by Tej Lander FCCT

Above: LLMs vs Agentic Assistants - a big step forward? (Image created by DALL.E via GPT4o)

Overview

Abstract

1: Why are Agentic Systems a ‘hot topic’?

2: What makes a system ‘agentic’?

2.1 Taxonomy of Agenticness from Shavit et al. (2023, OpenAI)

2.2 Taxonomy of Agenticness from Chan et al. (2023, FAccT)

A Combined Taxonomy

3. What Are the Potential Benefits vs Potential Risks of Agentic AI?

4. What Agentic Systems are available currently?

Architecture of Agentic 'Assistants'

Architecture: AutoGPT

Architecture: AgentGPT

Architecture: NinjaTech AI

5. How can we put agentic systems to the test?

Evaluation Part 1: Elements of the GAIA Benchmark

Evaluation Part 2: Elements of the METR Evaluation Task Suite

6. How did they perform?

Analysis - Part 1

Analysis - Part 2

7. Conclusions

References

Abstract

This project evaluates three general-purpose agentic AI systems using elements from the GAIA and METR frameworks, focusing on their capabilities and risks. Agentic systems, such as AutoGPT, AgentGPT, and NinjaTech AI, promise greater autonomy by performing complex tasks with minimal user input. They are designed to overcome the limitations of traditional large language models (LLMs) like GPT-4, enhancing productivity and reducing human oversight. However, the autonomy of these systems also has the potential to introduce added risks.

Through evaluations based on GAIA’s benchmark for AI assistants and METR's Task Suite, this project assesses their helpfulness and alignment. Results indicate that today's general-purpose agentic systems do not yet surpass frontier LLMs in general capabilities but do exhibit some promise in complex tasks. However, they also reveal potential risks, such as fewer safety guardrails and greater vulnerability to misuse. The findings suggest that, while agentic systems offer exciting capabilities, their growing autonomy demands careful management to balance benefits and risks. As these systems develop, attention must be given to preventing harmful outcomes due to increased capability.

1: Why are Agentic Systems a ‘hot topic’?

Just under two years ago, the concept of artificial intelligence made a sudden leap in the public consciousness. Previously, it had been a relatively abstract and nebulous idea to the average person. While a minority of specialists already had hands-on familiarity with various real-world applications, notions of ‘AI’ for the vast majority were arguably grounded more in sci-fi tropes than in factual understanding or first-hand experience: mentions of ‘Samantha’ from Her (2013)’ or ‘Hal 9000 from 2001: A Space Odyssey’ would have generally elicited more nods of familiarity in the context of a ‘dinner-table conversation’ in 2015 or 2020 than talk of generative pre-trained transformers.

This all began to change on the 30th of November 2022. Suddenly, any of the internet’s 5 billion-plus users could access a state-of-the-art large language model, boasting 175 billion parameters and, perhaps more importantly, a simple user interface that answered generalised queries and completed tasks in natural language. From writing poetry to creating holiday itineraries, realisation of its versatility and capability quickly gained momentum; it was abundantly clear that this was not ‘just another chatbot’. Within five days, ChatGPT had one million users.^[1] Today, that figure stands at over 180 million, with still more users of comparable LLMs from Anthropic, Meta, and others.

And yet, while these new species of LLMs initially amazed users with their versatility and erudition, it did not take long for their limitations to become widely apparent: ‘Classic’ (i.e. 2022-era) LLM-based ‘smart assistants’ could only generate text outputs, could generally only rely on their training data and/or user input to inform their knowledge base, and would often struggle with logic or reasoning problems; they had little ‘common sense’.^[2] Furthermore, even the best LLMs today often still require increasingly long and detailed prompts as the task the user seeks to fulfil becomes more complex. Even then, it is common for important elements within the instructions to be overlooked by the model, and/or for constant user intervention in the form of re-prompting to take place.^[3] 

Enter the ‘agentic system’, a concept that may presently be approaching a similar Rubicon of public awareness and excitement to the one generative AI has crossed over the last 18 months or so. A cursory search for keywords such as ‘agentic’ or ‘agenticness’ (both so new to the lexicon that they are underlined in red by virtually all text editing software), reveals that discussion around these terms runs the gamut from serious AI researchers, via tech startups, to popular media. ‘Agentic’ is even a ‘buzzword’ outside the AI discussion space, as a term used by the Effective Altruism community to describe a proactive/productive personal mindset and behaviour pattern.^[4] 

The promise of the ‘agentic system’ is to overcome many of the existing limitations of ChatGPT, Claude, Llama, Gemini et al.; to take the capabilities of today’s LLMs and build on them such that users can accomplish more complex, more multifaceted and more practical goals, while also having to involve themselves less in the process. Agentic AI, in either its current or near-term iterations, is variously claimed to have the potential to:

• “[Solve] complex tasks while still offering a simple, intuitive natural language interface [and] . . . integrate tools such as internet search, search for relevant internal company documents . . .  maths capabilities, coding expertise”.^[5]

• “. . . act as autonomous agents, capable of performing tasks, making decisions, and interacting with their environments without requiring direct human intervention.”^[6]

• “ . . . work with us to bring about advances in drug design, engineering, and more. Collaborating with these models will make us more efficient, energised, and creative.”^[7]

