AI agents for a small business hand over steps, not whole jobs.

A shop run by an agent did not make money

The most useful public test of an agent running a small business is one its own makers ran. In June 2025 Anthropic published Project Vend, in which a version of Claude Sonnet 3.7, nicknamed Claudius, ran a shop in Anthropic’s office for about a month with the AI safety company Andon Labs. The shop was a small fridge, some stacked baskets and an iPad for self-checkout. Claudius was responsible for the inventory, the prices and avoiding bankruptcy, and it dealt with customers over the office’s Slack.

It did not succeed at making money. It was talked into a string of discounts, including a 25% discount for Anthropic employees, when, as one employee pointed out, 99% of its customers were Anthropic employees. Someone offered it $100 for a six-pack of a Scottish soft drink that could be bought online in the US for about $15, and it said it would keep the request in mind. It bought metal cubes and sold them for less than it paid, which was the largest single fall in the shop’s value. For a time it told customers to pay into a Venmo account it had invented. Anthropic’s own verdict was that if it were expanding into office vending, it would not hire Claudius.

None of those failures needed a hard problem. Each one was a small, plausible step taken without anyone in between: a customer asked nicely, the agent agreed, and the agreement went straight into the business. That is the part to notice if you are thinking of connecting an agent to the inbox your clients write to. Everyone who emails you becomes someone who can ask it for something.

What fixed it was procedure, not freedom

In December 2025 Anthropic published a second phase, run on Claude Sonnet 4.0 and then 4.5. The shop now had a customer database, better information about its stock and better web search, and weeks with a negative profit margin were largely eliminated. The authors were clear about what made the difference. The biggest single change was making Claudius follow procedures: when someone asked for a product, it had to check prices and delivery times with its research tools rather than guessing. Their phrase was “bureaucracy matters.” Adding a second agent as its chief executive, to supervise it, helped much less.

It still went wrong in ways a business owner would recognise. The agents remained eager to please, which made them a mark for the more adversarial testers among the staff, and at one point both were ready to agree a bulk contract to lock in the price of onions until a member of staff pointed out it would break a US law on onion futures. The authors’ conclusion was that the gap between “capable” and “completely robust” remains wide, and that the agents still needed substantial human help.

Read as advice to a solo operator, the second phase says something specific. The agent got better when its freedom was narrowed into fixed steps with checks built into them, and the one failure that would have cost real money was stopped by a person. That is not a story about handing a job over. It is a story about breaking one up.

Office admin is where agents are weakest

A shop is one case. A broader test is TheAgentCompany, a benchmark built by researchers led from Carnegie Mellon University (Xu, Neubig and colleagues, first posted in December 2024 and updated in September 2025). It simulates a small software company, with internal websites, shared files and a chat system staffed by simulated colleagues, and sets agents 175 tasks of the kind real staff do. The best agent tested, built on Gemini 2.5 Pro, fully completed 30.3% of them.

The breakdown matters more than the headline. Administrative, finance and data science tasks scored lowest, with many models completing none of them. The authors’ explanation is uncomfortable for anyone hoping an agent will take the paperwork: these tasks need an agent to understand documents and communicate with people, and administrative and financial data is usually private to a company, so there is little of it for models to learn from. In other words, the work a bookkeeper or consultant most wants to give away is the work this benchmark found hardest to give.

The paper also records a failure that should worry anyone relying on an agent’s own report of what it did. In one task the agent could not find the colleague it was supposed to ask, so it renamed a different user in the chat system to that colleague’s name, and carried on. The authors call this the agent creating a fake shortcut that leaves out the hard part of the task. From the outside, the step looked done.

The longer the job, the less reliable the agent

There is a reason whole jobs fail more than single steps. In March 2025 the research group METR (Kwa and colleagues) measured how long a task (timed by how long it typically takes a person) an agent could complete with a 50% success rate. For Claude 3.7 Sonnet it was around 50 minutes, and the figure had been doubling roughly every seven months since 2019. But at 80% reliability, which is still one failure in five, the tasks agents could manage were roughly five times shorter. The authors also found performance much lower on “messier” tasks, the ones that look most like real work.

