AI agent
An AI agent is a software system that receives a goal, chooses its next actions and uses digital tools to complete a task. Unlike a conventional chatbot that produces a single response, an agent can search for information, read files, call application programming interfaces, change data, run code, inspect the result and continue until a specified condition is met.[1]
A modern AI agent usually combines a large language model with an application layer that stores task state, exposes tools and controls their execution. The model interprets the goal and selects a next step; the application performs the action in a real or isolated environment. Its result returns to the model as a new observation and the cycle repeats.[2]
The term covers systems with different degrees of autonomy, from an assistant that requests approval before every consequential action to a program that can execute a long sequence independently. A language model alone is therefore not an agent. The defining features are control over the course of a task, situational choice of tools and the ability to change later actions in response to earlier results.
How an AI agent works
Work begins with a goal supplied by a user or another information system. The agent compares it with its instructions, the available context and the set of permitted tools. It then chooses an action: provide an answer, obtain more data, call a function, open a document, execute a command or delegate a subtask.
The action produces an observation. A search engine returns pages, a database returns records, a code interpreter returns program output and a file editor returns changed content. The agent updates its working state, determines whether it is closer to the goal and makes another decision. Execution ends when the goal is satisfied, an error or limit is reached, or control must pass to a person.[1]
This mechanism is commonly called an agent loop. One influential form is ReAct, in which a language model interleaves reasoning about a task with actions in an external environment and uses the observations to choose subsequent steps. The method was introduced in 2022 and published at ICLR in 2023.[3]
Components
Model
The model identifies the user's intent, analyses the context, creates or revises a plan and chooses an action. A small, fast model may handle classification and routine steps, while a more capable model makes difficult decisions. A single system can use several models for routing, execution and evaluation.
Instructions and goal
Instructions define the agent's role, area of responsibility, permitted behaviour and stopping conditions. A precise goal is especially important for long tasks: an overly broad request admits many interpretations and increases the risk of an unwanted outcome. Instructions also specify error handling, treatment of confidential data and circumstances that require human participation.
Tools
A tool is any function through which the agent obtains information or changes an external system. Examples include web search, database queries, document readers, messaging, calendars, code execution and graphical interface control. The model receives a name, purpose and parameter schema for each tool.
Tools can be divided into three broad groups:[1]
- information tools read data without changing its source;
- action tools create or modify data, such as sending a message or updating a record;
- coordination tools delegate work to a specialised agent or combine several results.
Context, state and memory
Context is the information visible to the model on a particular step: the request, instructions, previous actions, tool responses and selected documents. State records the progress of the task and intermediate results. Memory can preserve selected information between separate runs, but it is not required for every agent. Long-term storage needs access controls and protection against inaccurate or malicious entries.
Guardrails and control
The application determines which actions are allowed, where they run and when approval is required. Common controls include sandboxes, least-privilege access, time and cost limits, input and output validation, audit logs, approval for irreversible operations and escalation to a person.
Agent, chatbot and workflow
Chatbots, workflows and agents describe different ways of controlling software. A conversational interface does not determine the architecture: a chatbot can be an agent if it independently chooses and uses tools, while an agent can run on a schedule without a chat interface.
| System | Who determines the steps | External systems | Response to a new result |
|---|---|---|---|
| Conventional chatbot | The user asks; the program produces a response | Optional or limited to retrieval | Usually stops after the response |
| Automated workflow | A prewritten algorithm | Performs predetermined integrations | Follows fixed branches and rules |
| AI agent | The model selects actions within defined constraints | Chooses among available tools dynamically | Observes the result, revises the plan and continues |
For a predictable operation with known steps, an ordinary workflow is usually more reliable and less expensive. An agent is useful when the order of work depends on unstructured documents, missing information, exceptions and intermediate results. The added flexibility generally increases latency, cost and testing difficulty.[2]
Architectural patterns
Single agent
A single agent receives the goal and has all required tools. This design is easier to observe and debug because decisions remain in one context and there are few hand-offs. Capabilities can be extended by adding tools while their purposes remain distinguishable to the model.