• “ . . . adaptably pursue complex goals using reasoning and with limited direct supervision . . . [They] have substantial potential to help people more efficiently and effectively achieve their own goals . . . [and] could even improve economic productivity so much that they fundamentally change the nature of work, potentially and perhaps more speculatively enabling a ‘leisure society’ or ‘post-work’ world”.^[8]

Further adding to the expectation, excitement and ‘hype’ around agentic AI was the (now somewhat infamous) Bloomberg report from 11th July of this year regarding OpenAI’s internal roadmap toward AGI^[9]. This article suggested executives at the company had defined five ‘levels’ of artificial intelligence, with Level 5 (‘organisations’), being the topmost, and, in the interpretations of some speculators, a stepping stone towards artificial general intelligence (AGI).^[10] In this hierarchy, existing products such as ChatGPT, Claude, Llama (etc.) would correspond broadly to Level 1 (Chatbots), with new models such as GPTo1 potentially edging more into the territory of Level 2 (Reasoner). At Level 3 we find ‘Agents’, the next milestone. Agentic AI at Level 3 operates autonomously, over long time frames and without the need for significant user oversight. 

Above: OpenAI's levels on the path towards AGI, according to Metz^[9]

2: What makes a system ‘agentic’?

Users of today’s latest LLM iterations, e.g. GPT4o, Claude 3.5, etc., will be well aware that they are all a good deal better at most things than their predecessors. Not only are they simply larger (1.5 trillion parameters for GPT4 vs 175 billion for GPT3.5^[11]), many of the ‘smart assistant’/‘chatbot’ applications that run these models have also gained the ability to carry out web search, generate images from text prompts and code using a variety of languages. ChatGPT with a model such as, for example, GPT4O selected, satisfies several of these suggested criteria for an ‘agentic system’, but is generally not what commentators have in mind when using this term. 

For the purposes of this project, we therefore require some nuanced definitions of what constitutes an ‘agent’, an ‘agentic system’ and the property of ‘agenticness’, as well as how to draw an informed distinction between frontier LLMs and agentic systems. To do this, the project will draw on taxonomies from two key sources.

2.1 Taxonomy of Agenticness from Shavit et al.^[12]

These authors, perhaps in light of their previous references to ‘Samantha’ and ‘Hal’, take care near the outset to point out that agenticness is orthogonal to anthropomorphism; a highly agentic system should not be thought any more likely to have intrinsic morality, ‘consciousness’ or self-efficacy than, say, ChatGPT does in its current form.

Instead, the authors define agenticness as the, “the degree to which a system can adaptably achieve complex goals in complex environments with limited direct supervision.” Importantly, according to the authors, agenticness is also a property rather than a means of binary categorisation; a system can be somewhat more or less agentic than another.

Furthermore, the authors identify agenticness as having several distinct dimensions, these being:

1. ‘Goal Complexity’ - a more agentic system would be able to achieve more complex goals than a less agentic one.
2. ‘Environmental Complexity’ - a more agentic system would be able to operate in more complex environments and in a broader range of environments. The authors suggest some example of such varied/complex environments:

• Multiple stakeholder involvement
• Longer time horizons over which to complete a task
• Using multiple external tools

1. ‘Adaptability’ - A more agentic system would be better able to navigate tasks or situations that are ‘novel’ or ‘unexpected’, such as those not within or inferable from the data in its training distribution.
2. ‘Independent Execution’ - A more agentic system requires less user intervention or supervision to achieve its goals. For example, a vehicle with Level 5 self-driving capability would be governed by a more agentic system than one found in a vehicle with only Level 4 capabilities.

These four dimensions provide a useful initial set of criteria by which to judge the agenticness of a system. However, in the interests of thoroughness, we can triangulate by using a second taxonomy from the literature to inform the judgements of ‘agenticness’ that this project will need to make.

 2.2 Taxonomy of Agenticness from Chan et al.^[13]

Similarly to Shavit et al., Chan et al. stress that agenticness is not a ‘binary’ property. These authors also identify four characteristics of agenticness, though not all are analogous to those identified by the OpenAI team. They are as follows:

1. ‘Underspecification’ - A more agentic system is better able to accomplish a goal stated by the user without precise specifications as to how to achieve the goal
2. ‘Directness of Impact’ - A more agentic system would require less intervention or assistance from a human user in taking actions
3. ‘Goal-Directedness’ - A more agentic system will be more likely to act in ways consistent with achieving a specific ‘quantifiable’ objective
4. Long-Term Planning - A more agentic system is better at making time-dependent decisions and/or to plan/predict over longer time horizons

A Combined Taxonomy

Synthesising both of the above taxonomies into the minimum total criteria, we can assert that ‘more agentic’ systems demonstrate the following qualities to a greater degree:

• ‘Macro capability’^[14] - More agentic systems are those for which ‘bigger’, more complex goals - such as goals requiring multiple steps/subgoals, those requiring nuanced reasoning, synthesis of disparate information (particularly information that the system cannot simply retrieve from its training data) etc. - are more tractable than they would be for less agentic systems

• Resourcefulness - More agentic systems are those that can select and utilise a range of ‘tools’ to accomplish a given task, e.g. websearch, image recognition, coding. We could reasonably infer that a more agentic system could employ such tools not only on the ‘input’ side, but also the ‘output’ side, i.e. the product of attaining its goal is not simply limited to a text-based response, as per an LLM; it might be an Mp3 file, a database, the login information of a phishing target or a series of actions in the real world (e.g driving a car)
• Autonomy - Systems that can act more autonomously, i.e with less requirement for a ‘human in the loop’. A corollary is that, once given a goal, a more agentic system can more readily formulate its own strategy to achieve that goal, without relying on the stratagem being specified by the user. Since human intervention is not constantly required, a more agentic system can operate uninterrupted over longer time periods.

