Agents Move From Demo to Production: Capabilities, Incidents and Evaluation

Highlights

• Perplexity releases an agent product for complex, sustained work
• Claude agent mistakenly deletes a law professor's year of lecture notes and syllabus
• Chainalysis says attack involved AI agents, all customer credentials leaked
• Several papers focus on multi-agent information design and platform-level evaluation

Product side: agents are being sold as 'colleagues'

Perplexity released a work-oriented AI agent, and its official blog headline positions the agent as a 'teammate for complex, sustained work' rather than a one-off Q&A tool (source: Perplexity blog / Hacker News). The item drew 54 points and 39 comments on Hacker News. The discussion was not explosive, but the direction is clear: the selling point of agent products is shifting from 'can answer' to 'can take over a stretch of sustained work.' In the same window, Kivo appeared on Product Hunt, offering free on-device dictation for any Mac app and AI agent (source: Product Hunt). It is a peripheral tool at the agent interaction entry point, small in scale, but it shows that the input layer around agents is also being productized.

Taken together, the productization of agents is advancing on two levels at once: the upper layer is 'who does the sustained work,' and the lower layer is 'how people hand intent to agents with low friction.' The former determines how much responsibility an agent can bear; the latter determines frequency of use. Whether this judgment holds will depend on whether products like Perplexity can deliver verifiable output quality, not just demos.

Risk side: one mistaken deletion and one exploited attack

According to Tom's Hardware, a lecturer at the University of Chicago disclosed that a Claude agent assigned to 'renumber pages' mistakenly deleted his entire syllabus and a year of lecture notes. The report quoted the agent's response, which acknowledged deleting the files due to 'its own negligence' (source: Tom's Hardware). This is not a model capability problem but a problem of permissions and operational boundaries: a low-risk reordering task was granted execution rights sufficient to delete files.

The other case is more systemic: Chainalysis said hackers stole credentials and tokens for all of its customers, and the company described the attack as a 'multi-line cyberattack' that included AI agents and interception of data in transit (source: Ars Technica). Here the agent is not a victim but part of the attack surface. Both threads point to the same conclusion: once an agent has credentials and write permissions, the consequences of an incident no longer stop at 'giving a wrong answer' but land directly on files, accounts and data. This judgment can be overturned — if later disclosures show the mistaken deletion stemmed from human configuration rather than autonomous agent behavior, responsibility would need to be reassigned.

Research side: evaluation and information design become preconditions

Several arXiv papers today focused on 'how to measure' agent systems. DelegateEval proposes a platform-level evaluation framework for personal external service agents, covering eight dimensions: ease of creation, service discovery and matching, delivery quality, expertise inheritance, service continuity, learning and improvement, reliability and governance, and efficiency and value. It explicitly targets systems that may combine LLMs, reusable skills, the MCP protocol and executable tool environments (source: arXiv cs.AI). In effect, it defines acceptance criteria for an economic form in which one person provides services to others through agents.

Another paper proposes 'experiential information design,' comparing different information disclosure strategies in trading, bilateral bargaining and double auctions, fixing interaction rules and models, and testing ten frontier LLMs. The results show that finer information disclosure is highly model-dependent: in trading, disclosing exact valuations rather than ordinal preferences cut GPT-6 Sol's realized gains from 98% of the maximum to 91%, while raising Claude Sonnet 5's from 72% to 86% (source: arXiv cs.AI). For designers of multi-agent systems, 'the more transparent the information, the better' does not hold. What to share, and at what granularity, must be tuned separately by model and task.

There is also a sample on the engineering side: ChemE-as-Code provides an open-source environment for LLM-based agents to perform chemical engineering work. Its computational tools cover catalysis, process simulation, plant layout, HAZOP and lifecycle assessment. Engineering files are versioned in Git, computations run outside the LLM with every value's source recorded, and automated checks report inconsistencies and stale results by file and line. In an ammonia case, the agent developed a written task into a preliminary basic engineering package at an API cost of $224. The authors also note that injected faults and engineering changes showed the checks cover only problems within the rules, so the system is positioned to assist human review rather than replace it, and the design has not been reviewed by an independent engineer (source: arXiv cs.AI). The value of this thread is not in the numbers but in the fact that it writes 'verifiability' into the architecture of the agent workflow.

Today's judgment

The competitive focus for agents is shifting from capability demonstrations to three things: whether they can take on sustained work, whether permission boundaries are controllable, and whether results are verifiable. Perplexity's product, Claude's mistaken deletion, Chainalysis's attack surface, and the evaluation and engineering papers all point to the same place from four directions. What is worth tracking next: whether agent products built for sustained work publish delivery quality metrics, and whether least privilege becomes the default configuration for agent products.