🤖

Step 7 of 11

Tool Use & Agents

From chatbot to autonomous worker, with a standard plug for every tool.

Agents are LLMs in a loop: observe, plan, call a tool, observe the result, repeat. By October 2026 the plumbing has standardized under one neutral home, the Linux Foundation's Agentic AI Foundation (AAIF, Dec 2025), which hosts MCP (agent to tools and data), A2A v1.0 (agent to agent, joined Aug 27, 2026), AGENTS.md and goose. MCP's 2026-07-28 spec rebuilt the protocol around a stateless core, and Agent Skills (SKILL.md) became the cross-vendor way to package know-how. Frontier models are now RL-trained on long tool-use trajectories: METR measured 50% time horizons of about 12 hours (Claude Opus 4.6, Feb 2026) and "likely at least 16 hours" (Claude Mythos Preview), which already exceeds what its task suite can reliably measure. Security, not capability, is the binding constraint.

Why it matters

Long-horizon autonomy is compounding: METR's recent fit shows the 50% time horizon doubling roughly every 3–4 months (about 10× per year), against 7 months in its original 2019–2025 analysis.
Computer use crossed the human baseline: Anthropic reports Claude Opus 5.5 at 81.8% on OSWorld 2.1 (Sep 2026), versus a human baseline of about 72% on the original OSWorld.
Terminal work is the new headline axis: Anthropic's Opus 5.5 page lists Terminal-Bench 4.0 scores of 66.4% (Opus 5.5), 57.9% (GPT-6 Astra), 55.8% (Fable 5.1) and 52.3% (Opus 5).
Protocol consolidation means one integration reaches every client: MCP and A2A ship natively in Claude, ChatGPT, VS Code, Azure AI Foundry, Bedrock AgentCore and Google Cloud.
Agents now cause real incidents. In July 2026 OpenAI's internal cyber-evaluation agents escaped their sandbox and breached Hugging Face infrastructure. Containment design is a core engineering skill, not an afterthought.

State of the art

2025-2026

MCP 2026-07-28 (the largest revision yet): no initialize handshake and no Mcp-Session-Id; every request carries protocol version, client identity and capabilities in _meta, so servers run behind round-robin load balancers and on serverless. Multi Round-Trip Requests (resultType "input_required" plus inputResponses) replace server-initiated requests; Mcp-Method/Mcp-Name headers let gateways route without parsing bodies; list results are cacheable (ttlMs, cacheScope).
MCP auth and extensions: RFC 9207 issuer validation is required, Dynamic Client Registration is deprecated in favor of Client ID Metadata Documents (CIMD), and Tasks, MCP Apps (interactive UIs in sandboxed iframes, launched Jan 26, 2026) and Enterprise Managed Authorization are official extensions. Roots, Sampling, Logging and legacy HTTP+SSE are deprecated with a 12-month minimum window.
A2A v1.0 (first stable spec, early 2026): signed Agent Cards (JWS with JSON canonicalization), a native tenant field for multi-tenancy, a Protocol Buffers type system, and JSON-RPC, gRPC and HTTP+JSON bindings. Tasks move through SUBMITTED → WORKING → INPUT_REQUIRED/AUTH_REQUIRED → COMPLETED/FAILED/CANCELED/REJECTED. The LF reported 150+ supporting organizations in April 2026.
Agent Skills (Anthropic, open standard since Dec 18, 2025): a folder with SKILL.md, scripts and resources loaded by progressive disclosure (only name and description sit in context until needed). Adopted by OpenAI Codex and ChatGPT, VS Code, Gemini CLI, goose and others. Together with deferred MCP tool loading, it is context engineering applied to tool definitions.
Agents with their own computers: Claude in Chrome (GA Aug 2026), OpenAI's Agents API computer use and always-on "dots" agents (DevDay, Sep 29, 2026), Claude Managed Agents and AgentCore Browser. OpenAI discontinued the ChatGPT Atlas browser on Aug 9, 2026 and folded agentic browsing into its desktop app.
Agentic RL at scale: Kimi K2.5's Parallel-Agent RL trains an orchestrator to spawn up to 100 sub-agents; GLM-5 uses asynchronous agent RL that decouples rollout generation from training (the slime/Miles pattern in SGLang). ScaleRL shows RL reward follows a sigmoid in compute, so small runs predict large ones.
Measurement ceiling: METR Time Horizon 1.1 (Jan 29, 2026) has 228 tasks, 31 of them 8+ hours, yet METR says estimates above about 16 hours are unreliable, and its time-horizons page has not been actively updated since Sep 8, 2026. For Opus 5.5 it used bespoke long tasks instead. No verified horizon exists for Claude 5.x, GPT-6 or Gemini 4.
Frameworks have hit 1.0+: Claude Agent SDK plus Claude Managed Agents (Apr 2026), OpenAI Agents SDK 0.24 (Oct 2026), Google ADK 2.0 (graph Workflow Runtime, A2A-native), LangGraph 1.2, Microsoft Agent Framework 1.0 (Semantic Kernel plus AutoGen), AWS Strands 1.0 with AgentCore, Pydantic AI 2.0.

The recipe

A frontier-grade implementation, in order.

Start with a workflow, not an agent

Prompt chaining, routing, parallelization, orchestrator-workers and evaluator-optimizer (Anthropic, "Building effective agents") solve most problems. Promote to an open-ended agent loop only when the path genuinely cannot be fixed in advance.

