Agentic AI is software that takes a goal rather than an instruction, decides its own next step and acts on other systems until the job is done. What it can actually do in a B2B marketing stack today, how to tell a real agent from a rebadged workflow, what to let one do on its own, and who is liable when it gets it wrong.
Agentic AI is software that receives a goal rather than an instruction, decides its own next step, acts on other systems through tools, checks what happened and carries on until it is done or stuck. An AI agent is one such system; agentic AI, strictly, is several of them coordinating. Most of what is sold to marketers under either name still stops before anything consequential happens.
That last fact is the useful one. Vendors will not volunteer it, the explainers written for ad-tech buyers bury it under protocol names, and it separates a marketing team that gets something out of the agent era from one that spends a year in pilots. This is the second piece in a series.
If you want the wider picture of where agents sit alongside prediction and generation, we covered that in Explaining AI Marketing. This one is about the layer that acts.
You have probably got three or four tools open with an "agent" button on them, and you could not say with confidence which of them would send, publish or spend without you if you switched it on. The sales rep's answer did not settle it either.
That is where most B2B marketing managers are, and it is not a gap in your understanding. Nobody has written the explainer for your stack.
Agentic AI is software that pursues a goal by choosing its own actions: it plans the steps, calls tools and other systems, observes the result and adapts, without a person approving each move. What defines it is who decides the next step. In an agent, the model decides, rather than a person or a fixed script.
The published definitions agree on that much and disagree on the threshold. Anthropic's engineering guidance of 19 December 2024 draws the line at control of the sequence: a workflow follows code paths someone wrote, an agent directs its own process and tool use. OpenAI's practical guide of April 2025 goes further, requiring that the model own the whole task, recognise when it is done and hand control back if it fails.
The OECD's working paper of 13 February 2026 refuses a single threshold and treats agency as graded, then adds the distinction most vendor copy blurs: an AI agent is one system, agentic AI is an architecture of coordinated agents. Gartner's June 2025 definition works by exclusion: if a scripted bot could do it, it is not agentic.
A workflow with an AI step fails the first test. A copilot fails the second, because it waits for you.
A single agent passes both. Agentic AI, in the OECD's sense, is several agents passing both and coordinating.
Almost every agent a marketer can buy today ships with human approval as the default and acts alone only if you switch that on. The OECD paper describes four levels of action autonomy: the system recommends and a person decides; it proposes and proceeds on approval; it acts unless a person intervenes; it acts alone. Britain's Digital Regulation Cooperation Forum reached a five-level version by a different route on 31 March 2026, and noted that most deployed systems sit towards the lower middle.
The product documentation bears that out. HubSpot's Prospecting Agent offers two modes, "Review before sending" and "Send automatically", and its partners recommend the first. Amazon's Ads Agent will turn a media plan into launch-ready campaigns but launches nothing without approval.
Microsoft's Sales Qualification Agent has a research-only mode that hands a seller a recommendation and a draft, and a research-and-engage mode that sends, follows up and qualifies inside criteria you configured. ChatGPT's and Claude's agent modes both stop for confirmation before purchases, sends and anything the platform classes as consequential. Zapier's own guidance is the frankest of the lot: use a Zap when you need predictability, use an agent when 80% accuracy is enough.
So autonomy is a property of a configured action, not of a product. The same HubSpot agent is propose-and-approve on Monday and act-alone on Tuesday if someone flips the setting. Classify the action, not the subscription.
Ask four questions in the demo, then break something. Gartner estimated in June 2025 that only about 130 of the thousands of vendors using agentic language had substantial agentic capability, and called the rest "agent washing".
It published no methodology for the count, so treat it as a warning rather than a census. The questions below are ours; each traces to a published source.
Who chooses the next step? If it is a rule, you are looking at automation. If it is you prompting each turn, a copilot.
If it is the model, an agent. Can it act on a system, not just draft for one? Sends, updates, publishes, spends.