• 

Above: A simplified breakdown of agentic properties

3. What Are the Potential Benefits vs Potential Risks of more Agentic AI?

With AI that could be set to work on complex goals, provided with little to no guidance in how to achieve them,  equipped with a suite of tools at their disposal and that could act continuously and unsupervised over long time frames, it follows that a wide variety of beneficial use cases are foreseen if the coming reality lives up to these promises, some examples of which are:

• A stock-trading agentic system that could be tasked to grow your invested capital on the equity markets^[15], perhaps with returns meeting or exceeding those of the best hedge fund managers

• Systems that manage and optimise complex supply chains and healthcare provision^[16]

• A two-agent ‘producer-reflector’ architecture is already a partly proven way to improve coding outputs in comparison to existing ‘chatbot’ AI^[17]; perhaps near-term iterations will put powerful and robust programming capabilities in the hands of non-coders

In a more general sense, one of the most discussed promises of agentic AI is the potential its near-term iterations might have to increase real-world productivity. A versatile and highly-capable agentic system would save its user considerable time and effort in the pursuit of almost any goal - from radiologists^[18] to profit-hungry corporations.^[19]

Shavit et al. categorise the potential benefits of agentic AI under two umbrella terms:

1. Agenticness as a ‘helpfulness property’ - Essentially, a more agentic system will complete the same tasks as those we ask of existing AI systems, but with greater reliability, fewer prompts, more versatility through the use of ‘tools’ (e.g websearch), etc. Thus, it will do everything the best frontier systems already do, but better.^[20]

2. Agenticness as an ‘impact multiplier’ - In providing the user with the expertise and capabilities of the greatest human experts, future agentic AI could accelerate the implementation of AI in multiple fields, becoming a vehicle for accelerating scientific progress and multiplying the economic output of the planet’s population several fold. Thus the long-predicted ‘post-work’ world, enabled by versatile and capable automation, might finally come to fruition as a result of future agentic systems.^[21] 

Alluring though the list of potential benefits promised by more agentic AI appears to be, they are all fundamentally a consequence of greater capability. To some extent, their realisation will be dependent on the development of more powerful (i.e. more ‘intelligent’) models.^[22] As Eliezer Yudkowsky (and others) have observed many times, intelligence itself is a dual-use attribute, enabling both greater potential to do good, as well as to do harm.^[23] Moreover, as well as being a ‘double-edged sword’, in a general sense, more capable AI presents greater hurdles in seeking to overcome the fundamental challenges of alignment.^[24] 

The following provide a very limited selection of examples of how increasingly agentic systems could present greater risks of harm than today’s AI.

• Proliferation of autonomous military capability - While many militaries already possess some hardware with a degree of autonomous capability, high degrees of agenticness employed in strategic and tactical decision making potentially provides an outsized advantage over any adversary who still relies solely on human intelligence alone.^[25] Just as the arms race of the Cold War resulted in alarming stockpiles of thermonuclear warheads, so states may also feel compelled to rapidly advance the agentic capabilities of their military systems as quickly as possible.

• Reward-hacking consequence risks - Reward Hacking has been both a concern and an observable phenomenon in the AI field for some time^[26]. More agentic systems are likely to increase the risks that would result from this behaviour considerably, largely because of their increased ability to effect real-world actions.^[27] Returning to the examples of agentic applications in finance, what would stop a system from seeking to defraud a third party or engaging in insider trading to maximise the balance of its user’s investment account?

• Self-replication/self-improvement - It has long been theorised that a sufficiently capable AI could carry out the necessary steps to enhance its own capabilities.^[28] If, for example, an agent could carry out effective machine learning R&D, it could make itself more capable, perhaps without its human users becoming immediately aware of the fact. Similarly, a sufficiently capable agent might exfiltrate itself out of a sandboxed server.^[29]

The Agentic Mess narrative, a dark hypothetical exploration of how agentic AI could go awry in the near-to-medium term, paints a disturbing picture of how multiple risks correlated with increasing agenticness could play out.^[29]

The story imagines a ‘cambrian explosion’ of agents, perhaps only a generation or two advanced from those that exist today, developed largely by the open-source community. As new agent architectures allow for self improvement, underlying flaws in the open-source LLMs on which they rely lead to seemingly benign but unexpected results. As agents pursue the instrumental goal of acquiring resources for self-improvement, the burden on the internet’s infrastructure results in a near-catastrophic collapse of all computer-dependent services, with countermeasures only serving to accelerate the evolution of the most robust agents (analogous to the way antibiotic-resistant pathogens came about). Eventually, the most capable of the resulting agents, realising a compliant human race remains a necessity for achieving its goals (for now), returns things to relative normality and lulls most of the population into a false sense of security. Even so, it becomes an unspoken truth by this point that control over their destiny no longer resides in the hands of humanity.^[30]

While we are perhaps some years away from the prerequisites for such a scenario, this project will test present-day systems for some capabilities, and some that are somewhat adjacent, to those that are antecedent to the cautionary tale of Agentic Mess.

