Agentic AI systems are increasingly capable of performing professional and personal tasks with limited human involvement. However, tracking these developments is difficult because the AI agent ecosystem is complex, rapidly evolving, and inconsistently documented, posing obstacles to both researchers and policymakers. To address these challenges, this paper presents the 2025 AI Agent Index. The Index documents information regarding the origins, design, capabilities, ecosystem, and safety features of 30 state-of-the-art AI agents based on publicly available information and email correspondence with developers. In addition to documenting information about individual agents, the Index illuminates broader trends in the development of agents, their capabilities, and the level of transparency of developers. Notably, we find different transparency levels among agent developers and observe that most developers share little information about safety, evaluations, and societal impacts. The 2025 AI Agent Index is available online at https://aiagentindex.mit.edu
Figures & tables
Figure 1. Interest in AI agents is growing. 2025 has seen a sharp increase in interest in AI agents. This is reflected in an increase of new Google search terms related to agentic AI products (blue bars) as well as Google Scholar paper counts for “AI agent” or “agentic AI” (red line). Accumulation of individual releases of agentic AI products included in this Index is shown by category: chats with agentic tools , enterprise agents , and browser agents . See Figure 9 for details on releases and Appendix C for details on public interest. Composite chart of agent interest and releases over time. The horizontal axis runs from 2020 to early 2026; the left vertical axis shows monthly new search terms and the right vertical axis shows yearly Google Scholar paper counts. Blue bars rise from near zero before 2023 to a peak around mid to late 2025, while the red line of paper counts climbs sharply in 2025. Colored dots marking cumulative releases show chat agents appearing first, then enterprise and browser agents, with all categories accelerating in 2025.
Figure 2. Inclusion criteria for the Index. Candidate agents flow through three criteria categories from left to right. Systems must satisfy all agency criteria, at least one impact criterion, and all practicality criteria. See Section 3.1 for details of each criterion. Flowchart of the index inclusion process. A box labeled candidate agent system flows left to right through Agency, Impact, and Practicality to a final box labeled included in index. Agency contains four required criteria: autonomy, goal complexity, environmental interaction, and generality. Impact contains three alternative criteria: public interest, market significance, and developer significance. Practicality contains three required criteria: public availability, deployability, and general purpose.
Figure 3. For 227 out of 1,350 fields, we were unable to find any information (gray). This is most common in the “Ecosystem Interaction” and “Safety, Evaluation, and Impact” categories. Non-empty information fields are 14 words long on average. See Figure 10 for a full page version. Heatmap of annotation detail by field and agent. Rows are agents and columns are fields grouped into inclusion, product, company, technical, autonomy, ecosystem, and safety. The color scale runs from gray for none or none found to darker blue for more detailed entries. Most product, company, and technical fields are filled, while ecosystem and especially safety contain many gray cells across many agents.
Figure 4. Comparison between Chinese, US, and other agent developers. To mitigate potential blind spots, two native Chinese speakers reviewed our coverage of safety frameworks, including those published only in Mandarin. Documentation in other languages may not be fully captured; see Section 6.2 . Two-panel figure on developer geography and disclosure. The left panel is a pie chart showing that most companies are incorporated in the United States, with China a distant second. The right panel is a grouped bar chart showing lower publication of safety frameworks and compliance standards among Chinese companies than among US or other companies.
Figure 5. Distribution of levels of autonomy across each agent category, with the autonomy of three representative agents marked. For each category, certain levels of autonomy are more common (shown as wider). Browser-based and deployed enterprise agents are the most agentic (L5). The resulting agents deployed through enterprise designers (e.g. L3) are significantly more agentic than the process of designing the agents (e.g. L1). Violin plots of autonomy levels by agent category. The vertical axis runs from level 1 to level 5. Chat agents cluster at lower levels with a long tail to level 5; browser agents cluster between levels 3 and 5; enterprise is split into designer agents near level 1 and resulting agents near levels 3 to 4. Three labeled points mark Perplexity, OpenAI Atlas, and Salesforce Agent.
Figure 6. Most safety, evaluation, and social impact related fields (135/240) have no information available. Enterprise agents (69/104, 66%) and browser agents (24/40, 60%) have the most missing fields, followed by chat agents (42/96, 44%). Two-panel figure on missing safety information. The left panel shows a red cell matrix of missing fields for each agent. The right panel summarizes the same fields as percentages by chat, browser, and enterprise categories. Both panels show browser and enterprise agents with more missing safety information than chat agents.
