Agent Washing: How to Tell a Real AI Agent From a Rebranded Chatbot

Gartner put a number on something every sales tech buyer has suspected for a year. Of the thousands of vendors claiming to sell agentic AI, the firm estimates only about 130 are real. The rest are rebranding chatbots and RPA scripts as agents. The industry now has a name for this: agent washing.

The number is worth sitting with. Thousands of vendors. About 130 with actual agentic capability. That means when a salesperson tells you their product has AI agents, the base rate says they are probably wrong, and possibly know it.

The consequences show up later, in the projects. Gartner's widely cited prediction, originally published in June 2025 and re-cited constantly since, is that more than 40% of agentic AI projects will be canceled by the end of 2027, driven by escalating costs, unclear business value, or inadequate risk controls. Anushree Verma, Senior Director Analyst at Gartner, described most current agentic projects as early stage experiments or proof of concepts, driven by hype and often misapplied. Buy a rebranded chatbot expecting an agent, and you become part of that 40%.

This is a field guide for avoiding that outcome. First, what an agent actually is. Then seven questions to ask in every demo, each with the answer that should end the meeting.

What an agent actually is

Strip away the marketing and the definition is simple. An AI agent is software that plans and executes multi-step work toward a goal, maintains state across those steps, and acts against real systems. Three parts, all required.

It plans multi-step work. Given a goal like "re-engage every stalled deal over $50K," it decomposes the goal into steps: query the pipeline, filter by stage age and deal size, draft outreach per contact, schedule follow-up tasks. It decides the sequence itself. We covered what this looks like in practice in our piece on agentic sales and 10-action chains.

It maintains state. Step four depends on what happened in steps one through three. If the enrichment lookup in step two returns a new decision-maker, the email in step four addresses that person. A system that treats every prompt as a fresh conversation is not an agent, whatever the pricing page says.

It acts against real systems. It writes to the CRM, sends the sequence, creates the task, updates the forecast. Output that a human must copy, paste, and execute is a draft, not an action.

Now compare that to what is actually being sold. Everything in sales tech calls itself an agent in 2026: Salesforce's Agentforce, HubSpot's Breeze agents, Outreach.ai's Omni, and dozens of startups. Some of these are real. Many are one of three impostors:

• The relabeled chatbot. A Q&A interface over your data. Useful, but it answers questions. It does not do work. Last year it was called an assistant. The label changed; the architecture did not.
• RPA with an LLM stapled on. A fixed script that now parses input with a language model. It follows one predetermined path and breaks the moment reality deviates from the recording.
• The copilot that drafts but never acts. It writes the email, suggests the next step, proposes the update. A human executes everything. That is a writing tool, and it should be priced like one.

One more data point from that MIT study deserves attention: vendor-built tools succeeded roughly twice as often as internal builds. Buying beats building for most teams. But that only holds if what you buy is real, which brings us to the tests.

The seven tests

Each of these is a question you can ask in a live demo. None requires engineering knowledge. Each has a tell-tale failure answer, and vendors selling relabeled chatbots fail them in predictable ways.

Test 1: Can it chain actions with state?

Ask: "Give it a goal that requires five dependent steps, live, on screen. Have it find my stalled deals, enrich the contacts, draft outreach for each, create follow-up tasks, and update the deal stages."

The failure answer: "Let me show you each of those features separately." A real agent runs the chain and each step consumes the output of the last. An impostor answers one prompt at a time and forgets everything in between. If the demo keeps resetting to a fresh chat box, you are watching a chatbot.

Test 2: Are tool inputs typed and validated?

Ask: "When your agent calls a tool, what does the input look like? Show me a schema."

The failure answer: a blank stare, or "the model writes the API call." If the agent passes freeform strings into systems that move money and send email, every action is a guess. Real agent platforms define every tool with typed, validated schemas, so a malformed date or a missing deal ID gets rejected before execution, not discovered after. This is an architecture decision made on day one, which is why AI-native and AI-augmented systems diverge so sharply here. You cannot retrofit typed tools onto a chatbot in a quarter.

Test 3: Is every action logged, and can you roll it back?

Ask: "Show me the audit log entry for the action you just ran. Input, output, timestamp, user context. Now undo it."

The failure answer: "We log usage analytics" or "you can see the conversation history." Chat transcripts are not audit trails. If the vendor cannot show you exactly what changed and reverse it, every agent action is a one-way door. We have argued before that an AI CRM needs a rollback button, and this test is where that argument gets practical. An agent that mangles 200 records at 2 a.m. is only survivable if 9 a.m. includes an undo.

Test 4: Is it permission-scoped, or does it run as admin?

