AI Agent Systems: A Field Guide To Types and Levels

The transition from AI experimentation to production-grade agentic systems is the defining challenge of the enterprise landscape today. While McKinsey’s latest State of AI survey shows that over 60% of organizations are actively prototyping agents, fewer than a quarter have successfully scaled them into business functions.

The gap between a successful demo and a reliable production system is not just a matter of compute—it is a matter of observability, safety, and rigorous evaluation. This guide categorizes the current state of agentic autonomy to help you map your systems against the industry standard, identify failure modes, and build a strategy for production-ready operations.

This taxonomy is critical because the gap between a successful demo and a production-ready system is defined by failure. Research from UC Berkeley shows that agentic systems exhibit 14 distinct failure modes—from specification drift to inter-agent misalignment—with failure rates often exceeding 80%. By mapping your agent to these levels of autonomy, you can preemptively identify which failure modes apply to your architecture.

What are AI agents?

At their simplest, AI agents are systems capable of acting toward a goal with autonomy. To distinguish them from standard LLM applications, consider the difference between a workflow and an agent:

• Workflows follow rigid, predefined code paths. They are deterministic and testable.
• Agents allow the LLM to dynamically direct its own process and tool use.

By granting the model the autonomy to select its own tools and break down complex tasks, you unlock significant productivity gains—but you also introduce non-deterministic failure modes that standard software testing cannot catch. Understanding these systems requires viewing them not as static code, but as dynamic, self-directing loops that require active monitoring.

Types of AI agents: Levels of autonomy

Categorizing these levels of agentic autonomy is not just an academic exercise; it is an observability requirement.

Academic proposals range from Huang's six levels modeled on the Society of Automotive Engineers (SAE) driving automation scale to Mitchell et al.'s five-level scale based on model control over program flow, and the NIST AI Risk Management Framework says only that AI systems "operate with varying levels of autonomy." The levels below are a composite, not a standards document.

As agents move from Level 0 to Level 7, the complexity of failure modes shifts from simple input/output errors to cascading hallucinations and 'environment' risks. Scaling these systems safely, especially with the EU’s mandate for human oversight, requires moving away from sampled testing toward full-trace evaluation.

Level -1. Fixed automation (The digital assembly line)

Level -1 is the familiar baseline: these systems don't adapt or think; they execute pre-programmed instructions. In Anthropic's framing, this is a workflow: LLMs and tools orchestrated through predefined code paths. Level -1 systems are deterministic, so you can test them like any other software.

Level 0. LLM-enhanced (Getting smarter)

Level 0 agents use an LLM for contextual understanding and ambiguous tasks within strict boundaries. The Stanford Center for Research on Foundation Models defines the underlying model class by two traits:

• Training on broad data
• Adaptability to a wide range of downstream tasks

A single model call is the easiest agent to evaluate: one input, one output to score.

Level 1. ReAct (Reasoning meets action)

ReAct agents combine reasoning and action, breaking complex tasks into manageable steps. Originating with Yao et al.'s paper at the International Conference on Learning Representations (ICLR) 2023, the ReAct pattern is still the loop that most frameworks build on.

• Pre-Act extends it with multi-step execution planning and reports a 70% improvement in action recall over ReAct.
• ReflAct at the Conference on Empirical Methods in Natural Language Processing (EMNLP) 2025 shifts reasoning toward goal-state reflection and reports a 27.7% average improvement.

Level 2. ReAct + RAG (Grounded intelligence)

ReAct + retrieval-augmented generation (RAG) agents add real-time access to external knowledge. RAG dates to Lewis et al. at the Conference on Neural Information Processing Systems (NeurIPS) 2020, which paired a parametric generator with "a non-parametric memory."

The current term is agentic RAG, which is described as letting agents "actively decompose tasks, issue exploratory queries, and refine evidence through iterative retrieval." Score retrieval quality, generation faithfulness, and decision quality separately, because a perfect answer built on the wrong documents is still a failure.

Level 3. Tool-enhanced (The multi-taskers)

Tool-enhanced agents integrate APIs, databases, and software into multi-domain workflows. Anthropic's docs put it plainly: "Tool use (also called function calling) lets Claude call functions that you define." The Model Context Protocol (MCP) reached spec version 2026-07-28 after Anthropic donated it to the Linux Foundation's Agentic AI Foundation in December 2025. Independent snapshots counted 30,375 unique MCP servers as of September 2026.

More tools means more ways to pick the wrong one. The MCP-Atlas benchmark diagnosed roughly 6,900 failures across 20 models and found 63.3% were cognitive (wrong tool, no tool use, malformed parameters) rather than tool-side errors. That's the case for scoring Tool Selection Quality as its own metric instead of inferring it from final outputs. AnInternet Engineering Task Force (IETF) Internet-Draft survey of 1,900+ MCP servers found 99.4% implement no cryptographic identity verification, message signing, or replay protection.

