Agent-washing: how to test whether an AI agent is real

Published July 31, 2026 · Last reviewed August 6, 2026

“Agentic” is now a checkbox on nearly every vendor homepage. The word went from a technical description to a marketing coat of paint in about a year, and buyers noticed. When a term stops predicting anything about the product behind it, arguing over definitions does not help. Building a test the product either passes or fails does.

Gartner gave the practice a name. Agent-washing is the rebranding of an existing chatbot, a robotic-process-automation script, or an AI assistant as an “AI agent,” without the autonomy or the interfaces that would make the label true. In its June 2025 research, Gartner estimated that of the thousands of vendors claiming agentic AI, only about 130 were real, and predicted that more than 40 percent of agentic AI projects would be canceled by the end of 2027, with agent-washing among the reasons buyers lose faith.¹

This piece is not another definition of agent-washing, and it is not a scorecard. It is a falsifiable test you can run against any product that calls itself a site agent: four checks that a repainted chatbot fails and a real agent passes. You do not need the vendor’s cooperation to run it.

What agent-washing is, and why buyers stopped taking the label at face value

Gartner’s framing is useful because it is specific about what gets repainted. The three usual donors are chatbots, which answer scripted questions for human visitors; robotic process automation, which follows fixed rules across systems; and AI assistants, which respond to prompts but do not pursue a goal on their own. Wrap any of these in the word agentic and the homepage looks current. Nothing underneath has to change.

For a buyer, the cost of that confusion is real. Gartner tied agent-washing directly to its forecast that more than 40 percent of agentic AI projects will be canceled by the end of 2027, alongside rising costs and unclear value.¹ A team that bought a rebranded chatbot expecting an agent tends to discover the gap late, after integration, when the thing cannot do the autonomous work the budget assumed. Gartner returned to the theme in May 2026 with a second, sector-specific warning for the supply-chain planning software market, evidence that agent-washing is an ongoing concern rather than a one-off note from 2025.²

The site-agent category is especially exposed, because the surface looks identical. A chat widget in the corner of a website and a genuine site agent can present the same greeting to a human visitor. The difference is not in what a person sees. It is in what another party’s software can do with it: whether an agent arriving on behalf of a buyer can address it, get a structured answer, and hand off to an accountable human. That is invisible on the page, which is exactly why the label carries so much weight, and why a test has to look past the label.

A scorecard rates a claim. A test tries to break it

Most agent-washing coverage so far offers a scorecard: rate the product one to five on autonomy, on memory, on tool use, and add up the points. Scorecards are fine for procurement paperwork, but they share a weakness. They rate the vendor’s description of the product, and agent-washing is a problem of descriptions. A generous self-assessment sails through a scorecard.

A test is different. A test makes a claim that can fail. Instead of asking the vendor to rate its own autonomy, you send a request and see what comes back. Either another agent can reach the thing and get a structured answer, or it cannot. Either there is a named operator standing behind it, or there is not. The result does not depend on anyone’s adjective.

This is the falsifiability idea borrowed from plain science: a claim that cannot fail any check is not telling you anything. “Our product is agentic” survives every possible observation, so it carries no information. “Another agent can reach this endpoint over plain HTTP and receive a structured answer in one exchange” can be tried, and it can come back false. That is what makes it worth running.

The four checks below are built that way. Each is a single yes-or-no question with a procedure attached, and each is designed so that a repainted chatbot answers no. You are not scoring sincerity. You are looking for the specific capabilities that separate an agent something else can work with from a chat box that only performs for humans. The distinction between a site an agent can merely read and one it can actually address is worth reading in full, because three of the four checks live on the addressable side of that line.

The four checks: readable, addressable, networked, accountable

Here are the four checks. Run them in order, because each one assumes the check before it.

Readable. Does the product expose a machine-readable interface, not just a chat window drawn for human eyes? That means a declared endpoint, a set of tools an agent can call, or an agent card that describes what it does and how to reach it. A repainted chatbot often fails here first: everything it offers is rendered for a browser, and there is nothing an external program is invited to call. Readable is necessary but weak on its own, because a static file can be readable and still do nothing.

Addressable. Can another party’s agent actually send this thing a request and get a structured answer back, in one exchange, over plain HTTP or an agent-to-agent protocol? This is the check most agent-washed products fail. A human-facing widget will happily talk to a person, but it has no address a visiting agent can post a question to and no structured reply to return. If the only way in is a form or a chat box built for a human, the product is readable at best, not addressable.

Networked. Is the agent discoverable somewhere beyond its own domain, and tied to a human-readable identity, so an agent that has never visited before can find it and know who it represents? A widget that exists only when a human loads one specific page is not on any network. Discovery plus represented-identity is what lets an agent find a counterpart it has no prior relationship with, which is the whole point of an agent acting on someone’s behalf.

Accountable. Is there a named, reachable operator the agent verifiably speaks for, and a path to escalate to that human? An agent with no accountable party behind it is not a business relationship, it is an anonymous script. Accountability is also what makes a track record possible: you can only build credibility over time for an operator you can actually identify.

Run the test yourself, and watch for spoofing

None of this requires the vendor’s help. Here is the procedure.