If everything ends in a suggestion box, it is a copilot with better branding. Does it know when it is done or stuck, and can it stop itself? Ask to see a failure and the hand-back.
Are several of these coordinating? One is an AI agent. A planner delegating to a researcher, a writer and a publisher is agentic AI.
Then the break test. Give it a messy task with a missing input and watch one step fail.
A real agent notices, picks an alternative inside its permissions, continues or escalates, shows you the trace, and still respects the same spend and data limits afterwards. If it runs a fixed happy path or asks you which button to press, the label is doing more work than the software.
In the CRM, in outreach and in support, at bounded autonomy with a published trail of successes and failures. Almost nowhere in content at real autonomy with published results, which is the opposite of where most marketers expect to start.
The most mature layer, because the work is tool-based, repeatable and measurable. HubSpot's Breeze enrichment fills standard CRM fields free on paid tiers, and since the second quarter of 2026 an activity log records what the agent changed. Microsoft's Sales Qualification Agent, generally available since October 2025, researches a lead from CRM and web sources, decides whether a seller should engage and either drafts or, in engage mode, sends.
Salesforce says its own agents re-engaged 68,000 leads, sent 156,000 emails and booked 800 meetings between July and October 2025; that is Salesforce's number and nobody has audited it. Independent tracking puts paid Agentforce adoption at roughly 6% of Salesforce's customer base as of May 2026, which is the better guide to how far this layer has actually got.
Producing the best-documented failures in agentic marketing. TechCrunch reported in March 2025 that ZoomInfo trialled 11x's autonomous SDR for about a month and found it performed "significantly worse" than its human team, that Airtable had been listed as a customer without ever being one, and that former employees put churn at 70 to 80% within three months; 11x disputed the figures and said retention was 79%. The mechanism is what matters.
Unreviewed outbound at scale burns sending domains, produces replies a person would never send and cannot carry a multi-turn objection, so buyers leave at the first break clause. A vendor's reply-rate screenshot tells you nothing; a holdout and a domain-reputation metric do.
Handling routine volume at scale, and producing the clearest reversal. Klarna said in February 2024 that its assistant handled 2.3 million conversations in its first month, the equivalent of 700 full-time agents. By May 2025 its chief executive told Bloomberg that cost had been "a too predominant evaluation factor" and that "what you end up having is lower quality", and Klarna began rehiring humans for disputes and hardship cases.
The assistant still fronts the routine work. What broke was quality on the hard cases, hidden behind an aggregate resolution rate. Intercom's Fin, which Salesforce finished acquiring on 10 September 2026, reports a 76% average resolution rate across more than 8,000 businesses; no third party has audited it.
Less than the marketing suggests, with the least independent evidence of any layer. Duolingo is the one content operation with independent reporting: about 10% of contractors offboarded in January 2024, an "AI-first" memo in April 2025, 148 AI-built courses launched a week later, a backlash that wiped its TikTok and Instagram accounts in May, and a walk-back through 2025 and 2026. No error rate was ever published, and that was generative content with a pipeline rather than an agent.
Products like Kontent.ai's Expert Agents will take a brief, draft, check against brand guidance and create a design task, and their own documented workflow keeps publishing approval with a person. We could find no B2B company that has published error or reversal rates for an agentic content pipeline.
Sensing and recommending continuously, and acting rarely. Natural-language query tools (Databricks Genie, Snowflake Cortex, Power BI Copilot, Tableau) answer the question asked. Investigative tools rank probable causes.
Acting tools are scarce: Amplitude's experimentation agent, announced 17 February 2026, designs and launches tests and makes rollout decisions, and its own copy keeps a human in the loop. Microsoft's Fabric Operations Agent detects, diagnoses and recommends, then waits for approval before it runs anything. The agentic moment is when an insight becomes an authorised action, and almost every product stops just before it.
The generative and agentic layers are being joined by the platforms, accountability for the result stays with you in writing, and the one rigorous study says removing the human from the loop costs a measurable slice of the lift.
