From Assistants to Early AI Agents

On 22 October 2024 Anthropic released a public beta allowing a model to use a computer, and described the capability in two documents published the same day. Its own research post states that computer use remains slow and often error-prone, and reports a score of 14.9 per cent on an evaluation of computer-using ability against a human range the post gives as 70 to 75 per cent. That is the best capability evidence there is at the date of this paper. It is also a vendor reporting on its own system. The gap between that figure and the market conversation is the reason this paper exists. Systems that select tools and take multi-step actions are a genuine change in kind, because an error stops being a sentence a person can discard and becomes an action in a system of record. That change deserves an operating model now, while the capability is too weak to cause much harm and the habits are being set. What follows defines an autonomy ladder with five rungs and excludes the sixth, sets out a threat model in which prompt injection is the distinctive entry, proposes a control architecture built on identity and least privilege, and gives a pilot gate. The organising claim is that as a system acquires agency, control shifts from reviewing content to governing permissions, actions and recoverability.