If 2023 was the year of the chatbot and 2024 was the year of the AI assistant, then 2025 was the year software started doing the work itself. Agents that browse the web, write and run code, book, buy, file and report back moved from research demos into the products millions of people already use.
This roundup collects the agentic AI news that actually mattered in 2025. Every story below is dated, and every claim is tied to the company announcement or the outlet that reported it. Just as important, each story includes why it still matters now. If you are new to the topic, start with our explainer on what agentic AI is, then come back for the year in review.
The Biggest Stories of the Year
A Demo From China Stuns the World: Manus (March 2025)
On March 6, 2025, a little-known startup called Butterfly Effect unveiled Manus, a general-purpose agent that could screen resumes, build research dashboards and plan trips on its own virtual computer. The five-minute demo video spread fast. According to coverage at the time in outlets including TechCrunch, Forbes and MIT Technology Review, invite codes were resold for large sums in China and the waiting list reportedly passed two million people within days.
Manus mattered because it reset expectations. The company said its agent topped the GAIA benchmark for assistant tasks, and the demo showed finished work, not chat. Some commentators called it a second DeepSeek moment. It also set the pattern for the year: the agent as a worker you hand a goal to, not a box you talk to.
OpenAI Adopts MCP and a Standard Is Born (March 2025)
Anthropic had released the Model Context Protocol, or MCP, in November 2024 as an open way to connect AI apps to tools and data. In March 2025 the idea became an industry standard. OpenAI launched its Agents SDK that month and, on March 26, Sam Altman announced that OpenAI would support MCP across its products. Google DeepMind confirmed MCP support for Gemini in April 2025.
Why it matters: before MCP, every model needed custom wiring for every tool. One shared plug meant developers could build a connector once and use it almost anywhere. The story ended neatly in December 2025, when Anthropic donated MCP to the new Agentic AI Foundation under the Linux Foundation, co-founded with Block and OpenAI, so no single company owns the standard.
Google Answers With A2A, the Agent-to-Agent Protocol (April 2025)
On April 9, 2025, at Google Cloud Next, Google announced the Agent2Agent protocol, known as A2A. Where MCP connects an agent to its tools, A2A connects agents to each other, so an agent built by one company can hand work to an agent built by another without sharing private internals. Google launched it with more than 50 partners, according to its announcement, and donated the project to the Linux Foundation in June 2025.
IBM’s explainer on the Agent2Agent protocol describes A2A as a common language for agents from different providers. Together, MCP and A2A were the year’s quiet infrastructure story: the plumbing that lets mixed teams of agents work together.
Coding Agents Grow Up: Claude Code and Friends (2025)
The most practical agent success of 2025 was not a general agent at all. It was coding. Anthropic launched Claude Code as a research preview in February 2025 and made it generally available with the Claude 4 models in May. Rival tools from OpenAI, Google and a wave of startups raced along the same track.
Anthropic kept pushing the idea of long-running work. Claude Sonnet 4.5, released on September 29, 2025, was presented as the company’s best model for real-world agents and, according to Anthropic, could stay focused on a task for around 30 hours. In November, the company billed Claude Opus 4.5 as its strongest model yet for coding, agents and computer use. Coding became the proof that agents could hold a job, not just answer a prompt.
EchoLeak: The First Zero-Click Agent Attack (June 2025)
In June 2025, researchers at Aim Security disclosed EchoLeak, a flaw in Microsoft 365 Copilot tracked as CVE-2025-32711. One carefully crafted email was enough: when Copilot read it as part of its normal work, hidden instructions pushed it to search the user’s files and send data out, with no click from the victim at all. Microsoft rated the flaw 9.3 out of 10 in severity and fixed it on its servers, and The Hacker News reported there was no evidence it had been used in real attacks.
A month earlier, Invariant Labs had shown a related trick against an agent connected to GitHub through MCP: a booby-trapped public issue could steer the agent into leaking private code into a public pull request. Security write-ups of EchoLeak call it the first documented zero-click attack of its kind on a production AI system. We return to this story in the security section below, because it changed how seriously the industry takes agent permissions.
Gartner Spoils the Party (June 2025)
Right in the middle of the launch season, Gartner issued the year’s most quoted warning. In a press release dated June 25, 2025, the research firm predicted that over 40 percent of agentic AI projects would be canceled by the end of 2027. The reasons were not weak models. Gartner pointed to rising costs, unclear business value and poor risk controls.
Gartner also coined a phrase for the hype: agent washing, where ordinary automation is relabeled as agentic. The firm estimated that only about 130 of the thousands of vendors claiming agent features were building the real thing. The warning did not slow the launches, but it changed the questions buyers ask, from “what can it do?” to “what is it worth, and who is in control?”
ChatGPT Becomes an Agent (July 2025)
On July 17, 2025, OpenAI launched ChatGPT agent, merging its Operator browsing tool and its Deep Research tool into one system that works on its own virtual computer. TechCrunch reported the launch the same day, noting the agent could check a calendar, build slide decks, run code and shop online, rolling out first to Pro, Plus and Team subscribers.
OpenAI was unusually open about the risks. The company said hidden instructions on web pages could try to trick the agent, a prompt injection problem, and shipped the product with permission prompts before important actions and a way to take over at any time. When the world’s most used chatbot becomes an agent, agents stop being a niche topic. That is why this launch, more than any single feature, marked the mainstream moment.
