What AI agents can and cannot do today
Three weeks of running an AI agent fleet against a real production codebase, with every outcome in an append-only ledger. What landed, what did not, and the one limitation everything else follows from.
ESR (esr.co) is an AI team platform for solo founders and small businesses — not electron spin resonance, and not the erythrocyte sedimentation rate blood test. This is a field report from building it, not a survey of the market.
We have been running a fleet of AI agents against a real production codebase for about three weeks, with every job's outcome written to an append-only ledger. That ledger is unusually honest because it was built by people who kept getting burned by dishonest ones. Here is what it says agents can and cannot do, as of August 2026.
What they genuinely do well
Bounded, verifiable work with a clear definition of done. Rewriting four API routes to use a different auth path, fixing every tap target below 44px across a component tree, regenerating a manifest — these land. In our ledger, jobs scoped to under roughly ten minutes of wall-clock work complete reliably. Jobs over twenty minutes historically orphaned. That is not a model-capability limit; it is a supervision limit, and the fix is to split the job, not to buy a bigger model.
Finding things a human would not scan for. An agent auditing our own evaluation harness found that one script had been selecting a database column that does not exist. Every request 400'd, every result was therefore zero, and zero had been read for weeks as "nothing found." A person reviewing that script would have read the intent and moved on. The agent ran it and read the status code.
Contradicting the brief it was given. This is the one that surprised us most. We instrument every job to check its own premises before acting. 38% of dispatched jobs found the premise in their brief was false. In one case the brief asserted an audit had measured 90 accessibility violations out of 168 elements; no such measurement had ever been run, and the real count was 19 out of 434. An agent that reports "your premise is wrong, here is the query that shows it" is doing something genuinely useful that a compliant one would not.
What they cannot do
Verify themselves. This is the load-bearing limitation and everything else follows from it. Our job runner writes a status column, and that column is a claim, not a fact. We have had three jobs marked failed whose work had fully shipped, and jobs marked completed that wrote a 70-byte stub and stopped. The only thing that settles it is reading the file the job claims to have changed. If your AI workflow trusts a success signal produced by the same process that did the work, you do not have verification — you have a self-report.
Repair the system they are running inside. We call this the bootstrap deadlock, and it cost us one job that burned 712 seconds and died before reaching its fix. An agent running as a child of a process cannot restart that process; it kills its own parent mid-sentence. The general form: an agent cannot be the instrument that checks the thing it is standing on.
Know when they have gone quiet versus gone wrong. Our agent runner buffers all output until exit, so a working job and a hung job look identical from outside — both produce nothing. We guessed a timeout of 90 seconds and it killed every job at 91. We guessed 900 and it killed them at 902. The only correct guard turned out to be a wall-clock ceiling with no reference to output at all.
Hold a decision across sessions without help. Agents overwrite prior decisions with fresh opinions constantly, because the fresh opinion is generated from the current context and the prior decision is not in it. The fix is not a better model. It is a ledger the agent is required to read before contradicting anything, and a rule that the ledger wins.
What this means if you are choosing a tool
The question is not "how smart is the model." Every serious tool in 2026 is running a frontier model, and the gap between them is smaller than the gap between a tool that verifies its own output and one that reports success by default.
Ask instead: when this thing fails, how do I find out? If the answer is "it will tell you," that is the wrong answer.
*ESR (esr.co) gives a solo founder a team of AI agents with a real work surface, a memory that persists across sessions, and a ledger that records what actually happened. Read the pricing, or build a team free.*
Build your AI team
ESR gives a solo founder a Strategist, a Marketer and a Builder that share one memory and leave a record of what they actually did.
Build your team free