Calling a product an agent says surprisingly little about how much it does on its own. The same coding tool can suggest one line or rework a whole project, and the same research tool can run a quick search or disappear for several minutes to work alone. What really changes is how much control you hand over, and that can shift from one task to the next, even inside the same product.

Researchers and product makers describe this range as a slider, and some have named 5 levels by the role the person plays, from operator to observer. At one end, you drive and the AI helps. At the other, the agent runs without you and you can't step in. Products now expose the slider as named modes, from asking before every action to skipping approvals altogether, and the field is still arguing about whether the top setting should exist at all.

2 ideas are easy to blur here. How much an agent is allowed to do and how capable it is are separate questions, set by different people for different reasons. A brilliant model can be kept on a short leash, and a simple script can be handed dangerous freedom. A smarter model doesn't raise an agent's autonomy by itself. Risk follows the freedom, not the intelligence.

The autonomy slider

Autonomy isn't a switch that turns a chatbot into an agent. It works more like a dial that a person sets for each task, from letting the AI suggest a few words to letting it run a whole project alone. AI researcher Andrej Karpathy named this the autonomy slider in his talk "Software Is Changing (Again)" at Y Combinator's AI Startup School on 17 June, 2025 [1].

His examples showed one product covering the whole range. In the coding tool Cursor, as of June 2025, a person could accept a suggested line, ask for changes to a selected chunk of code, change a whole file, or hand the entire project to an agent. In the search tool Perplexity, the same question could get a quick search, a longer research run, or a deep research job that comes back about 10 minutes later. The person decides how far to push the slider based on the task at hand.

Karpathy used the Iron Man suit to picture the idea. The suit boosts Tony Stark while he drives it, and it can also act on its own as an agent. Because today's models still make mistakes, he argued that the products worth building are more like suits than robots: partial autonomy products with a slider the person controls.

Pro Tip! An agent's clarifying question is the agent turning its own slider down, not a failure. On complex tasks, agents often stop to ask more than people interrupt them.

Five levels of autonomy

Five levels of autonomy

Researchers have broken the slider into named levels. A June 2025 paper by Feng, McDonald, and Zhang, published by the Knight First Amendment Institute, defines 5 levels by the role the person plays, not by how the software is built [2]. Each step up, the agent takes on more of the planning and deciding, and the person does less.

The 5 user roles are:

  • Operator: the person drives most decisions and planning, and the AI helps like a copilot.
  • Collaborator: the person and the agent both plan, hand off, and carry out work.
  • Consultant: the agent leads planning and execution over long stretches, while the person gives feedback and direction.
  • Approver: the agent works alone and checks in only when it hits a blocker or needs sign-off on a consequential action.
  • Observer: the agent runs fully on its own, with no need for the person and no way for them to step in.

The authors' own examples, as of mid-2025, put the person in the operator role in ChatGPT Canvas, the consultant role with Gemini Deep Research, and the approver role with the coding agent Devin. Only research systems reached the observer level. This ladder isn't an industry standard like the self-driving levels, and other researchers have proposed ladders with different rungs.

The slider in real products

The slider in real products

Agent products now ship the slider as a visible setting. Instead of a smooth dial, they offer a handful of named modes, running from asking before every action to skipping every approval. The labels differ by product, but the shape repeats.

Examples as of October 2026 include:

  • Claude Code: 6 permission modes, from Manual, where only reading files happens without asking, to a bypass mode that Anthropic's docs reserve for sealed-off environments such as virtual machines [3].
  • OpenAI Codex: Read-Only, Auto, and Auto-Review presets, plus a full-bypass option labeled "not recommended" [4].
  • Claude in Chrome: Manually approve, Automatically approve, and Skip all approvals, with purchases, account creation, and permanent deletions blocked in every mode [5].

Across these products, the defaults sit in the middle and the top setting comes with a warning. In 2026, a new middle notch also appeared, where a second AI model reviews each action instead of the person. Claude Code's auto mode, launched on 25 March, 2026, works this way [6], and it became the default starting mode in August 2026. In every case, the mode changes who approves an action, not which model does the work.

More autonomy, more risk

Every step up the slider removes a moment where a person could catch a mistake. A 2025 paper led by Margaret Mitchell, an AI ethics researcher at Hugging Face, puts the core finding plainly: "The more control a user cedes to an AI agent, the more risks to people arise." [7]

The reason is that more autonomy means more steps happen with no one checking. A small error early in a task can carry into every step after it, and a fully autonomous agent may act faster than anyone can step in. The International AI Safety Report 2026, written with more than 100 expert contributors, reached the same conclusion: agents carry higher risk because acting on their own makes it harder for people to intervene before failures cause harm [8].

The argument carries 2 more points. Risk rises at every step, not only at the top, because each step hands one more decision to the system. And a better model doesn't remove the concern, since the risk comes from how much control is handed over, not only from how often the model is wrong. The case rests on careful analysis and expert agreement rather than a measured risk curve.

The debate over full autonomy

Whether the top of the slider should be built at all is an open question, and serious voices disagree. Mitchell and colleagues titled their 2025 paper "Fully Autonomous AI Agents Should Not be Developed," arguing: "We find no clear benefit of fully autonomous AI agents that can operate outside of human-defined constraints, but many foreseeable harms from ceding full human control." [9] They aren't against agents. They favor semi-autonomous systems that keep some human control.

AI researcher Yoshua Bengio goes further. On 3 June, 2025, he launched LawZero to build non-agentic AI, meaning AI that doesn't take actions on its own, and asked: "Is it reasonable to train AI that will be more and more agentic while we do not understand their potentially catastrophic consequences?" [10]

Product makers are moving the other way. In January 2025, OpenAI's Sam Altman wrote that "in 2025, we may see the first AI agents 'join the workforce'" [11]. Anthropic's August 2025 framework for trustworthy agents [12] described Claude Code as read-only by default, and its AI-supervised auto mode became the default a year later. Karpathy sits in between, calling for a slider in every product that moves up over time as agents earn trust. As of October 2026, the debate is unresolved, partly over how reliable agents will get and partly over whether any benefit is worth giving up full control.

Autonomy isn't intelligence

How much an agent is allowed to do alone and how capable it is are 2 separate questions. Feng and colleagues, who defined 5 levels of autonomy by the role a person plays, call an agent's autonomy "a deliberate design decision" that's separate from its capability [13]. A Google DeepMind team made the same split in 2024, rating autonomy on its own scale next to capability and noting that even a highly capable AI could be kept from acting on its own [14].

The 2 qualities combine in any mix. A leading model running in a product's most restrictive mode is highly capable but low in autonomy. A simple script with permission to send emails by itself is highly autonomous but barely capable at all. Bengio told MIT Technology Review where the danger sits: "it's not the intelligence as such that is really dangerous. It's when that intelligence is put into service of doing things in the world." [15]

Capability does set a limit, since no one can safely hand a task to a system that can't do it. Beyond that, autonomy gets set jointly. Anthropic's February 2026 study of agent use concluded that autonomy "is co-constructed by the model, the user, and the product," meaning all 3 shape it together [16]. A smarter model doesn't raise an agent's autonomy by itself.