Agent Washing: How to Tell If a Vendor Agent Is a Script With a Chat Box

Agent washing is the practice of calling any AI feature an 'AI agent' regardless of what it actually does. Gartner uses the term for vendors relabelling AI assistants, RPA tools and chatbots as agentic, and estimates that only about 130 of the thousands of agentic AI vendors are genuine (as reported by w.media, from Gartner's June 2025 press release). A chatbot that retrieves FAQ answers is not an agent. A workflow that fires a preset sequence when a form is submitted is not an agent. Genuine agentic AI systems can plan across multiple steps, use external tools, observe whether their actions succeeded, and adjust course when they fail.

Why this matters more than a naming dispute

When buyers confuse a scripted automation with a genuine agent, they make purchase decisions based on capabilities the product does not have. They then build downstream processes on that assumption. When the product cannot adapt to edge cases the way a real agent would, those processes break - often silently, often in customer-facing ways.

The financial exposure is real. A vendor pitching an 'AI agent' to handle customer escalations may actually be offering a decision tree with GPT-generated text on each node. That product will fail on any escalation that does not match the tree. If you have staffed down on human support based on the promise, the failure lands on real customers. Gartner has forecast that more than 40% of agentic AI projects will be canceled by the end of 2027, citing rising costs, unclear business value and inadequate risk controls; our own write-up of that forecast covers the pattern in more detail.

What a real agent can do that a script cannot

The distinction comes down to four capabilities. A genuine agentic system has all four to some meaningful degree. A script or rule-based automation typically has none:

Planning: given a goal, the system can break it into sub-tasks it was not explicitly programmed for and decide which to tackle first
Tool use: the system can call external APIs, query databases, or trigger actions based on what it finds, not just based on what the user typed
Observation and retry: after taking an action, the system checks whether it worked and changes approach if it did not
Goal-directedness: the system is trying to accomplish an outcome, not execute a fixed sequence - the path can vary based on what it encounters

A chatbot that retrieves FAQ content based on keyword matching has none of these. A chatbot that can call your CRM, check order status, initiate a refund workflow, and then verify the refund succeeded - that is closer to agentic. The difference is not the quality of the text generation. It is whether the system has agency over its own actions.

Eleven questions to ask before any AI agent purchase

These are the questions that reveal what a product actually does, regardless of what the sales deck calls it. Ask them before signing anything. If a vendor cannot answer them clearly, that itself is information.

Questions about the system's behaviour

What happens when the agent encounters a situation it has no training data or rules for? Walk me through an example.
Can the agent take a sequence of actions it was not explicitly pre-programmed to take, based on what it observes during the task?
How does the agent know when it has succeeded? What happens when it has not?
Can it retry with a different approach, or does it fail to the same fallback every time?

Questions about the integration and access model

What external systems does the agent have write access to? Under what conditions does it take write actions?
Is there a human approval step for actions above a defined risk threshold, or does the agent act autonomously on everything?
What does the audit log look like? Can I see every action the agent took and why?
What access does the agent need - and what happens if you give it less?

Questions about failure modes and costs

What is the worst thing this agent could do if it behaves incorrectly? Can that be reversed?
How is API cost managed? Is there a cap, or does a runaway loop become my bill?
What are the SLAs, and who is liable when the agent takes a wrong action that causes a downstream consequence?

A vendor who has built a real agent will have clear answers to all of these. A vendor who has wrapped a chatbot in 'agentic' marketing will hedge or reframe. Take note of which questions produce fluent, specific answers and which produce generalities.

The access question is the most important one

Most agent washing is revealed at the access and integration layer. A true agent needs tools - meaning real access to real systems. If a vendor's 'agent' only takes action through a single API call with a preset payload, it is not planning. It is executing a trigger. The marketing team chose a more impressive word.

The corresponding risk is real for genuine agents too. A system with broad write access to production data and no human oversight can cause significant damage if it makes a wrong decision or is manipulated. Prompt injection is a well-documented attack, listed first in the OWASP LLM risks: in its indirect form, instructions hidden in external content the model processes, such as a web page or document, change what the model does. A vendor who has not thought through their agent's attack surface has likely not built a robust agent - regardless of what the product does on the demo.

What you actually need from most 'AI agent' pitches

For the majority of SMB use cases, you do not need a true autonomous agent. You need reliable automation with good language understanding at the interface. That is a genuinely useful product, and the honest vendors building it will describe it accurately. The red flag is not 'AI automation' or 'AI assistant' - the red flag is 'AI agent' applied to something that is clearly a decision tree or a retrieval-augmented chatbot.

If you are evaluating an AI agent product and want a second opinion on whether the claims match the architecture, book a scoped AI feature review. We look at what the product actually does, map it against your specific workflow, and tell you whether it fits.

If you are adding an agent to your own product

The agent washing problem runs in both directions. If you are building a product and planning to add AI features that you will market as an 'agent,' the same questions apply in reverse. What can your feature actually do autonomously? What does it do when it encounters an unexpected situation? Being accurate about capability in your own marketing protects you from customer complaints when the reality does not match the pitch.

The emerging approach in serious AI product teams is to define a clear scope of autonomy - a list of actions the agent can take without human approval, and a list it cannot - and to build the interface around that boundary rather than obscuring it. Adding an AI chatbot to your website covers the practical implementation side for simpler AI features; the same principle of clear capability definition applies whether you are building a retrieval chatbot or a more capable agentic system.

Common questions

What is agent washing in AI?

Agent washing is calling any AI feature an AI agent regardless of what it does. Gartner uses the term for vendors relabelling AI assistants, RPA tools and chatbots as agentic, and estimates that only about 130 of the thousands of agentic AI vendors are genuine, as reported by w.media.

How can I tell if an AI product is a real agent or a scripted chatbot?

A genuine agent can plan across multiple steps, use external tools, check whether its actions worked, and change approach when they fail. A chatbot that retrieves FAQ answers by keyword matching, or a preset workflow fired by a form submission, has none of these.

Who can check whether an AI agent product matches its claims?

Ask the vendor the eleven questions about behaviour, access and failure modes, and note which get specific answers. If you want a second opinion on whether the claims match the architecture, Zovintra offers a scoped AI feature review that maps the product against your workflow.