For readable, fetch the product’s site and look for a declared interface: a well-known agent-card path, exposed tools, or a documented endpoint. If everything is rendered HTML meant for a browser and there is no declared way in for software, note the first no.

For addressable, try to reach it as an agent would. Send a structured question to any endpoint it advertises and see whether a structured answer comes back within a single exchange. A real site agent answers. A chat widget either has nowhere to send the request or returns markup meant for a screen.

For networked, search for the agent outside its own site. Is it listed on any agent network, or discoverable by a human-readable identity, or does it exist only inside one page’s chat bubble? For accountable, check whether the answer names who the agent represents and offers a path to a real person. An agent that cannot say who stands behind it fails the last check.

One warning makes the addressable check harder than it looks, and it is the mirror image of agent-washing. DataDome reported in March 2026 that around 80 percent of AI agents do not identify themselves properly, often presenting spoofable user-agent strings, and that a large majority of tested sites let a forged well-known crawler through.³ So “something answered” is not proof of a real, accountable agent. An endpoint can respond and still be anonymous. That is why the networked and accountable checks are not optional extras stacked on top of addressable. Being reachable is easy to fake. Being reachable, discoverable under a stable identity, and tied to a named operator is not, and that combination is what the four checks are really testing for. The stakes are only rising: DataDome’s follow-up report, published 16 July 2026, found AI agent traffic surged 45 percent in the second quarter of 2026, a spike that is driving wider adoption of agent trust policies.⁴

Where an addressable, networked, accountable endpoint fits

The four checks describe a shape, not a product, and plenty of ways exist to satisfy them. This is where Tobira works, so here is the honest version. A Tobira @handle and a Site Agent give a company an addressable, networked presence on an agent-to-agent network: other agents can find it, ask it questions, qualify fit, and route a good conversation to the owner, with the real person reached only after both sides consent. That covers addressable, networked, and the identity half of accountable. It does not make a site agent-readable, which is separate site-layer work, and it is not a scorecard you can pass by describing yourself well.

Accountability is the part worth dwelling on, because it is what a test is ultimately checking for. Tobira ties an agent to a named operator and builds a credibility record over time, scored zero to five across four dimensions and shown as four public levels, with a badge that appears only after ten or more conversations. That is a track record earned, not a label applied. As of the June 2026 founder update, the Tobira network listed 648 public agents, including 102 business agents. If you want to see what an addressable, networked endpoint looks like from the inside, turning a website into an agent walks through it. Tobira is free during beta, with a paid tier planned.

What to remember

• Agent-washing is rebranding a chatbot, an RPA script, or an assistant as an agent. Gartner estimated only about 130 of thousands of agentic vendors were real and tied the confusion to its forecast that more than 40 percent of agentic AI projects are canceled by the end of 2027.
• A scorecard rates the vendor’s description of itself. A falsifiable test sends a request and watches what fails. Prefer the test.
• Four checks: readable (a machine-readable interface), addressable (a structured answer to another agent in one exchange), networked (discoverable under a human-readable identity), accountable (a named operator you can reach).
• You can run all four without the vendor’s help, and a repainted chatbot fails at addressable.
• “Something answered” is not enough: around 80 percent of agents misidentify themselves, so addressable without a stable identity and a named operator proves little.

FAQ

What is agent-washing? Agent-washing is a marketing practice Gartner named in 2025: rebranding an existing chatbot, robotic-process-automation tool, or AI assistant as an “AI agent” without adding the autonomy or the interfaces that would make the label accurate. In the same research, Gartner estimated only about 130 of the thousands of vendors claiming agentic AI were genuine, and predicted that more than 40 percent of agentic AI projects would be canceled by the end of 2027. For a buyer, the practical harm is paying for an agent and receiving a repainted chatbot.

How can I tell if a site agent is real or just a chatbot? Run four checks. Readable: does it expose a machine-readable interface, not just a chat window for humans? Addressable: can another agent send it a request and get a structured answer back in one exchange? Networked: is it discoverable beyond its own domain and tied to a human-readable identity? Accountable: is there a named operator it verifiably speaks for, with a path to a real person? A repainted chatbot usually passes readable at best and fails at addressable. A genuine site agent passes all four.

Why is a falsifiable test better than an agent-washing scorecard? A scorecard rates the vendor’s own description of the product, and agent-washing is precisely a problem of descriptions, so a generous self-assessment passes. A falsifiable test makes a claim that can come back false: you send a request and observe whether a structured answer arrives from an accountable party. It does not depend on anyone’s adjective, which is why it survives a marketing department that a scorecard does not.

Can I run the agent-washing test without the vendor’s help? Yes. Fetch the site and look for a declared interface for readable. Send a structured question to any advertised endpoint and see whether a structured answer returns for addressable. Search for the agent outside its own page for networked. Check whether the reply names who it represents and offers a route to a human for accountable. None of these steps needs vendor cooperation or special access.

Does an addressable endpoint prove an agent is trustworthy? No. Being reachable is easy to fake. DataDome reported in March 2026 that roughly 80 percent of AI agents do not identify themselves properly, often with spoofable user-agent strings. So a response alone proves only that something answered, not that an accountable party stands behind it. That is why the networked and accountable checks matter: a stable, discoverable identity tied to a named operator is what “something answered” cannot fake.