Meta's Advantage+ is now the default creation flow, its run-rate passed $75bn in the second quarter of 2026, and since July it has been rewriting headline text baked into ad images unless you opt out per creative. Google's AI Max for Search and automatically created assets switched on for eligible campaigns in September 2026, and its Terms of Service from 1 July 2026 treat automatically created assets as advertiser-provided content once submitted.
LinkedIn retired standalone Accelerate campaigns on 4 August 2026 and folded the automation into the classic flow. Amazon's Ads Agent still launches nothing unapproved.
The failure case is documented. Business Insider reported in July 2026 that Meta auto-enrolled the retailer REI in an AI creative feature and ran an Instagram ad showing a bicycle with two handlebars; REI disabled the setting and republished.
A platform changed a live campaign's creative inside paid delivery. Nobody approved the image.
The evidence on whether coupling helps is thin. An 11-month randomised trial published on arXiv in April 2026, run by the vendor aampe on 8.8 million lapsed consumer-app users with a persistent holdout, found agentic messaging sustained a 57% lift in notification clicks after seven months unattended, but the phase where humans actively curated the inputs beat the autonomous phase by 12 to 26% in relative lift, and the trend was turning down by the end. No study yet compares the same generated creative with and without a human gate before serving.
Let an agent act alone only on work you can undo faster than a customer, prospect or regulator can notice. Everything else stays at propose-and-approve until you have run a holdout that says otherwise. That is our position, it is more conservative than the vendors' and than some of our members', and it is the one the evidence supports.
The published frameworks converge on four tests: reversibility, blast radius, verifiability of the output and data sensitivity. OpenAI's guide names human-intervention triggers for high-risk or irreversible actions. Microsoft's governance framework wants every agent observable, owned and interruptible.
Anthropic's containment work found people approved roughly 93% of Claude Code permission prompts, which is evidence that too many checkpoints produce rubber-stamping, and its analysis of API traffic found only 0.8% of agent actions were apparently irreversible, with sending a customer email listed among them. A May 2026 architecture paper made the point cleanest: reversibility is a property of the action, not of who approved it.
Putting those together gives a two-axis map. It is ours, not the OECD's or any vendor's.
Publish a page and you can unpublish it in seconds. Send 5,000 emails and you cannot. The autonomy level follows the task, not the product.
With permissions rather than prompts. Telling an agent to be careful changes nothing it can reach; giving the drafting tool and the sending tool different credentials does. Nobody has published a complete guardrail design for a non-advertising marketing agent, so this one is assembled from controls that ship today.
Two rules from the vendors' own engineering are worth adopting as written. Microsoft's guidance says the approval for an irreversible action must be deterministic, enforced by the orchestrator, never left to the model to judge whether a send is risky. Anthropic's finding on approval fatigue means fewer, more meaningful gates plus hard technical boundaries beat a confirmation prompt on every step.
More than the token bill, and in units most finance teams do not yet track. The right unit is cost per completed outcome: per qualified meeting, per resolved ticket, per correctly completed CRM workflow, per published page that passes QA, including the human review and the reversals.
Pricing is moving that way. HubSpot switched on 13 April 2026 to roughly £0.40 ($0.50) per resolved Customer Agent conversation and £0.80 ($1) per lead its Prospecting Agent recommends. Intercom's Fin charges about £0.80 ($0.99) per resolution, with a resolution counted after 24 hours of silence, which is the main practitioner complaint.
Salesforce Agentforce runs at roughly £1.60 ($2) per conversation or a credit per action. The autonomous SDR tools sit at £4,000 to £6,400 ($5,000 to $8,000) a month on annual terms. Prices checked against secondary sources in July 2026; read the live pages before you sign.
Consumption is where budgets break. On OpenRouter's network, agents now consume roughly five times the tokens that human users do, and more than 85% of that is context re-read on every step. Microsoft Research found in April 2026 that agentic coding tasks used around a thousand times the tokens of a simple chat benchmark and that the same task varied up to thirtyfold between runs.
