

Score a vendor against the same five checks a real evaluation uses. Answer honestly, because the bands are calibrated to Gartner’s finding that most self-described agentic vendors are not the real thing. The value of scoring rather than eyeballing is that it forces the uncomfortable question on each axis: not “does the demo look autonomous,” but “can it act, stay bounded, and prove it,” one capability at a time. A vendor can dazzle on one axis and quietly fail another, and it is almost always the last axis, verifiable accountability, where the costume slips.

What questions should you put in your agentic AI RFP?

Turn the field test into procurement language. Drop these ten questions into your RFP verbatim; the ones a vendor dodges tell you as much as the ones they answer. Weight the verifiability and control questions most heavily, because they are the hardest to agent-wash and the most expensive to discover you lack after go-live.

• Describe a task the product completes end to end, autonomously, and name the specific steps it plans and executes.
• Which real actions can it take in our systems, and which are read-only or human-in-the-loop?
• What bounds constrain its autonomy, and how do we configure or tighten them?
• When it takes a wrong action, what is the undo path and how fast does it reverse?
• How does it produce an independently verifiable record of each action, and can we check that record without your dashboard?
• Is the action trail tamper-evident, so an after-the-fact edit would be detectable by us or a third party?
• Can we watch the agent live and stop it mid-task with a kill switch?
• What happens to in-flight actions when we halt it, are they rolled back or left partial?
• What concretely distinguishes this from the chatbot, RPA, or assistant we may already own?
• What is the measurable business outcome, and how do we verify it rather than take it on faith?