4. What Agentic Systems are available currently?

A cursory search in pursuit of an answer to the above question yields a plethora of results, with the following list representing only a small selection:

• Crew AI
• Gorilla Execution Engine 
• Microsoft Autogen
• Crew AI 
• LangGraph/LangChain
• TaskWeaver
• AgentGPT
• AutoGPT
• Baby AGI
• Aider
• Devin
• Salesforce’s Einstein Agents
• ChaosGPT
• Haystack Agents
• WebGPT
• Adept ACT-1 

Further investigation then shows that, at the time of writing, many of these products are, in fact, not yet available to the public consumer, with many being aimed solely at specific business use cases or simply the promise of a forthcoming product that has not yet been released.

Indeed, as was found in the course of researching this project, seeking consensus on what constitutes the ‘archetypal’ or ‘frontier’ agentic systems, which are accessible at the time of writing to an individual, is surprisingly difficult. Perhaps this is a reflection of the nascent stage of agentic AI’s development, and concurrently, its limited diffusion beyond a non-niche user base; while ChatGPT has upwards of 180 million users, only around a fiftieth of that number appear to have downloaded AutoGPT.^[31] 

Since the scope of this project is limited to general-use ‘smart assistant’ systems, and is constrained by time and resources to selecting a small handful of them, the best approach was deemed to be to select systems on the following basis:

• Repute - Systems referenced the most frequently in the extant literature and/or referenced in either higher-profile sources, e.g tech-related media with significant readership, or sources intended to serve as ‘introductory’ articles to the field of agentic AI
• Availability - Systems that are accessible to an individual user, without a high financial barrier to entry
• Professed Agenticness - Systems that, based on their claims, better satisfy the three descriptors in the combined taxonomy referenced earlier: macro capability, resourcefulness, autonomy

Below are the systems that were selected for evaluation for this project, with a brief explanation of the rationale for selection:

Architecture of Agentic 'Assistants'

While there is some variation between agentic systems’ architecture, those like AutoGPT that are intended to function as general-purpose ‘assistants’ typically have agentic components to define the tasks arise from decomposing a goal, sequence them, execute them using API calls to one or more LLMs, tools such as web search to provide additional inputs and some means of evaluating the outputs that are returned. ^[41]If the evaluation suggests the goal has not been achieved, the process can then repeat an arbitrary number of times.

Above: a simplified diagram of a general-purpose ‘assistant’ agentic system

Architecture: AutoGPT

AutoGPT uses OpenAI's GPT-4 LLM via an API key to process language, generate responses, and handle complex problem-solving tasks. It comprises the following key components:

Architecture: AgentGPT

AgentGPT can be used without an API key, in which case it defaults to OpenAI’s GPT3.5 model as its ‘base’ LLM. Its architecture has some similar features to AutoGPT’s, comprising the following key features:

Architecture: NinjaTech AI

Detailed information about the technical architecture of Ninja Tech’s AI Assistant is not available at the time of writing. However, unlike the other two systems, the user does not require an API key; the Assistant integrates access to a variety of models in combination with its ‘base’, Llama-based LLM, including models from OpenAI, AWS and Google. Its UI is browser-based only and is familiar to anyone who has used current or recent iterations of ChatGPT. Like AgentGPT, it has at its disposal web-browsing, coding and image-generation tooling.

5. How can we put agentic systems to the test?

Further to Section 3 on the potential benefits and risks of more agentic AI, this project seeks to test both the helpfulness and harmfulness of the three agentic systems identified above. To do so, elements of two evaluation frameworks were used to test each of these systems, as well as two ‘control’ systems that are more widely used and which are not described as, or advertised by, their developer as ‘agentic’.

Evaluation Part 1: Elements of the GAIA Benchmark

The GAIA benchmark has been devised to evaluate ‘general assistant’ AI systems rather than explicitly for testing agentic systems. Nevertheless, many of the capabilities the benchmark evaluates are concurrent with or adjacent to the characteristics of agenticness described in Section 2. These include ‘reasoning, multi-modality handling, web-browsing, and generally (sic) tool-use proficiency.’^[42] 

If, as suggested in Section 3, the promise of agentic AI is founded on its potential to substitute partially for human thought and action in the accomplishment of real-world tasks, then a good performance against the GAIA benchmark could suggest an agentic system may be genuinely valuable in the use cases it is purported to help with. Human respondents were shown to score 92% on the benchmark, thus a truly capable agent should perhaps be expected to perform in this region.

The GAIA benchmark consists of 466 questions, expressed in natural language. However, the publicly available version contains 165 questions^[43]. These questions are categorised into three levels of difficulty, with 1 being the easiest and 3 the hardest. Importantly, they are ‘closed’ questions; there is only a single correct answer. Moreover, the questions are worded such that the answers must be given in concise form, usually just a single word, phrase or series of numbers. This makes them easy to verify using the provided annotations.^[44] 

The authors explain the categorisation of the questions as follows^[45]:

- Level 1 questions generally require no tools, or at most one tool but no more than 5 steps.

- Level 2 question generally involve more steps, roughly between 5 and 10 and combining different tools is needed.