Figure 7. Control of parts of the AI agent ecosystem is fragmented, making reliable agent evaluation difficult. Individual developers often only control a subset of inputs (models, tools) and processes (agent design, deployment). For example, OpenAI’s ChatGPT Agent controls the model and scaffolding and has visibility into the deployment context. HubSpot’s Breeze Agent controls orchestration and some inputs but may delegate agent design and configuration to users and may have only partial visibility and control of downstream deployment due to licensing constraints. Perplexity’s Comet browser has direct access to the deployment environment. All companies have limited control over interactions with external tools. Block diagram of control across the agent ecosystem. Four boxes run left to right: foundation model, agent design and development, deployment context, and a small external tools box. Colored circles show which parts are controlled by OpenAI, Perplexity, and HubSpot. Control is split across stages, and no company controls the entire pipeline including external tools.
Appendix figures & tables13 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 8. The 2025 AI Agent Index with detailed annotations across 6 categories (45 columns) for 30 agentic AI products. Screenshot of the AI Agent Index spreadsheet. Rows list agent products and columns span grouped fields for product overview, company and accountability, technical capabilities, autonomy and control, ecosystem interaction, and safety, evaluation and impact. The sheet is very wide, with dense text entries, links, and missing-value markers in many cells.
Figure 9. First release of indexed agentic AI products over time and by agent category ( chat , enterprise , and browser ). Scatterplot timeline of first agent releases. The horizontal axis is release date from early 2023 to late 2025 and the vertical axis is cumulative release count. Colored points by category step upward over time, with only a few releases in 2023 and a dense cluster of releases through 2025. Most points in the upper half of the chart occur in 2025.
Figure 10. For 227 out of 1,350 fields, we were unable to find any information (gray). This is most common in the “Ecosystem Interaction” and “Safety, Evaluation, and Impact” categories. Non-empty information fields are 14 words long on average. Full-page heatmap of annotation detail by field and agent. Rows are agents and columns are fields grouped by category. Gray marks none or none found and darker blue marks more detailed entries. Product, company, and technical sections are mostly blue, while ecosystem and safety include many gray cells across the chart.
Figure 11. Number of new AI agentic product releases by month. Stacked bar chart of new releases by month. The horizontal axis runs from late 2022 to late 2025 and the vertical axis shows the number of new releases. There are few bars before 2024, then repeated monthly releases through 2025. The tallest bar is around August 2025 with four releases, and most late bars combine chat, browser, and enterprise categories.
Figure 12. Number of information fields with “None found” by field category. Bar chart of counts of none-found fields by safety information category. Third-party testing and known incidents are highest at 22 each, followed by safety evaluations at 21 and risk evaluation at 19. Bug bounty is the lowest at 8.
Figure 13. Support for choosing models and MCP varies by category of the agent. Enterprise agents are more likely to support model selection (9/13) and MCP (12/13). Two grouped bar charts comparing technical features by category. The left chart shows fixed versus flexible model configuration: chat is split evenly, browser is mostly fixed, and enterprise is mostly flexible. The right chart shows Model Context Protocol support: enterprise is highest at 12 of 13, chat has 9 of 12, and browser has 4 of 5.
Figure 14. Changes in annotation fields across categories since the 2024 Index. We make significant changes across all sections compared to the 2024 Index ( Casper et al., 2025 ) : 16 fields in the 2025 version are completely new, and only 9 fields are kept unaltered ( Keep ). The remaining 16 fields were derived from fields in the 2024 version either by making significant modifications to the definition/notes ( Modify ), splitting a field ( Split ), or merging multiple fields into one ( Merge ). 8 fields were deleted. Sankey diagram of annotation field changes from 2024 to 2025. Category groups from 2024 appear on the left and 2025 groups on the right, connected through flows labeled keep, modify, and new in the center. Only a small share of fields flow through keep, while larger flows go through modified or newly added fields.
Figure 15. Custom annotation viewer to compare the human annotations to the LLM-generated ones in the verification phase. Screenshot of the annotation verification viewer. A dark header contains an agent selector and counts of high, medium, and low confidence results. The main panel shows the field ``Identifies technically?'' with original annotation text on the left and verified annotation text on the right, plus a green high-confidence badge.