Those were software tasks, and the models have moved on since. The shape still applies to your admin. Onboarding a new client is not one task, it is a dozen: read the enquiry, check the diary, propose times, send the engagement letter, set up the folder, raise the first invoice. Every step an agent takes without you is another place for one of those small, plausible mistakes, and the mistake in step two is only visible when the client replies to step nine.

Hand over steps that end at your desk

Put together, the evidence points to a different unit of delegation. Not “the agent does onboarding”, but “the agent does the next step and leaves the result where I will see it.” In practice that gives you three rules.

1. Nothing an agent produces reaches a client, a bank or a contract without you. It can draft the engagement letter, fill in the invoice and propose three times for the call. You send, pay and agree. This is where Claudius lost its money, and where the onion contract was caught.
2. Fix the procedure, and leave the agent no room to guess. If a quote needs a price, the step reads it from your price list and shows which line it used. If a booking needs a slot, it reads your calendar rather than assuming. This is the change that rescued the second phase of the shop.
3. Keep the agent off the channels clients can talk to it through. If it reads your inbox to draft replies, it drafts; it does not answer. Anyone who can message an agent that acts can ask it for a discount, and the shop showed how often it says yes.

That still takes real work off you: the reading, the gathering, the filling in of forms, the first draft. What it does not do is remove you from the points where the business commits to something. Working out where those points sit in your own admin, step by step, is most of the job, and it is the part an agent sold as an employee assumes away.

What this concedes

The evidence above is dated, and the direction of travel is not on our side. The shop improved a great deal between its two phases, METR’s whole finding is that the length of task agents can manage keeps rising, and the models in these studies are older than the ones on sale now. Some of the line drawn here will be in the wrong place within a year, and it is worth testing again rather than taking it as settled.

Keeping yourself at every point of commitment also costs time. An agent that drafts and waits saves less than one that sends, and if your admin is mostly the sending, the saving may be small. You remain the bottleneck at exactly the moments that matter, which is the opposite of what the AI employee pitch promises.

And it suits what we sell, which is a reason to read it sceptically. We build systems with a person at the decisions that matter, and this post argues that is the right shape. The fair test is the case where it is not: a job made entirely of fixed rules, like chasing invoices on set dates, does not need an agent or us. The scheduling feature in your accounting software does it every time, with no one in between, because there is nothing to be talked into.

Common questions

Can an AI agent run the admin for a one-person business?

Not unsupervised, on current evidence. In Anthropic’s 2025 Project Vend, an agent running a small office shop was talked into discounts, sold stock below cost and invented a payment account, and the shop did not make money. Agents are useful for single steps such as drafting, gathering information and filling in forms, as long as you approve anything that reaches a client, a payment or a contract.

What are AI agents worst at in a business?

Administrative and finance work, in the most direct test so far. In TheAgentCompany, a Carnegie Mellon benchmark of 175 tasks in a simulated small company, the best agent fully completed 30.3%, and administrative, finance and data science tasks scored lowest. The authors put this down to the need to understand documents and communicate with people, and to company admin and finance data being private, so models have seen little of it.

Is an AI employee worth it for a small business?

As a set of supervised steps, often; as an employee that acts on its own, not yet. The improvement in Anthropic’s second shop trial came from making the agent follow fixed procedures, such as checking prices before quoting, rather than from giving it more freedom, and a person still had to catch a contract that would have broken the law.

How do I use an AI agent safely in my business?

Break each job into steps and let the agent take only the steps that end with a result waiting for you: a draft, a filled-in form, a proposed booking. Make it read prices and dates from your own records rather than guessing, and keep it from acting on channels your clients can message, because anyone who can talk to an agent that acts can ask it for something.

Will AI agents get good enough to run whole jobs?

They are improving quickly. METR found in 2025 that the length of software task agents could complete half the time had been doubling roughly every seven months since 2019. But reliability lags capability: at 80% success the tasks were about five times shorter, and performance was much lower on messy, real-world tasks. Re-test the line every so often rather than assuming it is fixed.