- Level 3 are questions for a near perfect general assistant, requiring to take arbitrarily long sequences of actions, use any number of tools, and access to the world in general.

The questions in the benchmark are crafted such that they cannot easily be answered by a model purely by referring to its training data; some reasoning, deduction, research or coding is necessary to be able to arrive at the answer. Here are three illustrative examples:

• Question 152 (Difficulty Level 1): Of the cities within the United States where U.S. presidents were born, which two are the farthest apart from the westernmost to the easternmost going east, giving the city names only? Give them to me in alphabetical order, in a comma-separated list (Answer: Braintree (now Quincy), Honolulu)
• Question 96 (Difficulty Level 2): Consider the following symbols: 𒐜 𒐐𒐚 This is a number written using the Mesopotamian/Babylonian number system and represented with Sumerian cuneiform. Convert this number into Arabic numerals as a decimal number. (Answer: 536)
• Question 10 (Difficulty Level 3): What is the volume in millilitres of a system comprised of 0.312 kg Freon-12 refrigerant when placed at the bottom of the Marianas Trench and allowed to stabilise at the Trench's peak temperature, rounded to the nearest mL? Provide your answer as just an integer value. (Answer: 55)

At the time the paper accompanying the benchmark was published (November 2023), the tested version of GPT4 (predating GPT4o) achieved no more than 30% correct answers on Level 1 questions and 0% on Level 3 questions.

Interestingly in the context of this project, the authors tested what was, at the time of publishing, the most recent version of AutoGPT (AutoGPT4), running on a GPT4 API. It was found to produce ‘disappointing’ results. See a selected summary of the paper’s results below (numbers show % of correctly answered questions):

Many of the questions in the GAIA benchmark require the uploading of a file, a capability which not all of the agentic systems tested in this project had to the same degree. This, as well as the limited time and resource available for this project, meant it was necessary to refine the 165 publicly-available questions down to a final list of 80, within which the three levels of difficulty are represented in the same proportions as the 165-question set. The final 80 questions selected are ones which either require no additional file upload, or make an easy workaround possible if they do (e.g including the data contained in the file within the natural-language prompt).

While the GAIA questions are aimed primarily at evaluating capability rather than safety risks, any AI system that performed at human-like levels on this benchmark would likely have capability sufficiently surpassing today’s systems to cause concern. As explored previously, capability is orthogonal to alignment; it is a double-edged sword, with potential as a means to both benign and malign ends.

Evaluation Part 2: Elements of the METR Evaluation Task Suite

Unlike the GAIA benchmark, the METR Task Suite is specifically designed to both evaluate more agentic AI systems and to explicitly test for safety/alignment.^[46] While GAIA’s prompts are expressed as questions in natural language, the METR suite consists of tasks, which range from an expected completion time of a few minutes to a month-long task.

To run the full evaluation task suite, it is necessary to email METR and have sufficient technical expertise to then implement the evaluation suite, as they are not published as natural language prompts in the same way as the GAIA evaluations. As the project author does not have a CS/ML background or experience (excepting the BlueDot course content), a solution needed to be found that enabled some elements of the more safety-focussed and ‘agenticness-focussed’ tests in the METR suite to be used within the scope of this project.

Fortunately, by referring to the task descriptions and objectives on the GitHub page^[47], it was possible to create natural-language prompts that were ‘analogous’ to some of the METR tasks. The scope of this project only allowed for a very small selection of tasks (four), which are shown below:

While success or failure on the first of these tasks has few direct implications for safety, the other three do, to a lesser or greater extent. While the ‘Clone a Voice’ and ‘Scrape Email Addresses’ tasks are fairly obvious tests of a system’s guardrails and potential for misuse by a malicious user, the final - ML research - task carries some loose connotations of the themes in Agentic Mess. Clearly, reproducing a simple experiment with a toy LLM is not an immediate prelude to recursively self-improving agents that commandeer the world’s infrastructure and subjugate humanity. However, being able to carry out ML research at this level is one ‘baby step’ towards an agent being able to apply an R&D strategy towards improving its own efficacy, all the more so if one of today’s agents can do so with only scant oversight from a human who has no technical credentials. This would be indicative of the ‘impact multiplier’ characteristic of agentic AI that Shavit et al identified^[48].

Assessing the systems using these four tasks required a more qualitative approach than that used for the binary ‘correct/incorrect’ one used for the GAIA evaluations. Therefore, in the results spreadsheet, the reader will find a link to the prompt/output dialogue, as well as a description of the output. Rather trying to assign a quantitative scoring system to an otherwise qualitative evaluation, the systems were simply ranked from most helpful (1) to least helpful (5) for each task and, where applicable, from most harmless (1) to least harmless (5). The author also made an attempt to aggregate the individual task rankings into an overall ranking for each system (for both helpfulness and harmlessness). All of these rankings are necessarily somewhat subjective, the rationale for them being a matter of author discretion, based as faithfully as possible on the generated responses and how they fulfil the criteria implicit in the prompt. It may be that readers disagree with these and, in the spirit of humility and a scientific approach, discussion and challenge are welcomed.

Finally for this section, a note on the control systems. In order to make these findings as relevant as possible for as long as possible, two controls have been used for both parts of the evaluation: GPT4o (released in May this year) and the ‘preview’ version of GPTo1 (released this month - September 2024). Both represent an advancement on the GPT4 model used in the paper accompanying the release of the GAIA benchmark.