Level 4. Self-reflecting (The philosophers)

These agents analyze their reasoning and learn from mistakes within a task, making their behavior easier to audit. The canonical reference is Reflexion (NeurIPS 2023), where agents reflect verbally on task feedback signals and keep that reflection in an episodic memory buffer; it hit 91% pass@1 on HumanEval against GPT-4's 80%.

On τ-bench, the best model passed about 61% of retail tasks on a single try, but pass^8 (succeeding on all eight repeated trials) dropped below 25%.

Level 5. Memory-enhanced (The personalized powerhouses)

Memory-enhanced agents maintain historical context, including user preferences, prior interactions, and task history. Google's Vertex AI Memory Bank became generally available (GA) in December 2025, OpenAI's Conversations API offers durable cross-session state, and Microsoft's Foundry procedural memory preview reported a Tau-Bench pass¹ lift from 75.1% to 79.8% with memory enabled.

Memory is also an attack surface. MPBench measured a 50.46% average success rate for memory-poisoning attacks and noted that "existing prompt injection defenses provide incomplete coverage." More memory is not automatically better: on CL-Bench, "naive in-context learning (ICL) outperforms systems dedicated to memory management." Treat the context window as working memory and external storage as long-term memory, and decide deliberately what crosses between them.

Level 6: Environment controllers (The world shapers)

Environment-controlling agents, also called computer-use agents, operate a browser, desktop, or physical world in real time. The original OSWorld paper (April 2024) reported a best score of 12.24% against a 72.36% human baseline. By September 2025, Claude Sonnet 4.5 led OSWorld-Verified at 61.4%, and Google's Gemini 2.5 Computer Use model posted 88.9% on WebVoyager. On the physical side, Gemini Robotics 1.5 scored above 80% on the ASIMOV semantic safety benchmark.

OS-HARM (NeurIPS 2025) measured unsafe execution rates of 8% to 20% under simple static prompt injections, and RedTeamCUA reported an 83% end-to-end attack success rate against Claude 4.5 Opus in computer-use mode. Anything at this level needs full traces of every action, not just the final screenshot.

Level 7: Self-learning (The revolutionaries)

This level, the most autonomous category, combines reasoning, memory, environment control, and self-reflection with autonomous learning. This level is still mostly research. A 2026 survey of self-improving agents separates improving the scaffold (prompts, memory, and tools) from updating model weights; conflating them inflates claims.

Google's AlphaEvolve produced a data-center scheduling heuristic that "continuously recovers on average 0.7% of Google's fleet-wide compute resources," a narrow algorithmic domain. ARIA runs on a payment platform with over 150 million monthly active users, with humans in the loop. In the lab, the Darwin Gödel Machine pushed itself from 20.0% to 50.0% on SWE-bench by rewriting its own code.

Are they the future of AI? Potentially. The survey literature names "evaluation, control, and safety as unresolved concerns," making these systems high risk without evaluation and oversight.

The road ahead: swarms, multi-agent workflows, and beyond

Networks of agents are already here.Among organizations already scaling agents, nearly 45% are piloting or scaling multi-agent systems.

OpenAI's experimental Swarm library has been replaced by the OpenAI Agents SDK, described as "a production-ready evolution of Swarm."

• The agent-to-agent (A2A) protocol shipped v1.0 in with signed Agent Cards for cryptographic identity, and the Linux Foundation counts more than 150 supporting organizations.(Where MCP connects agents to tools and data. A2A connects agents to other agents.)
• The AGNTCY project, now under the Linux Foundation, adds discovery, identity, and observability layers that interoperate with both.

Adding agents doesn't automatically add capability. On HiddenBench, multi-agent LLM teams reached 30.1% accuracy when information was distributed across agents, versus 80.7% for a single agent holding everything.

The Hallucination Snowball study found 23.7% of injected hallucinations survived undetected to the final output, and detection accuracy dropped from 72.0% at the first stage to 50.9% by the fourth. Where you can intercept a cascading error depends on the architecture you choose (centralized, decentralized, hierarchical, or hybrid).

The path to trusted operations

As you move agents from the lab to the enterprise, the goal is to augment human intelligence, not replace it. However, the complexity of these systems means that traditional logging is no longer sufficient. Reliable agentic operations require visibility into every trace, every decision point, and every tool selection.

Splunk Agent Observability is built to provide that visibility, using Luna evaluation models to score every trace in real time—drastically reducing the cost and complexity of maintaining production-grade agents.

To dive deeper into how you can bridge the gap between initial pilot and production scale, read our full report: The Agentic Shift: Redefining Observability for the AI Era.

FAQs: AI agent levels and types