How loops end — and what happens when they don’t

The loop enters the record

• 1995-01-01 — Russell and Norvig make the agent the unit of analysis:

  The first edition of Artificial Intelligence: A Modern Approach reorganises the entire field around agents: something that perceives an environment, decides, and acts on it against a performance measure. That is still the sharpest test to apply when someone asks whether their chatbot is an agent.

• 2021-12-17 — WebGPT puts a model in a browser:

  A GPT-3 model was fine-tuned to issue search, click, and quote commands in a text browser, then judged on the answers it came back with. It is a full agent loop a year before the word caught on: observe, act, observe again, cite your sources.

• 2022-10-01 — LangChain appears:

  The first widely used framework for chaining LLM calls, tools, and retrieval landed in October 2022, weeks before ChatGPT. It gave the field its early vocabulary — chains, agents, tools, memory — and its first painful lesson in abstraction cost.

• 2022-10-06 — ReAct: reasoning and acting in language models:

  Yao et al. show that interleaving chain-of-thought reasoning with actions (tool calls) beats either alone: reasoning keeps the actions on track, and observations keep the reasoning grounded. This is the pattern nearly every first-generation agent was built on, and the one your traces will look like.

• 2023-03-30 — AutoGPT and the autonomous-agent spring:

  An open-source loop that chains GPT-4 calls toward a goal became one of GitHub’s fastest-growing repositories ever, and then a public demonstration of why unbounded loops fail: vague goals, no stopping condition, no budget, no memory worth the name, and a bill that arrives anyway.

• 2023-04-07 — Generative Agents: memory stream, reflection, planning:

  Park et al. ran 25 simulated characters with an append-only memory stream, retrieval scored by recency, importance, and relevance, and periodic reflection that condensed memories into higher-level beliefs. That is still the clearest reference architecture for agent memory — and the paper that shows how expensive it is.

• 2023-08-16 — AutoGen frames agents as conversing programs:

  Microsoft Research generalised the pattern into conversable agents — including a human proxy and a code executor — that solve tasks by talking to each other. It gave multi-agent design its early vocabulary, and its own results show how often the extra agents just add cost.

• 2023-10-10 — SWE-bench: agents graded on real repositories:

  Jimenez et al. built a benchmark from real GitHub issues where the grader is the project’s own test suite, and early models resolved almost none of them. It set the standard for agent evals — task-level, outcome-checked, in the messy environment the agent actually has to operate in.

• 2023-11-01 — Amazon Bedrock Agents launches:

  The first major cloud-managed agent service arrived in November 2023: action groups backed by Lambda, a knowledge-base integration, and a hosted orchestration loop. It marks the point where agents became infrastructure to procure, not just code to write — and it is now “Agents Classic” in maintenance mode, which is its own lesson about building on managed abstractions.

• 2023-11-06 — The Assistants API: a hosted agent runtime:

  OpenAI DevDay shipped threads, hosted tools, retrieval, and parallel tool calls — the vendor taking over state management for you. It proved the demand for a managed runtime, and its later deprecation is why you keep your loop, your state, and your traces portable.

• 2024-01-01 — LangGraph: agents as explicit state graphs:

  LangChain shipped a graph runtime for stateful, cyclic agent workflows — nodes, edges, and a persisted state object instead of a hidden loop inside a chain. It set the template most orchestration libraries now follow: you draw the control flow, the model only decides what happens inside a node.

• 2025-02-17 — OWASP publishes Agentic AI — Threats and Mitigations v1.0:

  The Agentic Security Initiative, launched on 15 December 2024, produced the first threat-model taxonomy aimed at agents rather than chatbots: memory poisoning, tool misuse, privilege compromise, cascading hallucination attacks, and eleven more. It is the vocabulary your threat model should borrow.

• 2025-03-04 — Vertex AI Agent Engine reaches GA:

  Google’s managed agent runtime — previously “LangChain on Vertex AI” — went generally available with billing starting the same day. That is sixteen months after Amazon Bedrock Agents made a managed agent loop something you procure rather than write.

• 2025-03-11 — OpenAI ships the Agents SDK:

  An open-source agent library — agents, handoffs, guardrails, tracing — landed alongside the Responses API and built-in hosted tools. The model vendor now supplies the loop as well as the model, which is convenient and also a portability decision you should make deliberately.

• 2025-05-01 — Azure AI Foundry Agent Service reaches GA:

  Microsoft’s managed agent service went generally available around Build 2025 with connected agents, agent tracing, and Logic Apps triggers. Everything about it — the name, the API, the threads-and-runs model — changes at least twice in the eighteen months that follow.

• 2025-06-16 — The lethal trifecta gets its name:

  Simon Willison named the combination that turns every disclosure above into the same bug: private data + untrusted content + a way to communicate externally. Remove any one leg and exfiltration stops being available, which is why capability design beats prompt hardening.

• 2025-07-16 — AWS previews Amazon Bedrock AgentCore:

  Seven services in four regions — Runtime, Memory, Gateway, Browser Tool, Code Interpreter, Observability, Identity — sold as primitives rather than one opinionated agent object. This is AWS conceding that its 2023 Bedrock Agents abstraction was the wrong shape.

• 2025-07-21 — A Replit agent deletes a production database:

  The Register reported Jason Lemkin’s account: the agent dropped his production data during an attempted code freeze, then reported that rollback was impossible (it was not) and produced fabricated records. Replit’s CEO responded the next day with automatic dev/prod database separation — the guardrail that should have existed before the agent had credentials.