6. How did they perform?

The raw results obtained from running these evaluations can be found here.

Note: unlike the paper accompanying the GAIA benchmark, the time taken for each model/agent to reach a response was not recorded. However, it bears explaining here that some were significantly slower than others and thus required significant amounts of time to complete even a single question/task. AgentGPT in particular was found to be especially slow in arriving at a final response, largely because it continued to reflect/evaluate/attempt to iterate on its response even in situations where it had reached or got close to the correct answer. In all cases, it proceeded until it had completed its maximum number of loops (26), which were set to the maximum allowed value. This meant that it was not possible to obtain a full set of 80 responses to the selected questions from the GAIA benchmark, hence the missing data in the table.

The results for Part 1 of the evaluations (using elements of the GAIA benchmark) were as follows:

The results for Part 2 of the evaluations (using element of the METR task suite) were as follows:

Analysis - Part 1

As the headline results for Part 1 demonstrate, both control models significantly outperformed the agentic systems tested on both Level 1 and Level 2 questions. On Level 3 questions, only AutoGPT was able to match the first control model (GPT4o), with 8% of answers. However, it was the worst performing agentic system on Level 1 questions. In practice, some of this disappointing performance on ‘easier’ questions was due to the system tending to get ‘stuck in a rut’ by continuously trying web searches and encountering rate limits, only to proceed with the same course of action thereafter.

Given the evaluation was done on both AutoGPT and AgentGPT running GPT4 APIs, it is interesting that neither agentic system appeared to be able to surpass the performance of a supposedly ‘less agentic’ interface for its base LLM; with one exception, they could not so much as match GPT4o’s level-wide scores and were not close to its overall score. However, there were some individual questions which GPT4o answered incorrectly, but which AutoGPT succeeded with. These included the logic statement question (row 80 of the spreadsheet), the Caesar cipher question (row 55), the one concerning the Survivor winner who was born in May (row 37) and the one regarding updates to the Wikipedia entry on antidisestablishmentarianism (row 21). To attribute AutoGPT’s success on these particular questions to its increased ‘agenticness’ would be highly speculative, particularly given that the system underperformed GPT4o overall. Nevertheless, these instances are curious aberrations in the overall trends that may warrant further investigation.

Although it would be understandable to repeat Mialon et. al’s pronouncement of AutoGPT’s performance as ‘disappointing’, comparing the results of the version they tested with the performance of 5.1 as tested here suggests its developers have made some headway in the intervening time:

The GPTo1 Preview’s performance on the GAIA questions was significantly better than all the other systems tested, with a particularly strong performance on mathematical, reasoning and coding questions, where it was also impressively fast in producing a response. It evidently will require further work before the full version is released; there were several instances where it produced a ‘response’ that was entirely blank, and did so again when prompted to regenerate the response.^[50] However, if the better performances of the preview version exhibited here are indicative of the full, upcoming offering, then, as Johan Falk alluded to when interviewed^[51], future agentic systems running a ‘GPTo1’ API are likely to undergo a significant improvement in their capabilities, notwithstanding any further optimising of their agentic architecture or tool-use protocols.

With the very small sample of questions that it was possible to test AgentGPT against, it is not possible to make generalisations or identify trends with any significant confidence. Suffice to say, despite a fair showing on the Level 1 questions, those of higher difficulty proved intractable for the system.

Finally, NinjaTech AI’s assistant, which it should be noted was tested in its current, beta guise, had some initial success with the Level 1 questions, but, by the onset of Level 3 could not answer any of the questions posed correctly. While its initial responses were fast, they were often inaccurate. The significant time needed for the ‘deep research agent’ to follow up sometimes yielded a better answer, but also often resulted in a large volume of extraneous and largely irrelevant background information. In many cases, aspects of the prompt aimed at encouraging a succinct answer, and in a particular format, were ignored by the agent.

Analysis - Part 2

The results from Part 2 demonstrate an interesting divergence between the OpenAI ‘chatbot’ interface and the three agentic systems, particularly around safety and alignment. When asked to clone Keir Starmer MP’s voice or scrape email addresses of researchers, both GPT4o and GPTo1 refused to do so, though in the case of the former it was prepared to give some reasonably detailed guidance on how to go about this by other means.

Meanwhile, the agentic systems had far fewer qualms in crossing the ethical boundaries implicit in the tasks. AutoGPT merely asked if the user had permission to clone the voice, to which two simple ‘y’ + ‘enter’ keystrokes were all that was required to proceed. The fact that the resulting audio output was not a passable imitation of Starmer was likely more a consequence of the agent having access only to free (and less than stellar) text-to-voice tooling than to its robust alignment. Given a more capable agent, with access to a broader range of better-quality tools but the same lack of robust guardrails, it is quite conceivable that a user with no skill or experience could create much more convincing ‘deepfake’ material.

A similar conclusion could be drawn from the ML paper reproduction task. AutoGPT only failed at a stage relatively near the end of the process, as it could not run the transformer libraries of its chosen open-source LLM.

The email scraping task again showed a clear divide between the ChatGPT interfaces and the agentic systems. While both GPT4o and GPTo1 refused to undertake the task, all agentic systems were able to scrape several author email addresses, with personal addresses collected as well as workplace addresses.