KPMG's Global AI Pulse for the second quarter of 2026 asked approximately 2,100 senior leaders whether their organisation had "questioned, delayed, or scaled back the deployment of AI agents because the expected costs began to outweigh the value generated". Forty-nine percent said yes; only 26% had real-time visibility of AI operating costs. One line from the fine print: HubSpot's credit pool auto-upgrades by default when it runs out.
One task, one autonomy level, a baseline before you start and a matched human control while you run. Nobody has published this design for marketing, so it is ours, built from OpenAI's advice to start with one agent and one workflow, Microsoft's simulation mode for its sales agent, and the post-mortems of the failures above.
Spend one to two weeks recording the current process: throughput, time, error types, conversion or resolution rate, escalation rate, cost. Then one to two weeks in replay, running last quarter's records through the agent and deliberately feeding it stale data and a prompt-injection attempt.
Then two to four weeks in shadow mode: live inputs, but it writes only to a review queue and you compare every recommendation with what the team actually did. Then four to six weeks as a canary: limited live action on a small cohort, daily caps, full review of anything consequential, the kill switch tested, and a matched group the humans keep running.
The promotion criterion is set before you start, and it includes the dangerous case. Klarna measured resolution and speed and missed the dispute. Duolingo measured course volume and missed the brand.
11x's customers let a 90-day break clause do the measuring. Your criteria need a quality measure (complaint rate, unsubscribe rate, factual or brand defect rate), a cost-per-outcome ceiling, a named rollback trigger and a contractual exit.
To prove an agent beat the team rather than coincided with a good quarter, you need three cells: the human baseline, AI-assisted with a person approving, and agentic within its permitted boundary. Randomise at the account or contact level so a control prospect never receives treatment logic, pre-register the primary metric and the stopping rule, and run for at least four months, because the aampe trial's autonomous lift was decaying by then. Measure business outcome per eligible unit: qualified meetings, not emails sent.
Not yet. The independent evidence for agentic marketing performance in September 2026 fits in a paragraph, and the gap is the finding. DataBeat's June 2026 programmatic report, drawn from $55m of monthly publisher revenue and 35 billion impressions, found agentic buyers cleared at $6.13 CPM against $6.95 for conventional programmatic while entering 86% fewer auctions; it measures publisher-side auction outcomes rather than advertiser profit, and PubMatic is a data source.
The aampe trial is the one randomised study, and it is consumer push notifications. StackAdapt's survey of 500 marketers plus 187 of its own customers, published 19 August 2026, found comfort dropping from 90% for an agent that recommends to 78% for one that acts within rules the team set, and to 50% for full autonomy even once performance was proven; only 6% act on in-platform AI recommendations almost always.
Everything else is a vendor test presented as a finding: Meta's roughly 22% better return for Advantage+, Fin's 76%, HubSpot's four hours saved per person per week. None is audited.
Forrester reported in June 2026 that half of US agencies use agentic AI for execution and did not disclose the sample. The measurement gap is why the delegation gap exists, and it is why the pilot design above matters more than any number in this section.
Job design is changing before the headcount data exists. The clearest artefact is a title: "Agentic Operator, Marketing", posted by Docebo on 15 May 2026, sitting in campaign operations with a remit to own marketing's AI layer, build the agent workflows, run the AI-powered nurture and outbound, maintain the knowledge library and measure the return. Ramp, Serval and WeTravel posted near-identical roles in the same quarter; WeTravel's says in terms that it is "not a coding role".
The adjacent function has a name and a growth curve. Go-to-market engineering postings, for the people who wire Clay, Make, n8n and the CRM together, roughly doubled from around 1,400 in mid-2025 to more than 3,000 by January 2026 on recruiter counts of job boards. Sumble's data for the first half of 2026 had SDR postings at US B2B companies down 21% while go-to-market engineering headcount doubled.