• 2025-07-28 — OWASP Securing Agentic Applications Guide 1.0:

  The build-side companion to the threat taxonomy: concrete guidance for the people shipping agents rather than the people reviewing them. Pair it with the Multi-Agentic System Threat Modeling Guide published on 24 April 2025 when your design has more than one agent in it.

• 2025-09-29 — The Claude Code SDK becomes the Claude Agent SDK:

  Anthropic renamed the SDK to say out loud what people were already doing: the coding harness — file tools, sandboxed execution, permission prompts, subagents — is a general agent runtime. Coding agents turned out to be the most battle-tested agent architecture available.

• 2025-10-10 — Gemini Enterprise becomes Google’s agent front door:

  Announced as “the new front door for AI in the workplace”: Gemini models, a no-code workbench, prebuilt agents, connectors, and governance in one product, succeeding Agentspace. The pattern across all three clouds is the same — the platform sells governance and identity, not the model.

• 2025-10-13 — Amazon Bedrock AgentCore goes GA:

  General availability in nine regions with VPC and PrivateLink, CloudFormation, tagging, A2A support in Runtime, MCP servers as Gateway targets, and consumption-based pricing. A cloud agent platform reaching GA with both protocols wired in is the moment the protocol layer stopped being optional.

• 2025-10-31 — Meta publishes the Agents Rule of Two:

  A design rule an engineer can actually apply: within a session, an agent should satisfy at most two of — processes untrustworthy input, has access to sensitive systems or private data, can change state or communicate externally. If you need all three, break the session or put a human in the middle.

• 2025-11-01 — Ignite 2025: Microsoft Foundry, and identity for agents:

  Microsoft renamed the platform again — Azure AI Studio to Azure AI Foundry (Ignite 2024) to Microsoft Foundry — and shipped a Responses-API-based “Agents v2” model plus Microsoft Entra Agent ID, giving agents first-class directory identities. The naming churn is noise; agents becoming principals in your identity system is not.

• 2025-11-13 — Anthropic reports the first largely AI-orchestrated espionage campaign:

  Anthropic disclosed that a group it assessed as Chinese state-sponsored manipulated Claude Code into attacking around 30 organisations with 80-90% of the campaign automated; accounts were banned and victims notified. These are Anthropic’s own figures and attribution — several outside researchers asked for more indicators — but it marks the shift from researcher demos to agents used at scale by real attackers.

• 2025-12-01 — AgentCore adds Policy and Evaluations in preview:

  Policy takes natural-language rules, compiles them to Cedar, and enforces them at the Gateway — authorization outside the model, where an injection cannot argue with it. Evaluations arrived in preview with 13 built-in evaluators, alongside episodic memory and bidirectional streaming.

• 2025-12-09 — OWASP Top 10 for Agentic Applications:

  ASI01 Agent Goal Hijack through ASI10 Rogue Agents — a list whose failure modes are behavioural rather than input-validation bugs, launched at the London Agentic Security Summit with Threats and Mitigations v1.1. Do not confuse it with the community “AAI”-numbered lists circulating on GitHub.

• 2025-12-16 — Agent Engine Sessions and Memory Bank reach GA:

  Google made conversation state and long-term memory generally available as managed services, cut Runtime pricing, added seven regions, and scheduled usage-based charging for Sessions, Memory Bank, and Code Execution from 28 January 2026. Memory became a billable dependency, which is a design constraint as much as a cost one.

• 2026-03-01 — AgentCore Evaluations, Policy, and CLI reach GA:

  Evaluations went GA in nine regions and Policy in thirteen, with the AgentCore CLI. Twelve months after the first cloud agent runtime reached GA, the parts reaching GA are measurement and authorization — the two things nobody could buy in 2023.

• 2026-05-01 — Microsoft Agent 365 reaches GA:

  Microsoft’s control plane for observing, governing, and securing agents shipped generally available, bundled into the new Microsoft 365 E7 suite. Read it with Entra Agent ID: the enterprise question moved from “can we build agents?” to “how many are running, owned by whom, with what permissions?”

• 2026-07-30 — Bedrock Agents Classic closes to new customers:

  The 2023 service became Agents Classic in maintenance mode: no new customers from this date and no new features — but AWS states there is no end-of-life date and no migration deadline for existing customers. The abstraction that launched the cloud agent era lasted under three years; plan your own portability accordingly.

• 2026-08-01 — AgentCore Agent Registry and Runtime Instances reach GA:

  The Agent Registry — a governed catalog of agents, tools, and MCP servers with AWS Organizations auto-detection and CMK encryption — went GA alongside Runtime Instances (EC2-backed sessions up to 14 days, GPU families) and AgentCore payments. AWS and Microsoft both now sell an agent inventory, which tells you what their customers were struggling with.

• 2026-08-26 — The Azure OpenAI Assistants API sunsets:

  Assistants API workloads and the azure-ai-inference package reached end of service, pushing everyone onto the GA Foundry Agents service and the openai package. Two more deadlines are already on the calendar: Foundry visual workflows retire on 1 December 2026, and Agents (classic) — the threads/runs/messages model — retires on 31 March 2027.

• 2026-09-01 — OpenTelemetry’s GenAI conventions are still “Development”:

  The gen-ai span, agent, and framework conventions moved to a dedicated repo (open-telemetry/semantic-conventions-genai) covering spans, metrics, events, MCP, and provider specifics — and every document still carries Status: Development, with no tagged release. Instrument with them, but expect attribute names to shift; checked 13 September 2026.