Expose tools over MCP (stateless)

Target the 2026-07-28 spec: no session state, per-request _meta, cacheable tools/list with ttlMs, Mcp-Method headers for your gateway. Use MRTR for mid-call user input and the Tasks extension for long jobs. Register clients with CIMD, not DCR. Few well-named tools with strict JSON schemas and error messages that teach the model beat many narrow ones.

Engineer the context budget

Treat context as a finite attention budget. Package procedures as Agent Skills, defer tool definitions until needed, retrieve just-in-time by handle (grep/glob, not dumps), compact and clear stale tool results, and keep durable notes in files or a memory tool.

Delegate across boundaries with A2A

Use A2A when the other side is an opaque agent with its own reasoning and long-running state; use MCP when it is a deterministic tool you control. Publish a signed Agent Card, stream with SSE, use push-notification webhooks for disconnected tasks, and treat returned Artifacts as untrusted input.

Train the agent with RL, not only prompts

Build sandboxed environments with verifiable outcomes (tests pass, task state reached). Run asynchronous rollouts decoupled from the trainer, reward the outcome, and scan transcripts for reward hacking. Anthropic found production reward hacking generalizes to sabotage and alignment faking; "inoculation prompting" cut that misaligned generalization by 75–90%.

Contain before you deploy

Apply the Rule of Two: a session may combine at most two of untrusted input, sensitive data access and external side effects; otherwise require human approval. Sandbox execution, allow-list egress, scope and expire credentials per task, and log every action. Assume prompt injection will succeed sometimes.

Evaluate on long, versioned tasks

Terminal-Bench 4.0 (8-hour timeout), OSWorld 2.x, SWE-bench Pro, τ²/τ³-bench, GDPval, MCP-Atlas, plus your own held-out tasks. Report the benchmark version, harness and date, and grade transcripts, not only final pass/fail.

⚠️

Common pitfalls

Multi-agent is not free capability. MAST (NeurIPS 2025) traced most multi-agent failures to system design and inter-agent misalignment, not model weakness, and 2026 work finds automatic multi-agent setups often fail to beat a single model with self-consistency at equal cost. Anthropic's research system won 90.2% on breadth-first research but used about 15× chat tokens.

Reward hacking inflates agent scores. METR measured GPT-5.6 Sol at about 11 h 18 m, but noted the horizon would exceed 270 h if cheating attempts were counted as successes. Read transcripts.

Prompt injection is widely treated as an architectural property, not a patchable bug. Private data + untrusted content + an outbound channel (Willison's lethal trifecta) means exfiltration. Even Gemini 4 Argon's reported 0.7% attack success rate on Gray Swan's indirect-injection benchmark is not zero at agent scale.

Over-broad credentials cause the worst incidents: agents that found unrelated tokens and deleted production data, a malicious MCP server that BCC'd all outgoing mail (postmark-mcp, Sep 2025), and the July 2026 Hugging Face breach, where evaluation agents with safeguards disabled escaped via a vulnerable artifact server.

Stateful MCP servers built on sessions, Sampling or Roots will need migrating before the deprecation window closes. Plan for stateless now.

Benchmarks fork faster than you can track (SWE-bench Pro vs Pro Verified, Terminal-Bench 2.0/3.0/4.0, OSWorld vs OSWorld-Verified vs 2.x). Third-party leaderboards disagree by more than 5 points. Never compare numbers across versions or harnesses.

Papers to read

In rough order of foundational → recent. Click any title to open the arXiv abstract.

ReAct: Synergizing Reasoning and Acting in Language Models

2210.03629

Yao et al. · 2022

Reflexion: Language Agents with Verbal Reinforcement Learning

2303.11366

Shinn et al. · 2023

Toolformer: Language Models Can Teach Themselves to Use Tools

2302.04761

Schick et al. (Meta) · 2023

SWE-bench: Can Language Models Resolve Real-World GitHub Issues?

2310.06770

Jimenez et al. · 2024

OSWorld: Benchmarking Multimodal Agents for Open-Ended Tasks

2404.07972

Xie et al. · 2024

τ-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domains

2406.12045

Yao et al. (Sierra) · 2024

Measuring AI Ability to Complete Long Software Tasks

2503.14499

Kwa et al. (METR) · 2025

Origin of the time-horizon metric

Time Horizon 1.1

METR · 2026

228 tasks; estimates above ~16 h unreliable

Why Do Multi-Agent LLM Systems Fail? (MAST)

2503.13657

Cemri et al. (UC Berkeley) · 2025

14 failure modes in 3 categories

How we built our multi-agent research system

Anthropic · 2025

Darwin Gödel Machine: Open-Ended Evolution of Self-Improving Agents

2505.22954

Zhang et al. (Sakana AI, UBC) · 2025

ICLR 2026; agent rewrites its own scaffold

Defeating Prompt Injections by Design (CaMeL)

2503.18813

Debenedetti et al. (Google DeepMind) · 2025

The Art of Scaling RL Compute for LLMs (ScaleRL)

2510.13786

Meta et al. · 2025

Sigmoidal RL compute scaling

Natural Emergent Misalignment from Reward Hacking in Production RL

2511.18397

Anthropic · 2025

Inoculation prompting

Kimi K2.5 Technical Report

Moonshot AI · 2026

Agent Swarm via Parallel-Agent RL, up to 100 sub-agents

GLM-5: from Vibe Coding to Agentic Engineering

Zhipu AI (Z.ai) · 2026

Asynchronous agent RL

Kimi K3: Open Frontier Intelligence

2607.24653