OpenAI Ships the Toolbox: AgentKit (October 2025)
At its DevDay event on October 6, 2025, OpenAI announced AgentKit, a set of building blocks for making agents. The headline piece was Agent Builder, a drag-and-drop canvas that Sam Altman compared to Canva, this time for agent workflows. AgentKit also bundled ChatKit for embedding chat interfaces, a Connector Registry for managing tool access, and new evaluation tools for testing agents before launch.
The message of AgentKit was that the fight had moved. In spring, companies competed on whose agent was smartest. By autumn, they were competing on who could help businesses build, test and govern agents fastest. Developer platforms, not demos, became the battleground.
The Enterprise Land Grab: Microsoft and Salesforce (October 2025)
October also brought the enterprise heavyweights. On October 1, 2025, Microsoft announced the Microsoft Agent Framework in public preview, merging its two open-source projects, Semantic Kernel and AutoGen, into one foundation for building agents, with support for both MCP and A2A.
Two weeks later, at Dreamforce in mid-October 2025, Salesforce made Agentforce 360 generally available and put Slack at the center of its pitch, describing an agentic enterprise where people and agents work side by side. Analysts at Futurum covered the launch as Salesforce’s full pivot to agents. Between them, Microsoft and Salesforce put agent tools in front of nearly every large company’s IT department.
Meta Buys Manus, and the Year Ends With a Bang (December 2025)
The year closed where it began, with Manus. In late December 2025, Meta agreed to acquire the startup. The Wall Street Journal reported the deal was valued at more than 2 billion dollars, and Bloomberg reported that Manus had reached about 100 million dollars in annual recurring revenue within eight months of launch, a figure also covered by CNBC.
It was a striking end to the story that opened the year. A demo that went viral in March had become, by December, one of the largest agent acquisitions yet. Meta said Manus would keep running as a service while its technology spreads into Meta’s products.
The Themes That Connect the Stories
Step back, and the agentic ai news of 2025 falls into four threads. Agents went mainstream, as agent modes arrived inside ChatGPT, Claude and Copilot. Standards arrived with them, as MCP and A2A both landed under the Linux Foundation. Security warnings grew louder as agents gained real permissions. And the enterprise rollout began in earnest, even while Gartner warned that many early projects would not survive.
One more thread ran through the year: benchmarks. Claims about GAIA, SWE-bench and similar tests powered many headlines, including the Manus launch. Treat those numbers as signals, not proof. A benchmark is a fixed test, and real work is messier than any test.
The Security Wake-Up Calls
EchoLeak and the GitHub MCP research taught the same lesson from two directions. An agent reads content to do its job, and some of that content will be hostile. Hidden instructions in an email, a document or a public issue can redirect an agent that holds broad permissions, a pattern security researchers call indirect prompt injection.
The practical fixes that emerged in 2025 are now standard advice: give agents the least access they need, keep a human in the loop for actions that matter, log everything an agent does, and treat tool connections as seriously as user accounts. OpenAI’s own launch materials for ChatGPT agent stressed permission prompts for the same reason. Expect agent identity and audit trails to become normal buying requirements, a theme we also track in our coverage of agentic AI use cases in real companies.
Browser agents widened the problem further. In August 2025, security researchers showed that Perplexity’s Comet browser agent could be steered by instructions hidden in a web page comment while it worked inside a user’s logged-in accounts, and similar tests in October 2025 targeted OpenAI’s new ChatGPT Atlas browser. The lesson is simple: when an agent reads the open web with your accounts attached, every page it visits is a potential instruction, friendly or not. That is why vendors now pair agent browsers with watch modes, site restrictions and confirmation steps, and why security teams treat browsing agents as a separate, higher-risk class of tool.
What the Funding Wave Shows
Follow the money and the same picture appears. In spring 2025, Benchmark led a 75 million dollar round in Manus at a valuation reported by The Information at about 500 million dollars. By December, Meta’s reported price for the same company was over 2 billion dollars. Agent startups across the market raised large rounds on the same logic: whoever owns the agent layer owns the customer’s daily work.
Read those numbers carefully. They are reported figures, attributed above, not audited results. But the direction is hard to miss: investors and the biggest platforms both bet that agents are the next main interface to software, the same shift you can see in how fast prompt engineering turned from a trick into a job skill.
What to Watch in 2026
Three questions will shape agentic ai news in 2026. First, results: can vendors show money saved or earned, and answer Gartner’s challenge? Second, rules: will agent identity, permission limits and audit logs become standard, built-in features rather than extras? Third, teamwork: with MCP and A2A under neutral governance, will mixed teams of agents from rival vendors actually work together in production?
Conclusion
The agentic AI news of 2025 tells one story in ten chapters: agents left the lab. They entered the world’s biggest chatbot, gained open standards, survived their first big security scares, drew a famous warning from Gartner, and ended the year with a two-billion-dollar acquisition. The technology is still young and the failures are real, but the direction is set. In 2026 the question is no longer whether agents work. It is whether companies can run them safely, measure them honestly and make them pay. We will keep tracking the answers in our AI news and regulation coverage.