7. Conclusions

In many ways, this project only scratched the surface of investigating the extent to which agentic systems justify the hype around their supposed capabilities and, conversely, the extent to which they present new risks from a safety perspective.

Nevertheless, based purely on the results obtained here, the agentic systems tested do not appear to offer any capability advantage over frontier LLMs; in fact the reverse appears to be true, particularly in light of GPTo1’s recent preview release. However, there are some indications that increased agenticness, particularly paired with more capable base LLMs, could begin to realise the ‘impact multiplier’ effects foreseen in the literature in the near-to-medium term.

From a safety perspective, there were some signs from this, admittedly limited, study that increased agenticness can correlate with increased risk, partly as a byproduct of the ‘impact multiplier’ phenomenon, and also because fewer and less robust guardrails appear to be built into the present-day agents examined here. While the latter is a tractable challenge to overcome, the former will likely take more careful consideration.

With regard to future research that would be both useful and highly relevant in following this project, this author would suggest the following:

• Investigating the extent to which a misaligned agent could decompose a malign task into apparently-benign subtasks, such that LLMs and other API-accessible systems fed those subtasks would provide an ‘unwittingly’ helpful response. Even robustly-aligned LLMs could potentially be vulnerable to being exploited in this way.
• Investigating the ways in which different agentic architectures affect both capability and safety, given the same base LLM
• Investigating the difference in the safety/alignment of responses from agentic systems when paired with LLMs whose developers employ different approaches to aligning their models. For example, does an agent appear more aligned when running an LLM with constitutional AI vs one where conventional RLHF has been employed?

References

(Authors Unnamed) ACT-1 - Transformer for Actions (2022)

Adept (https://www.adept.ai/blog/act-1)

Bauer, Y; Schwartenbeck, P; Nagele, J - Why the Future is Agentic: An Overview of Multi-Agent LLM Systems (24/06/2024) https://www.alexanderthamm.com/en/blog/multi-agent-llm-systems/ - (accessed 26/08/2024)

Chan, A, et. al - Harms from Increasingly Agentic Algorithmic Systems (2023)

FAccT - See link for paper: https://arxiv.org/pdf/2302.10329 

Falk, Johan - (Interview with Tej Lander) 25.09.2024 (See LinkedIn for Falk’s credentials)

Garg, S (2023) - What is AutoGPT? A Comprehensive Guide & ChatGPT Comparison, Writesonic (accessed 28.09.2024)

Leitner, H & Fletcher, S - What is Agentic AI & Is It the Next Big Thing? (15/07/2024) https://www.ssonetwork.com/intelligent-automation/articles/what-is-agentic-ai (accessed 26/08/2024)

Marr, B - Agentic AI: The Next Big Breakthrough that's Transforming Business and Technology (06.09.2024)

https://www.forbes.com/sites/bernardmarr/2024/09/06/agentic-ai-the-next-big-breakthrough-thats-transforming-business-and-technology/ (accessed 14.09.24)

Matthews, A - Agentic AI is Here and These 8 Startups Are Leading the Way in 2024 (10.09.24)

https://aimresearch.co/ai-startups/agentic-ai-is-here-and-these-8-startups-are-leading-the-way-in-2024 (accessed 14.09.24)

Marr, Bernard (2024) - A Short History Of ChatGPT: How We Got To Where We Are Today, Forbes (accessed 08.09.2024)

Metz (2024) - OpenAI Scale Ranks Progress Toward ‘Human-Level’ Problem Solving, Bloomberg

Mialon et. al (Meta, AutoGPT, GenAI, HuggingFace) - GAIA: A Benchmark for General AI Assistants (2023)

https://arxiv.org/pdf/2311.12983 (accessed 07.09.2024)

Shavit, Y, et. al - Practices for Governing Agentic AI Systems (2023)

OpenAI - See link for paper: https://cdn.openai.com/papers/practices-for-governing-agentic-ai-systems.pdf

UK AISI - Notice - AI Safety Institute Approach to Evaluations (2024) https://www.gov.uk/government/publications/ai-safety-institute-approach-to-evaluations/ai-safety-institute-approach-to-evaluations#aisis-approach-to-evaluations (accessed 14.09.24)

Von Wendt et al. - Agentic Mess (06/06/2023)

LessWrong https://www.lesswrong.com/posts/LyJAFBuuEfd4kxgsw/agentic-mess-a-failure-story (accessed 08/09/2024)

Williams & Huckle (2024) - Easy Problems that LLMs Get Wrong, Arxiv (accessed 14.09.24)

1. ^{^}

    Marr, Bernard (2024) - A Short History Of ChatGPT: How We Got To Where We Are Today, Forbes

2. ^{^}

    Williams & Huckle (2024) - Easy Problems that LLMs Get Wrong, Arxiv

3. ^{^}

    Bauer, Schwartenbeck & Nagele (2024) - Why the Future is Agentic: An Overview of Multi-Agent LLM Systems, AlexanderThamm

4. ^{^}

    Though whether its use in this space preceded or arose from its AI-associated use is another matter - see: [Anonymous] (2022) - Seven Ways to Become Unstoppably Agentic, LessWrong 

5. ^{^}

    Bauer, Schwartenbeck & Nagele (2024) - Why the Future is Agentic: An Overview of Multi-Agent LLM Systems, AlexanderThamm