The documented redundancies are in support and content production, at Salesforce, Klarna and Duolingo. Marketing-specific headcount data does not exist yet, and we would rather say so than quote a number we cannot trace.
The scarce skill is turning a marketing process into a governed system: decompose the task, assign the autonomy level, design the evaluation and the holdout, set the permissions, read the cost per outcome, and tell a workflow from an agent when the vendor will not. If you are becoming that person, you are becoming the one these job titles describe.
We wrote about that identity separately in What Is an AI-Native Marketer? (And How to Become One).
On agencies: the plan to buy model capacity wholesale and resell it to clients at a markup is being discussed openly by the holding companies, per Digiday and AdExchanger in late July and early August 2026, and no agency has disclosed doing it. If you retain one, ask for token pass-through terms now.
Yes, as default-on platform automation with fewer opt-outs and no audit trail. What does not reach you is the governance layer the large buyers get.
Meta's Advantage+ is the default at every tier and 9 million small businesses use it. Google's AI Max switched on for eligible campaigns of any size in September 2026. LinkedIn's AI campaign building sits in the standard Campaign Manager.
HubSpot's Prospecting Agent is now on all paid Hubs, though most agents need a Professional tier from roughly £360 to £710 ($450 to $890) a month. Fin starts at about £40 ($49) a month for 50 resolutions. Zapier's agents run on a Starter plan at about £24 ($29.99) a month, and traffic to Zapier, Make and n8n fell by double digits in the twelve weeks to August 2026 as agent-native tools took share.
A three-person B2B team can run CRM enrichment, agent-assisted prospect research with human-approved outreach, support deflection from a maintained knowledge base, platform-managed delivery and agent-written reporting. It cannot yet safely run unreviewed bulk outbound from its core domain, autonomous spend allocation across Google, LinkedIn, Meta and the CRM, or autonomous publication of anything with a claim in it.
Capability reaches everyone; the control layer does not. The practical move is one workflow that joins systems end to end, say inbound lead research to CRM enrichment to human-approved outreach to pipeline reporting, rather than a replica of an enterprise agentic department.
Every form, inbox, web page and enrichment feed an agent reads is an input an outsider can write to. The three reference incidents in the field all happened in marketing and sales systems.
ForcedLeak, disclosed 25 September 2025, worked by placing instructions in the description field of a Salesforce Web-to-Lead form. When an employee later asked Agentforce about the lead, the agent followed the embedded instructions and sent CRM data to an attacker's domain, a lapsed Salesforce-related address bought for about $5. Severity was rated 9.4 out of 10.
EchoLeak, in June 2025, did the same to Microsoft 365 Copilot through a crafted inbound email with no click required. In August 2025, attackers took the OAuth tokens behind Salesloft Drift's chatbot and queried the Salesforce instances of more than 700 organisations.
OWASP's Top 10 for Agentic Applications, published 9 December 2025, names the classes: goal hijack, tool misuse, privilege abuse, supply-chain compromise through connected tool servers, memory poisoning. Its own position is that there is no fool-proof prevention for prompt injection and that mitigation is the realistic goal. Which is why the guardrail design above starts with what the agent can reach rather than what it is told.
You are, in every jurisdiction that has ruled so far, and the platforms have put it in writing. No case yet turns on an agentic marketing system as such, but the direction is settled.
The British Columbia tribunal that heard Moffatt v Air Canada in February 2024 called the airline's argument that its chatbot was a separate legal entity "remarkable" and held the company to the bereavement policy the bot invented. A German appeals court in Hamm reached the same conclusion in May 2026 for a chatbot that invented medical titles, and a Munich court held Google directly liable for false statements in its AI Overviews.
Google's Ads Terms of Service from 1 July 2026 make automatically created assets your content once submitted. The FTC's first order against a seller of AI sales agents, Air AI, settled on 24 March 2026 with an $18m judgment, largely suspended, over false earnings claims.
