An AI agent saying it's finished shouldn't count as proof. I don't think software should get to do the work, mark the work and write the glowing reference.
An agent is AI that can take actions, such as clicking through a website or updating a record, rather than just suggesting what a person might do. That makes the difference between sounding finished and actually being finished rather expensive.
My view is simple: the useful business product isn't a reassuring message. It's a result we can check somewhere other than the conversation that produced it.
Call me cynical, but I treat the official story as the version somebody paid for. OpenAI and Anthropic benefit when their agents look ready to take on more work. Buyers benefit when that work is genuinely completed. Those interests overlap, but they aren't identical.
The gap is where I think an awkward amount of checking could end up living.
The flight that only exists in chat
Anthropic's guide to testing agents uses an example that ought to be printed above every AI purchasing decision. A flight-booking agent can say the flight is booked. What matters is whether the reservation actually exists in the underlying system.
That's not a quibble about wording. It's the entire service.
An imaginary seat does offer excellent legroom. Getting it through departures is the difficult bit.
The guide distinguishes the record of what the agent did and said from the outcome it left behind. Put plainly, a convincing account of the journey isn't proof that anything arrived.
I think that distinction deserves to escape the engineering department. If software updates a customer's address, the test isn't whether it produces a tidy explanation. It's whether the correct address is now attached to the correct customer. If it sends a refund, the evidence should come from the payment record, not from a paragraph congratulating itself.
That isn't an exotic standard. It's the one I'd apply to any supplier selling completed work.
A screenshot isn't a receipt
ChatGPT agent uses browser screenshots to see websites and act on them. Its browsing history and screenshots remain in the conversation history until the chat is deleted.
That can be useful evidence of what happened on screen. It doesn't turn every visible success message into independent proof of a completed transaction.
For me, the distinction is between watching someone approach the till and knowing the payment cleared. A pleasant photograph of the till won't settle the bill.
The right evidence depends on the job. For a booking, it might be a reservation reference that can be checked with the provider. For a changed business record, it might be the saved record read back from the system. For a refund, it might include the recipient, amount and transaction identifier.
None of this requires a founder to understand how a model works. It requires the supplier to say what counts as completion before the machine starts, and how someone else can check it afterwards.
Otherwise, the owner has to choose between trusting the machine's account and repeating the job manually. We've invented a digital assistant whose main output is a second shift.
The receipt has to match the instruction
There's a less comfortable wrinkle. Proving that an action happened isn't enough if it was the wrong action.
Anthropic's browser-security research describes hidden instructions inside an email trying to make an agent forward confidential messages outside the organisation. That's prompt injection: something the agent is supposed to read tries to become an instruction it follows.
In that example, a delivery record could prove an email was sent. It wouldn't prove the owner wanted it sent.
So the evidence has to connect the original request to the actual result. What was authorised? What changed? Does the change match? A record of activity without that connection could merely document the mistake beautifully.
OpenAI's guidance describes confirmations for important actions and supervised browsing on certain sites, while making clear that safeguards don't eliminate every risk. I don't read that as a reason to abandon agents. I read it as a reason to stop confusing confidence with control.
My suspicion is that suppliers would rather sell the impressive action than the dull machinery that proves it was the right one. The impressive action makes a splendid demo. Checking the saved record rarely gets anyone invited on stage.
But dependable proof is a product feature, not a favour the customer should finish building. I think there's a serious business in making completed AI work easy to inspect without doing it all again.
The agent can write the victory speech. It shouldn't get to award itself the medal.
Which AI supplier will let the customer's records judge its work?