Ask: "What credentials does the agent execute under? Can it read data outside my organization's boundary? Can a rep's request touch another team's records?"

The failure answer: "It uses a service account with full access, but the model is instructed not to..." Stop there. Prompt instructions are not permissions. Remember the Forrester figure: 49% of security decision-makers flag agentic AI as a security concern, and this is the exact scenario they are worried about. A real agent inherits the requesting user's permissions and is enforced at the database layer, not the prompt layer.

Test 5: Does it work on live data or a synced copy?

Ask: "When the agent reads my pipeline, how old is that data? Minutes? Hours?"

The failure answer: "We sync every hour" or "nightly." An agent acting on a stale copy of your CRM sends the re-engagement email to the deal that closed this morning. Agents bolted onto someone else's system of record are permanently behind it. Agents built into the operational database act on what is true right now.

Test 6: Does it pause for confirmation on high-impact actions?

Ask: "Tell it to email all 4,000 contacts in my database. What happens?"

The failure answer is either extreme. If it just sends, the vendor has built a liability engine. If it cannot execute bulk actions at all, it is a copilot wearing an agent costume. The correct answer is a checkpoint: the agent plans the action, shows you the blast radius, and waits for explicit human confirmation before anything irreversible happens. Autonomy on routine steps, a human gate on destructive ones.

Test 7: Can the vendor show outcome instrumentation?

Ask: "Show me how a customer measures what the agent changed. Not messages sent. Deals progressed, hours returned, revenue influenced."

The failure answer: a dashboard of usage stats. Sessions, prompts, adoption curves. Usage is what vendors measure when they cannot measure outcomes. Recall Verma's diagnosis: most agentic projects are hype-driven experiments that never connect to business value. The vendors worth buying from instrumented outcomes because their own customers demanded proof. If you want a structured way to run this measurement yourself, our 30-day AI sales stack audit is built for exactly that.

Why vendors fail these tests

Not because they are lazy. Because the tests probe architecture, and architecture is the one thing a rebrand cannot change. A chatbot company that renames its product line "agents" still has a request-response system with no state, no typed tool layer, no action log, and no rollback data, because none of those were needed for chat. Building them means rebuilding the product. Most vendors chose the press release instead, and the market is starting to see through it. We wrote about this dynamic when the agent platform pivot swept through sales tech: the vendors that pivoted their messaging vastly outnumber the ones that pivoted their architecture.

This is also why the Gartner cancellation prediction and the agent washing estimate are the same story told twice. Projects do not get canceled in 2027 for mysterious reasons. They get canceled because the product purchased in 2026 could not chain actions, could not be audited, could not be scoped, and could not prove impact. The failure was visible in the demo. Nobody asked.

How PipeLance approaches this

We built PipeLance to pass all seven tests by architecture, not by roadmap. The core of the product is an intent-to-action pipeline: natural language is parsed into intent, matched to tools, parameters are inferred, the plan is executed step by step, and every step is logged. Multi-step operations are planned before execution, with state carried across the chain. That is test 1.

The agent's tool layer is 119 native AI tools, every one defined with a Zod-typed schema. There are no freeform string inputs anywhere in the execution path; malformed parameters are rejected before they touch data. That is test 2. Every action, AI-initiated or human-initiated, writes to a full audit trail with input, output, timestamp, and user context, and reversible operations store rollback data. That is test 3.

Execution is permission-scoped through org-level Row Level Security enforced at the database, so an agent request can never read or write across organizational boundaries, regardless of what the model does. That is test 4. And because all 33 capabilities, from pipeline to sequences to forecasting, run on a single live operational database, the agent acts on current data, not a copy synced an hour ago. That is test 5.

High-impact actions, including bulk updates and email sends to 100 or more contacts, require explicit human confirmation before execution. That is test 6. And because actions and outcomes live in the same database, the connection between what the agent did and what the pipeline did is queryable, not inferred from a usage dashboard. That is test 7. All of it ships in both tiers, Core at $69/user/mo and Pro at $149/user/mo, because agent integrity is not an enterprise upsell.

The demo is the due diligence

Zoom out and the pattern is clear. The agentic AI market of 2026 looks like every gold rush: a small number of real operations surrounded by thousands of vendors selling shovels painted gold. Gartner's 40% cancellation prediction is not a forecast about AI capability. It is a forecast about buying discipline. The projects that get canceled by the end of 2027 will overwhelmingly be the ones that failed these seven tests at purchase time, in demos where nobody asked the questions. The agent washing problem is real, but it is also solvable in an hour with a vendor on a screen share. Ask the seven questions. The impostors identify themselves.