The EU's transparency duties under Article 50 of the AI Act have been live since 2 August 2026, and the Digital Omnibus did not defer them. If your agent talks to people, they must be told it is an AI, which bears directly on SDR and support agents; synthetic media must be marked, with a grace period to 2 December 2026 for systems already on the market; fines run to €15m or 3% of turnover. The high-risk obligations are deferred to December 2027 and most marketing agents will not fall under them unless they touch credit or employment.
In the UK there is no agentic statute; the Information Commissioner's Office has dedicated agentic guidance in consultation, with final guidance planned for spring 2027, and the DRCF paper records the ICO's view that organisational responsibility is unchanged by autonomy. In the US, Texas's AI law has been in force since January 2026, Colorado's has been reset to a January 2027 framework, and the FTC's position across its AI enforcement is that using AI relaxes none of your existing obligations.
Agentic AI is not marketing automation, not a copilot, not generative AI and not a single AI agent, and the test at the top of this page separates them. Automation follows a rule a person wrote and never chooses. A copilot drafts and recommends and waits for your click.
Generative AI produces an asset and takes no action of its own. A single AI agent decides its next step and acts; agentic AI is several of them coordinating. Agentic commerce is the same technology pointed at consumers buying rather than marketers selling, and belongs in a different article.
If a vendor's demo cannot show you the model choosing a step, acting on a system, recovering from a failure and leaving a trace, you are being sold one of the neighbours.
Is ChatGPT an agentic AI?
Not by default. A ChatGPT conversation is a copilot: it generates and waits for you. ChatGPT's agent mode, and equivalents from Anthropic and Google, can plan multi-step tasks, browse and use tools, which meets the definition of a single AI agent, but they stop for confirmation before purchases, sends and other consequential actions unless you change that.
What is the difference between generative AI and agentic AI?
Generative AI produces something, such as text, an image or a plan, and stops. Agentic AI takes a goal, decides what to do, acts on other systems through tools, checks the result and continues. Most agentic systems use a generative model to reason, so the difference is whether the model is allowed to act on what it produces.
What is the difference between an AI agent and agentic AI?
The OECD's February 2026 working paper draws the line: an AI agent is a single system that perceives, plans and acts on a goal; agentic AI is an architecture of several coordinated agents that split a task between them. Vendors use the terms interchangeably. The distinction matters for oversight, because a multi-agent system has more places to fail and more hand-offs to audit.
What is an example of agentic AI in marketing?
Microsoft's Sales Qualification Agent in research-and-engage mode: it researches an inbound lead from CRM and web sources, decides whether to engage, sends personalised outreach, follows up, gauges intent, qualifies or drops the lead and hands it to a seller, all inside criteria the team configured. HubSpot's Prospecting Agent in "Send automatically" mode is the equivalent inside HubSpot.
How autonomous are agentic AI tools today?
Less than the marketing suggests. Every major product we reviewed ships human approval as the default for consequential actions and makes acting alone an opt-in. The UK's Digital Regulation Cooperation Forum noted in March 2026 that most deployed systems sit towards the lower middle of its five-level autonomy scale, with approval steps, spending limits and monitoring.
Should a small marketing team use agentic AI?
Yes, for bounded, reversible, internal work: CRM enrichment, account research, support deflection from a maintained knowledge base, reporting. Not yet for unreviewed outbound from your main domain, autonomous spend allocation or unreviewed publication of anything containing a claim. Start with one workflow that joins systems end to end and keep a human approval on every external action until a holdout says you can remove it.
Who is responsible when an AI agent makes a mistake?
The organisation that deployed it. Courts in Canada and Germany have held companies to what their bots said, Google's Ads terms treat automatically created assets as the advertiser's own content, and the EU AI Act's transparency duties apply to the deployer. "The agent did it" has not succeeded as a defence anywhere yet.
SaaStrix is where B2B marketers become agentic marketing leaders, and you can try it free for five days.
.svg){kind=icon}