Agent classes
Software agents account for nine of the 19 registry incidents
| Class | Defining property | Types | Flagship deployments | Registry incidents |
|---|---|---|---|---|
| Physical AI Agents | Agents that move, lift and fly in shared space. | 6 | 17 | 7 |
| Personal and Ambient Agents | Agents on the body, in the home, in the car and in public space. | 7 | 17 | 3 |
| Software Agents | Agents that act in code, business tools, payments and corporate systems. | 4 | 12 | 9 |
Attack surface
Perception and sensors rates very significant or critical for 12 of 17 agent types
| Dimension | Types rated critical | Types rated very significant or higher |
|---|---|---|
| Perception and sensors | 0 | 12 |
| Data capture and retention | 1 | 12 |
| Command and control channels | 0 | 10 |
| Behavioral and policy boundary | 3 | 10 |
| Identity and authentication | 1 | 8 |
| OTA and update pipeline | 1 | 8 |
| Integrations and permissions | 2 | 6 |
| Connectivity surface | 0 | 3 |
| Multi-agent coordination | 2 | 3 |
| Physical access | 0 | 1 |
Agent types
46 flagship deployments across 17 agent types, 16 of them in China
| Agent type | Class | Where it operates | Flagship deployments | Registry incidents |
|---|---|---|---|---|
| Robotaxis and autonomous vehicles | Physical | Public roads | Waymo One, Apollo Go, Tesla Robotaxi | 6 |
| Humanoid robots | Physical | Factories, warehouses, early homes | Figure 02 at BMW Spartanburg, UBTech Walker S2, Agility Digit at GXO | 0 |
| Industrial robots and cobots | Physical | Factory floors | Hyundai Metaplant America, Xiaomi Changping smart factory | 1 |
| Autonomous trucks | Physical | Highways, ports, oil fields | Aurora Driver, Kodiak Driver at Atlas Energy, Pony.ai Robotruck | 0 |
| Drones | Physical | Low-altitude airspace | Zipline, Meituan Drone (Keeta Drone), Amazon Prime Air MK30 | 0 |
| Fleets and swarms | Physical | Warehouses, cities, battlefields | Amazon Robotics with DeepFleet, EHang drone show system, DAWG (successor to Replicator) | 0 |
| Phones and tablets | Personal and ambient | Personal devices | Doubao Phone Assistant, Apple Intelligence and Siri, Microsoft Recall | 0 |
| Wearables | Personal and ambient | On the body | Ray-Ban Meta and Oakley Meta glasses, Quark AI Glasses, Apple Watch hypertension notifications | 0 |
| Vehicle cabin AI | Personal and ambient | Car interiors | GM Gemini assistant, Grok in Tesla vehicles, BYD Xuanji with DeepSeek | 1 |
| Smart home assistants | Personal and ambient | Homes | Alexa+, Gemini for Home, Ring Familiar Faces and Search Party | 2 |
| Medical devices | Personal and ambient | Clinics and bodies | LumineticsCore (formerly IDx-DR), Chinese radiology AI (Yukun, United Imaging, Infervision, Deepwise) | 0 |
| Public infrastructure | Personal and ambient | Streets and public space | Met Police live facial recognition, Flock Safety license plate readers, SkyNet camera network | 0 |
| Ambient sensors | Personal and ambient | Homes, PCs, workplaces | 0 | |
| Coding and research agents | Software | Code repositories and shells | Claude Code, OpenAI Codex, Trae | 5 |
| Workflow agents | Software | Business software and tools | Microsoft Copilot Studio, Manus, Coze and Coze Space | 1 |
| Commerce agents | Software | Payments and shopping | Alipay AI Pay in the Qwen App, ChatGPT checkout and Agentic Commerce Protocol, Google UCP and AP2 | 0 |
| Enterprise agents | Software | Corporate systems | Microsoft Agent 365, Salesforce Agentforce, Alibaba Cloud Bailian (Model Studio) | 3 |
Incidents
Registry incidents cluster in two agent types: robotaxis and autonomous vehicles (6) and coding and research agents (5)
Method
Ratings measure exposure on ten paths into each agent
Each agent type is rated on ten dimensions: physical access, identity and authentication, command and control channels, perception and sensors, connectivity, the update pipeline, data capture and retention, integrations and permissions, the behavioral boundary, and multi-agent coordination. Ratings use five levels: limited, moderate, significant, very significant and critical. Every rating carries a one-line reason, published on the agent type page and in ai_attack_surface.csv.
Ratings describe exposure, not likelihood. A critical rating means a failure or compromise on that path can cause the most serious harm the agent type can do. 13 agent types carry ratings from the earlier 137AI inventories; drones, industrial robots, ambient sensors and enterprise agents were rated for this edition.
Record
Page Record
- Datasets
- ai_deployments.csv (48 rows, 46 flagship); ai_attack_surface.csv (170 rows); ai_incidents.csv (19 rows, Agent_Page column)
- Sources
- Listed on each agent type page
- Last verified
- October 2026