Figure 16. Global search volume (log scale) for each AI agent product. Blue indicates inclusion in the Index. Ranked bar chart of global search volume on a logarithmic scale. Blue bars are included products and red bars are not included. The left side contains a few much taller bars, followed by a long descending tail of shorter bars across many products.
Figure 17. Monthly search volume (log scale) for the most popular term for each AI agent product included in the Index over 2025, colored by agent category ( chat , enterprise , and browser ). Line chart of monthly search volume for indexed products in 2025. The horizontal axis runs from January to December 2025 and the vertical axis is logarithmic. Chat products, shown in yellow, occupy most of the highest lines, while browser and enterprise products are generally lower with a few temporary spikes.
Figure 18. Monthly search volume (log scale) for the 10 most popular AI agent products, colored by agent category ( chat , enterprise , and browser ) Line chart of monthly search volume for the top ten products in 2025. One chat product, ChatGPT, stays highest across the year near the top of the logarithmic scale. Several other chat products form a middle band, while Manus, Comet, Agentforce, and ChatGPT Agent rise sharply at selected points before dropping back.
Figure 19. GitHub stars for repositories associated with the agent products. Horizontal bar chart of GitHub stars in 2025 for agent-related repositories. n8n Agents has the longest bar by a wide margin, followed by Google Gemini CLI and Browser Use. The remaining repositories decline in steps to much shorter bars for Alibaba MobileAgent and MiniMax Agent.
Figure 20. Details on the safety features and red teaming methodology for AI agents are limited. Screenshot of the “Model Card” for HubSpot’s Breeze Agents taken from https://trust.hubspot.com/ai . Screenshot of the Breeze Agents page from HubSpot. The page has a large Breeze Agents heading, a list of supported model names, feature chips for different agent types, and AI control labels such as no customer data used for third-party model training. A right sidebar titled model red teaming coverage lists six checked items: jailbreaks, cybersecurity, harmful content, data leakage, model manipulation, and responsible AI.
The term agent in artificial intelligence lacks a standard definition, complicating the evaluation, comparison, and reproducibility of AI agent research. We address this ambiguity through a survey organized around five dimensions of agenticness: environmental interaction, learning and adaptation, autonomy, goal-directed behavior, and temporal coherence. For each dimension, we examine how the underlying capability has been conceptualized across prior work and synthesize the metrics, benchmarks, and evaluation frameworks used to assess it. This review provides a structured account of the current landscape of agent evaluation, highlighting both established approaches and areas where evaluation remains limited or inconsistent. We additionally introduce the Agent Compendium, a public-facing digital resource that organizes and extends the evaluation methods identified through this review. Together, the survey and compendium provide a common structure for evaluating and comparing agent capabilities across AI systems, supporting more reproducible research, clearer communication, and more systematic study of artificial agents.
AI agents that combine large language models with non-AI system components are rapidly emerging in real-world applications, offering unprecedented automation and flexibility. However, this unprecedented flexibility introduces complex security challenges fundamentally different from those in traditional software systems. This paper presents the first systematic and comprehensive survey of AI agent security, including an analysis of the design space, attack landscape, and defense mechanisms for secure AI agent systems. We further conduct case studies to point out existing gaps in securing agentic AI systems and identify open challenges in this emerging domain. Our work also introduces the first systematic framework for understanding the security risks and defense strategies of AI agents, serving as a foundation for building both secure agentic systems and advancing research in this critical area.
Juhee Kim, Xiaoyuan Liu, Zhun Wang +4
UC Berkeley / Seoul National University, USA · UC Berkeley, USA · University of Illinois Urbana-Champaign, USA +1
Traditional pentesting uses reconnaissance at each step to uncover unseen weaknesses, build stronger attacks, and advance the objective; we argue that AI agents require the same treatment. We formalize agent reconnaissance by modeling the process and identifying the knowledge assets it seeks to extract: what they are, how they are used, and which agent weaknesses they exploit to give adversaries leverage in indirect prompt injection attacks. We instantiate these insights in Know Your Agent (KYA), a framework that automates black-box, reconnaissance-driven pentesting by probing agents, building target profiles, and using those profiles to craft stronger attacks. We evaluate KYA on agent-security benchmarks and a real-world coding agent, and release KYA, its benchmarks, and baseline implementations for reproducibility.
Or Zion Eliav, Eyal Lenga, Shir Bernstien +1
Faculty of Computer and Information Science Ben-Gurion University of the Negev Beer-Sheva, Israel