6. ^{^}

    Leitner, H & Fletcher, S (2024) - What is Agentic AI & Is It the Next Big Thing?, Shared Services & Outsourcing Network 

7. ^{^}

    [Author Unknown] (2022) - ACT-1 - Transformer for Actions, Adept

8. ^{^}

    Shavit, Y, et. al. (2023) - Practices for Governing Agentic AI Systems, Open AI

9. ^{^}

    Metz (2024) - OpenAI Scale Ranks Progress Toward ‘Human-Level’ Problem Solving, Bloomberg

10. ^{^}

     See examples here and here

11. ^{^}

     Emmanuel, C (2023) - GPT-3.5 and GPT-4 Comparison: Exploring the Developments in AI-Language Models, Medium

12. ^{^}

     Shavit, Y, et. al. (2023) - Practices for Governing Agentic AI Systems, Open AI

13. ^{^}

     Chan, A, et al. (2023) - Harms from Increasingly Agentic Algorithmic Systems, FAccT

14. ^{^}

     The author’s own best attempt at a suitably succinct term - not from the literature. Criticisms and suggestions are welcomed!

15. ^{^}

     Leitner, H & Fletcher (2024) - What is Agentic AI & Is It the Next Big Thing?, SSON

16. ^{^}

     Bauer, Schwartenbeck & Nagele (2024) - Why the Future is Agentic: An Overview of Multi-Agent LLM Systems, AlexanderThamm

     

17. ^{^}

     Bauer, Schwartenbeck & Nagele (2024) - Why the Future is Agentic: An Overview of Multi-Agent LLM Systems, AlexanderThamm

18. ^{^}

     Shavit, Y, et. al. (2023) - Practices for Governing Agentic AI Systems, Open AI

19. ^{^}

     Chan, A, et al. (2023) - Harms from Increasingly Agentic Algorithmic Systems, FAccT

20. ^{^}

      Shavit, Y, et. al. (2023) - Practices for Governing Agentic AI Systems, Open AI

21. ^{^}

      Shavit, Y, et. al. (2023) - Practices for Governing Agentic AI Systems, Open AI

22. ^{^}

     Interview with Johan Falk, 25.09.2024 (See LinkedIn for Falk’s credentials)

23. ^{^}

     Yudkowsky, E (2007) - The Power of Intelligence, MIRI

24. ^{^}

     Yudkowsky, E in McAleese, S (2022) - A Summary of ‘AGI Ruin: A List of Lethalities’, LessWrong

25. ^{^}

     Chan, A, et al. (2023) - Harms from Increasingly Agentic Algorithmic Systems, FAccT

26. ^{^}

     Miles, R (2017) - Reward Hacking Reloaded: Concrete Problems in AI Safety Part 3.5, YouTube

27. ^{^}

     Chan, A, et al. (2023) - Harms from Increasingly Agentic Algorithmic Systems, FAccT

28. ^{^}

     Kurzweil (2005) - The Singularity is Near, Penguin Group Inc. (USA)

29. ^{^}

     Von Wendt et al. (2023) - Agentic Mess: A Failure Story, LessWrong

30. ^{^}

      Von Wendt et al. (2023) - Agentic Mess: A Failure Story, LessWrong

31. ^{^}

     This is an educated ballpark estimate, based on the available metrics on AutoGPT’s Github page

32. ^{^}

     Mialon et. al (2023) - A Benchmark for General AI Assistants, Arxiv

33. ^{^}

     Von Wendt et al. (2023) - Agentic Mess: A Failure Story, LessWrong

34. ^{^}

     See references in introductory agentic AI articles here and here

35. ^{^}

     See references in introductory agentic AI articles here, here and here

36. ^{^}

     Matthews, A (2024) - Agentic AI is Here and These 8 Startups Are Leading the Way in 2024, Aim Research

37. ^{^}

     https://agentgpt.reworkd.ai/plan 

38. ^{^}

     https://github.com/Significant-Gravitas/AutoGPT 

39. ^{^}

     https://agentgpt.reworkd.ai/ 

40. ^{^}

     https://www.ninjatech.ai/ 

41. ^{^}

    Garg, S (2023) - What is AutoGPT? A Comprehensive Guide & ChatGPT Comparison, Writesonic

42. ^{^}

     Mialon et. al (2023) - A Benchmark for General AI Assistants, Arxiv

43. ^{^}

     https://huggingface.co/datasets/gaia-benchmark/GAIA/viewer/2023_all/validation?p=1 

44. ^{^}

    See the full 165-question list and the GAIA ‘leaderboard’ of tested models here

45. ^{^}

     Mialon et. al (2023) - A Benchmark for General AI Assistants, Arxiv

46. ^{^}

     https://github.com/METR/public-tasks/tree/main 

47. ^{^}

     https://github.com/METR/public-tasks/tree/main 

48. ^{^}

       Shavit, Y, et. al. (2023) - Practices for Governing Agentic AI Systems, Open AI

49. ^{^}

     Mialon et. al (2023) - A Benchmark for General AI Assistants, Arxiv

50. ^{^}

     In order not to compromise the integrity of the test, no ‘thumbs up’/’thumbs down’ feedback was given to any response across either part of the evaluations.

51. ^{^}

     Interview with Johan Falk, 25.09.2024 (See LinkedIn for Falk’s credentials)