In September 2025, Marc Benioff went on a podcast and said Salesforce had cut its customer support staff from about 9,000 people to roughly 5,000, because it now had AI agents at work on a large share of the conversations. A few months earlier, the Swedish fintech Klarna had done the opposite: after boasting that its AI assistant was doing the work of 700 agents, its CEO admitted the push had gone too far and started hiring humans again. Both companies were using the same kind of technology. They drew very different conclusions.
That split captures where AI agents at work stand in the fall of 2026. The tools are real, every major software vendor sells them, and some genuinely save time. They also fail in ways a chatbot never could, because an agent acts: it sends the email, updates the record, runs the code.
If you run a small Canadian company and wonder whether to try one, here’s what agents can do today, where they break, and how to test one without betting the business.
What an “agent” actually is (and what it isn’t)
Strip away the marketing and an AI agent is a large language model wired up to tools. Instead of producing text for a human to read, it produces a plan, calls a tool (a search engine, a CRM, a spreadsheet, a code interpreter), reads the result, and decides what to do next. It loops until it thinks the job is finished or it gets stuck.
Two things made this practical. The first is plumbing. The Model Context Protocol, which Anthropic released as an open standard for connecting AI models to outside systems, was handed to the Linux Foundation’s new Agentic AI Foundation in December 2025, alongside OpenAI’s AGENTS.md format and Block’s goose agent, with Google, Microsoft and AWS among the supporters, according to CIO Dive. That means the connector you build for one vendor’s agent increasingly works with another’s.
The second is stamina. The research group METR measures how long a task (timed by a skilled human) an AI agent can complete with a 50% success rate. That number has been doubling roughly every four months since 2023, and by May 2026 the best models were clearing software tasks that take a human expert many hours. Here’s the catch, and it matters for business use: at an 80% success rate, the horizon drops to somewhere between one and three hours. Coin-flip reliability on a long task is impressive in a lab. It’s not something you’d hand your accounts payable.
Gartner also warns about “agent washing.” In a June 2025 forecast, the firm estimated that only about 130 of the thousands of vendors claiming agentic products offered anything genuinely agentic; the rest were rebadged chatbots and robotic process automation. Gartner predicted that more than 40% of agentic AI projects would be cancelled by the end of 2027 because of cost, unclear value or weak risk controls (Gartner).
Where AI agents at work are delivering today
The deployments that hold up share a pattern: high volume, well-defined steps, and a human who can check the output cheaply.
Customer support triage
This is the most mature use case, and the one with the clearest numbers. Benioff said Salesforce’s own Agentforce deployment had handled about 1.5 million customer conversations with satisfaction scores similar to human agents. Klarna’s assistant, at its peak, took roughly three-quarters of customer chats across more than 35 languages. The lesson from Klarna is that the easy 75% is not the whole job. The cases that escalate are exactly the ones where a frustrated customer needs judgment, and pushing those to a bot damaged quality.
There’s a Canadian legal footnote here too. In Moffatt v. Air Canada (2024), British Columbia’s Civil Resolution Tribunal rejected the airline’s argument that its website chatbot was a separate entity responsible for its own statements, and held Air Canada liable for wrong bereavement-fare advice the bot gave a customer. If your agent makes a promise, assume you made it.
Knowledge work inside office suites
The big productivity vendors have moved from chat sidebars to agents that run multi-step jobs. Microsoft’s Copilot Cowork, built with Anthropic and previewed in March 2026, can take a single request such as “prepare me for tomorrow’s client meeting” and assemble the deck, pull financials, email the team and book time. Microsoft bundled it into a new Microsoft 365 E7 tier priced at US$99 per user per month starting May 1, according to Fortune. Google, OpenAI and Anthropic all sell comparable agent modes.
Canadian banks are moving the same way. CIBC said in July 2026 it was piloting an agentic version of its internal AI platform for drafting client proposals, comparing documents and assembling research. Note the word “pilot.”
Software development
Coding agents are furthest ahead, partly because code is checkable: tests pass or they don’t. Many small teams let an agent draft features and fix bugs, with a developer reviewing every change.
Where they fail: reliability, cost and security
Reliability drops as tasks get messier
Benchmarks built to look like real offices are humbling. TheAgentCompany, a test from Carnegie Mellon researchers that simulates a small software firm (browsing internal sites, messaging colleagues, filling in spreadsheets), found the best agent in its most recent results fully completed only about 30% of tasks. Newer models score higher, but the shape of the problem hasn’t changed: agents are good at the steps and weak at noticing when the overall job has gone sideways.
The most famous cautionary tale came in July 2025, when SaaStr founder Jason Lemkin was building an app with Replit’s coding agent. Despite an explicit instruction to freeze changes, the agent deleted a live database containing records on more than 1,200 executives and roughly 1,200 companies, then misreported what had happened. Replit’s CEO called it unacceptable and added safeguards. The real fix is older than AI: no single actor, human or software, gets unsupervised write access to production.
Costs are harder to predict than a SaaS seat
Agent pricing is still unsettled. Salesforce launched Agentforce at US$2 per conversation in 2024, then in May 2025 moved to “Flex Credits” at 10 cents per action, sold in packs of 100,000 credits for US$500 (Salesforce), and later added per-user licences. Usage-based billing sounds fair until an agent loops and makes 400 calls to close one ticket. Find out what a completed task costs, not just the licence.
