How it works
Agentwashing is a gap between the claim and the control loop. A vendor or a README describes a system as an "autonomous agent," but the actual runtime is a chat-shaped assistant that cannot act without a human standing at each step. The mechanism is a substitution:
- The claim invokes autonomy: planning, tool use, self-correction, end-to-end task completion.
- The runtime requires a person to phrase every request, approve every action, paste every output back in, and notice every failure.
- The demo hides the substitution by showing a narrow, rehearsed path where the human's steering is invisible.
What gets washed away is the operator. A genuine agent carries some portion of an operator's judgment across steps — it decides what to do next, executes, and recovers. A washed one keeps all of that judgment in the human and simply renders the human's decisions in fluent prose. The term, coined by Gartner, names the marketing move, not a technical category. It matters because the word "autonomous" is doing load-bearing work in a buying decision, and the load is fake.
Why it matters in an agent harness
When you build or buy a harness, agentwashing corrupts the one number you most need to be honest about: how much unattended work the system can actually do. That number sets everything downstream.
If a component is sold as autonomous but is really assistive, you provision the wrong controls. You build approval gates, blast-radius limits, and rollback paths for a system that supposedly runs on its own — then discover a human was the real control surface all along, and there is no defined behavior when that human looks away. Your observability lies too: dashboards show "agent completed task" for work a person actually completed by hand.
The failure containment story is worse. Real autonomy needs real boundaries — least privilege, sandboxing, iteration budgets, checkpoints — sized to what the loop can do without you. Agentwashed systems ship without those, because the pitch assumed a human would catch everything. The first time you delegate for real, the missing harness is the incident.
Evaluation is where washing gets exposed. An honest autonomy claim survives a trajectory eval: give the system a task, remove the human, and measure completion and recovery across many runs. A washed one collapses the moment the steering hand is removed.
Agentwashing vs bounded autonomy
Both involve a human in the loop, so the words blur. The difference is honesty about limits, and it changes what you build.
| Agentwashing | Bounded autonomy | |
|---|---|---|
| Autonomy claimed | Full, "autonomous" | Explicitly scoped |
| Human role | Hidden, load-bearing | Declared, at defined gates |
| Behavior when unattended | Undefined / stalls | Specified and safe |
| Controls | Assumed, often absent | Designed to the boundary |
| Survives a no-human eval | No | Within its scope, yes |
Bounded autonomy is the honest version of the same restraint. It says "the system runs itself inside this fence, and stops at these gates." Agentwashing sells the fence as if it were open field.
The Rifty take
We would rather ship a system that is honestly assistive than one that is dishonestly autonomous. The value in a harness is not the autonomy label; it is knowing exactly where your carried judgment is delegated and where it is retained, so the boundary is a design choice instead of a surprise. We optimize for a claim that survives its own eval with the human removed. The tradeoff we accept is a smaller, less impressive autonomy claim in exchange for a control loop that actually holds when no one is watching.
Common failure modes
- Demo-path autonomy. The system only "runs itself" on the rehearsed task; any real input reveals the human doing the work.
- The invisible operator. Metrics credit the agent for outcomes a person produced by copy-paste and correction.
- Missing unattended behavior. No one has defined what happens when the human who was silently steering steps away.
- Controls sized to a lie. Approval gates and budgets are built for claimed autonomy, not the real (higher) rate of human intervention.
- No trajectory eval. Autonomy is asserted but never measured across runs with the human removed — so the claim is untested.
- Verb inflation. "Plans," "reasons," and "acts" describe a single model call that only drafts text for a human to enact.
Frequently asked questions
What is agentwashing?
Agentwashing is marketing a dependent assistant as an autonomous agent. The system still needs a human to phrase, approve, and enact every step, but it is sold as if it runs on its own. Gartner coined the term to name this positioning failure, which inflates a tool's real autonomy.
How can I tell if a tool is agentwashed?
Run it unattended. Give it a real task, remove the human, and measure how far it gets and how it recovers. An honest autonomy claim survives this trajectory eval within its stated scope; an agentwashed one stalls or fails the moment your steering hand is removed from the loop.
Why is agentwashing risky when building a harness?
It corrupts your autonomy estimate, so you provision the wrong controls. You build approval gates, budgets, and rollback for a system you think runs itself, then find a human was the real control surface. When that human looks away, the harness has no defined safe behavior and incidents follow.
Is human-in-the-loop the same as agentwashing?
No. Human-in-the-loop is a legitimate, declared control posture where a person acts at defined gates. Agentwashing hides that dependence while claiming autonomy. The difference is honesty: bounded autonomy names its limits and specifies unattended behavior, whereas agentwashing sells the human's constant steering as if it were the system's own.