Companies pour money into AI agents, but only 1% have figured them out

The investment surge is real. 88% percent of business functions plan to increase AI-related budgets in the next 12 months, driven largely by agentic AI. Two-thirds report productivity gains from early implementations, and three-quarters believe AI agents will reshape the workplace more profoundly than the internet did. Meanwhile, 92 percent of companies say they're increasing AI investments over the next three years.

The maturity gap

However, there is a disconnect: only 1 percent of leaders describe their organizations as mature in AI deployment, meaning AI is fully integrated into workflows and drives substantial business outcomes. The gap between spending and sophistication is looking more like a canyon.

The maturity problem shows up in how companies operate. Only one in five organizations has mature governance models for autonomous AI agents, even as those agents gain access to sensitive systems and data. 80% of organizations have encountered risky AI agent behavior such as unauthorized access, handling of restricted information, and actions outside intended boundaries.

Security gaps at scale

The risk isn't theoretical. In March 2026, security firm CodeWall demonstrated how an AI agent hacked McKinsey's internal AI platform in under two hours, gaining access to 46.5 million chat messages and metadata about hundreds of thousands of confidential files. The agent exploited publicly exposed API documentation and unauthenticated endpoints. These are basic security gaps that shouldn't exist in production systems handling sensitive data. This isn't an indictment of McKinsey specifically. It's evidence that organizations are deploying AI systems faster than they're securing them.

The enthusiasm is understandable, and early results look promising. Companies report faster decision-making, cost savings, and improved customer experience from AI agents handling tasks in customer service, software development, and finance. But only about one-third of organizations are scaling AI across the enterprise, and fewer than 10 percent have deployed agentic AI at a functional scale.

Most companies remain stuck in what industry observers call "pilot purgatory." They've launched AI projects that show promise in isolated pockets but haven't figured out how to turn those experiments into transformation. The technology works, and the business case is clear, but what's missing is the organizational capability to deploy AI safely and systematically.

Part of the problem is that companies are treating AI deployment as a technology project rather than an operating model transformation. Only 34% are truly reimagining how work gets done, according to enterprise leaders surveyed in mid-2025. The rest are automating existing processes or adding AI features to current workflows – incremental improvements that don't require rethinking how the business operates.

What separates the 6 percent

High performers look different. The 6% of companies reporting more than 5% EBIT impact from AI share common patterns: they redesign workflows around AI capabilities, implement clear human-in-the-loop validation processes, and treat AI as a catalyst for new business models rather than a tool for efficiency.

The infrastructure exists, the models are capable, and the early pilots are working. What separates leaders from laggards is governance, measurement, and the willingness to fundamentally rethink operations. Fewer than half of organizations actively mitigate even common AI risks, despite growing awareness.

The longer companies stay in experimentation mode, the wider the gap becomes between those capturing value and those burning capital on pilots. The organizations that solve the maturity problem first will see better returns on their AI investments while simultaneously building capabilities that competitors will struggle to match.

McKinsey's long-term AI opportunity remains at $4.4 trillion in added productivity potential. But capturing that value requires more than budget increases and enthusiasm. It demands governance frameworks that keep pace with technology, operating models that treat AI as infrastructure rather than innovation, and leadership teams willing to make the organizational changes that turn pilots into platforms.

The investment numbers signal commitment, while the maturity numbers signal that most organizations have a long way to go.

________________________

Sources

PwC AI Agent Survey, April 2025

McKinsey Superagency in the Workplace, January 2025

Deloitte State of AI in the Enterprise 2026

McKinsey Trust in the Age of Agents, October 2025

McKinsey State of AI 2025

Financial Times, March 2026