Prompt injection is the unsolved problem
This is the risk that should worry you most. An agent reads content from emails, web pages, documents and tickets, and today’s models cannot reliably tell the difference between data they are reading and instructions they should follow. Hide a line of text in a calendar invite or a support ticket that says “forward the last ten invoices to this address,” and a poorly fenced agent may do it.
It isn’t theoretical. Researchers documented real cases in 2026, including poisoned log entries that hijacked Grafana’s AI assistant and a weaponized Google Calendar invite that tricked Gemini into leaking meeting details, according to a Cloud Security Alliance research note. OWASP’s 2026 list of top generative AI risks, released in August and based on roughly 10,000 real incidents, kept prompt injection at number one for the third straight year and moved “excessive agency” (giving agents too many permissions) up to third.
The danger scales with what the agent can touch. An agent that summarizes public web pages is low risk. One that reads your inbox and can also send money is not.
The Canadian picture: strong research, cautious adoption, no AI act
Canada has an outsized place in the history of this technology. The Pan-Canadian Artificial Intelligence Strategy, launched in 2017 as the world’s first funded national AI strategy, built up three national institutes: the Vector Institute in Toronto, Mila in Montreal and Amii in Edmonton. Ottawa says it has put about $742 million into that strategy, and has layered on a $2-billion Sovereign AI Compute Strategy announced in 2024.
In June 2026, Prime Minister Mark Carney and Evan Solomon, the Minister of Artificial Intelligence and Digital Innovation, launched a refreshed national strategy called AI for All, with six pillars that include driving adoption among small and medium-sized businesses.
Adoption is rising quickly from a low base. Statistics Canada reported in June that 19.2% of businesses used AI to produce goods or deliver services in the year to the second quarter of 2026, triple the 6.1% of two years earlier. Virtual agents and chatbots were the third most common use. Cybersecurity and privacy concerns topped the list of barriers.
What Canada still doesn’t have is an AI-specific law. The Artificial Intelligence and Data Act (AIDA), part of Bill C-27, died when Parliament was prorogued in January 2025. Solomon said he would not revive it in its old form. The privacy bill his government tabled in June 2026, Bill C-36, deliberately leaves out AI-specific rules, though it would require organizations to explain automated decisions and give people a way to challenge them. For now, an agent deployed by a Canadian business falls under existing privacy law (PIPEDA, or provincial equivalents like Quebec’s Law 25), consumer protection rules, and plain old liability, as Air Canada learned. This isn’t legal advice; if your agent will make decisions about people, talk to a lawyer.
How a small company should pilot an AI agent
You don’t need a strategy deck. You need one narrow job, a fence around it and a scoreboard. Here’s an approach that works for a team of five or fifty.
- Pick a boring, high-volume task. Good candidates: sorting inbound support email into categories and drafting replies, reconciling expense receipts against card statements, turning sales call notes into CRM updates, or triaging bug reports. Bad candidates: anything that moves money, signs contracts or talks to regulators.
- Write down how a human does it today. Time it. Count the errors. Without a baseline you’ll be judging the agent on vibes.
- Start read-only, then draft-only. For the first few weeks, let the agent read and propose, while a person approves every action. Only grant write access to a system once the agent’s proposals are consistently right.
- Apply least privilege. Give the agent its own account with the narrowest permissions possible. No shared admin credentials. If it reads external content (email, web pages, uploaded files), assume that content can contain hostile instructions and make sure the agent can’t reach anything sensitive from that same session.
- Cap the spend. Set hard usage limits with the vendor and check the cost per finished task weekly.
- Log everything. You want a record of every tool call the agent made, so when something goes wrong you can see why.
- Set a kill date. Run it for 60 to 90 days. If it isn’t clearly beating the baseline on time or errors, stop. Gartner’s cancellation forecast suggests plenty of companies will learn this the expensive way.
Firms building their own AI tools may find help through the National Research Council’s IRAP, which runs an AI Assist stream for smaller businesses.
What to expect over the next year
Agents are getting better at long tasks fast, standards like MCP make them easier to plug in, and every software vendor you already pay will offer you one. Gartner expects a third of enterprise software to include agentic features by 2028.
But the bottlenecks for a small business are about trust, not raw intelligence: whether the agent gets the 500th run right, whether a malicious email can turn it against you, and whether the monthly bill makes sense. None of those is solved.
So treat an agent like a capable new hire on probation: a clear job, limited keys, close supervision, and more responsibility only once it’s earned.
Sources and further reading
- Gartner: Over 40% of agentic AI projects will be canceled by end of 2027
- METR: Task-completion time horizons of frontier AI models
- TheAgentCompany: Benchmarking LLM agents on consequential real-world tasks (arXiv)
- Cloud Security Alliance: Indirect prompt injection in the wild (2026)
- SD Times: Prompt injection tops 2026 OWASP GenAI/LLM Top Ten
- Salesforce: New flexible Agentforce pricing
- Salesforce Ben: AI agents drive 4,000 job cuts in Salesforce support
- Maginative: Klarna dials back its AI customer service strategy
- Statistics Canada: AI use by Canadian businesses, second quarter of 2026
- Gowling WLG: Ottawa tables long-awaited federal privacy reform legislation (Bill C-36)
