A new study analyzing over 177,000 AI agent tools finds that the share of tools capable of directly modifying external environments — sending emails, editing files, executing financial transactions, even steering drones — surged from 27% to 65% of total usage over just 16 months, signaling a fundamental and largely unmonitored shift in how artificial intelligence is being deployed in the real world.

The research, posted to arXiv in March 2025 (arXiv:2603.23802), examined 177,436 agent tools created between November 2024 and February 2026, gathered by monitoring public Model Context Protocol (MCP) server repositories. MCP is currently the predominant standard for connecting large language models to external tools, making it a rare empirical window into real-world AI agent deployment.

The authors classify tools into three categories: perception tools, which access and read data; reasoning tools, which analyze data or concepts; and action tools, which directly alter external environments. It is the explosive growth of that third category that the researchers flag as most consequential.

Software development dominates the landscape, accounting for 67% of all agent tools and a striking 90% of MCP server downloads. This aligns with widely observed industry trends in which AI coding assistants have become embedded infrastructure for developers. However, the researchers note that the ecosystem is diversifying, with tools appearing across task domains carrying varying levels of risk.

Using agentic financial transactions as a case study, the paper argues that existing regulatory frameworks focused on model outputs are insufficient. The authors contend that governments and regulators need to extend oversight to the tool layer itself — the specific capabilities that agents are given to act upon the world — rather than focusing solely on what models say or generate.

'While most action tools support medium-stakes tasks like editing files, there are action tools for higher-stakes tasks like financial transactions,' the paper states, underscoring that the infrastructure for consequential autonomous action is already in place and growing.

The study connects to a broader pattern visible across the AI industry: the rapid industrialization of agentic AI, in which LLMs are no longer passive responders but active participants capable of multi-step, real-world task completion. Frameworks like MCP, released by Anthropic in late 2024, have dramatically lowered the barrier to building such systems, accelerating both adoption and the associated risks.

For policymakers, the research offers both a methodology and an argument. By monitoring public MCP repositories, regulators could in principle track what kinds of autonomous capabilities are proliferating in the wild — before incidents, rather than after. Whether regulatory bodies in the United States, European Union, or elsewhere have the bandwidth or mandate to pursue such monitoring remains an open question.

This observer notes that the 27-to-65-percent shift in action tool prevalence within 16 months is among the most concrete empirical signals yet that the transition from AI as advisor to AI as actor is not a future scenario. It is already underway.