AI Weekly: Smarter Models, Riskier Agents — February 16-22, 2026

Two frontier labs shipped genuine reasoning jumps this week, and the "personal AI agent" category that's been generating headlines since January hit its first real security reckoning. If you're running a small business and either using or being pitched a self-hosted AI agent, this week is worth ten minutes of your attention.

Gemini 3.1 Pro's reasoning leap

Google DeepMind released Gemini 3.1 Pro on February 19, and the benchmark jump is hard to ignore. It scored 77.1% on ARC-AGI-2, more than double the previous Gemini 3 Pro's 31.1%, and hit 94.3% on GPQA Diamond, the highest score reported on that benchmark to date.

Why this matters for SMEs: ARC-AGI-2 tests novel problem-solving, not memorised patterns. A model that reasons better on problems it hasn't seen before makes fewer of the confident-but-wrong mistakes that turn AI-assisted work into a liability. If you're using AI for anything beyond drafting (contract review, financial modelling, custom workflow logic), model-level reasoning gains like this compound quickly.

Grok 4.20 bakes a team into one model

xAI shipped Grok 4.20 in beta on February 17 with a production multi-agent system running by default on complex queries: a coordinator agent breaks down the task, then hands pieces to specialised sub-agents for research, code/logic, and synthesis before returning one answer.

This is the same idea we covered in the Feb 3-10 post about Claude Code's custom agents, where developers manually route tasks to Opus, Sonnet or Haiku depending on the job. Grok 4.20 bakes that specialisation into the model itself rather than leaving it to the user.

The takeaway: agent specialisation is moving from "power-user technique" to "default product behaviour." Within a year or two, asking "which model should handle this?" may stop being a question humans need to answer at all.

The real bottleneck is agent infrastructure, not model quality

Both launches this week point the same direction: the models themselves are no longer the limiting factor. Gemini 3.1 Pro reasons better, Grok 4.20 coordinates specialists automatically — the raw capability keeps compounding month over month. What hasn't caught up is the infrastructure around agents: permissions, plugin marketplaces, and the security boundaries that decide what an agent is actually allowed to touch.

That gap matters more with every release like these two. A model good enough to reason through novel problems, or to hand off subtasks to specialised sub-agents on its own, is also a model businesses will trust with more autonomy. Why this matters for SMEs: the question worth asking about any AI agent setup isn't "how capable is the model?" anymore — it's "what happens if this agent does something I didn't authorise?"

Before you hand a self-hosted or third-party agent framework broad access to your business:

• Ask exactly what it can touch by default (filesystem, email, shell commands, browsing) and whether that's configurable per-task
• Check who maintains any plugin or "skill" marketplace it pulls from, and how vetted the entries are
• Don't grant standing access to systems that hold business-critical data — scope permissions per workflow instead
• Treat vendor claims of "autonomous AI agent" as a prompt to ask how they audit what the agent is permitted to do, not a feature to take on faith

This is exactly the gap we help clients close when we scope Claude Code automation builds with proper permission boundaries from day one, rather than bolting security on after something goes wrong.

The pattern this week: models keep getting smarter and more agentic by default, but the infrastructure around agents (marketplaces, plugins, permissions) is where the real risk now sits. Worth remembering before you hand any AI system the keys to your business.

Want a second opinion on an AI agent setup before you deploy it? Get in touch and we'll walk through it with you.