Multiple agents
A multi-agent system distributes work among specialised agents. A manager agent can divide the task, invoke subordinate agents as tools and combine their outputs. In a decentralised design, agents hand control to one another according to the subject or stage of work.
Specialisation is useful when subtasks require different instructions, data or permissions. It also complicates context transfer, error containment and cost measurement. An error made by one participant can affect every later stage, so adding agents does not automatically improve quality.
Agentic workflows
Between fixed automation and a fully autonomous agent are systems in which code defines part of the route while a model makes selected decisions. Common patterns include:[2]
- prompt chaining, where one result becomes the input to the next step;
- routing, where an input is classified and sent to an appropriate handler;
- parallelisation, where independent subtasks run at the same time;
- manager and workers, where a model decides which subtasks to create;
- evaluator and optimiser, where one component produces a result and another critiques it before repetition.
Applications
Software-engineering agents inspect a codebase, edit files, run builds and tests and correct failures. These tasks have comparatively clear verification through automated tests.
Research agents formulate queries, study several sources, compare evidence and produce cited reports. Their output must be assessed for factual accuracy, coverage and source quality rather than prose alone.
Customer-service agents retrieve account and order information, consult policies, propose a resolution and, when authorised, update a case or issue a refund. Computer-use agents interact with websites and applications through APIs or through the screen, keyboard and pointer. Visual interaction supports software without a suitable API but is more sensitive to layout changes, delays and unexpected dialogs.
Other applications include document analysis, calendar administration, report preparation, internal knowledge access, infrastructure monitoring and coordination of repetitive office processes.
When an agent is appropriate
An agent architecture is most useful when several conditions apply:
- the complete sequence of actions cannot be defined in advance;
- the decision depends on unstructured material such as messages, documents or images;
- intermediate results can be checked and used to guide the next step;
- clear tools and constraints are available;
- the benefit of flexibility exceeds the added latency, cost and risk.
An agent is usually unnecessary when one model call is sufficient, when an operation can be expressed as deterministic code or when failure cannot be detected. A conventional search form, database rule or scheduled script is preferable when it solves the problem completely.
Building an AI agent
Development starts with a narrowly defined task and a measurable result rather than a broad request for autonomy. The first version commonly uses one agent and a small set of distinct tools. Each tool validates its inputs, returns structured errors and grants no more access than the operation needs.
A typical implementation sequence is:
- collect representative tasks, including failures and ambiguous cases;
- define the success condition and the state changes that prove completion;
- implement read-only tools and validate their outputs;
- add action tools with limited permissions and approval points;
- record model decisions, tool parameters, errors and final state;
- run repeated evaluations and compare changes against a fixed baseline;
- expand autonomy only where measured results justify it.
Tool descriptions are part of the control system. Overlapping names and vague descriptions make selection harder, while a huge catalogue consumes context and increases the chance of a wrong call. High-risk operations should remain separate from routine read operations.
Reliability and evaluation
Evaluating an agent is more difficult than checking a single response. It performs multiple steps and changes the environment, so an early error can alter the rest of the trajectory. Evaluation therefore examines the action log, tool arguments and actual external state as well as the final message. A claim that an order was created is not success unless the order exists in the database.
An evaluation consists of a task, one or more runs and a set of checks. Code agents can be assessed with tests and static analysis; support agents with case state and conversation quality; research agents with factual accuracy, coverage and citations. Because model behaviour varies, each scenario should be run repeatedly to measure reliability rather than occasional success.[4]
Risks and security
Tools turn an incorrect model response into a potentially incorrect action. Important risks include choosing the wrong tool or arguments, following a plausible but mistaken plan, disclosing contextual data, storing false information in memory, propagating errors between agents and prompt injection. In a prompt-injection attack, content in a document, message or web page attempts to replace the user's instructions.
The risk is greatest when an agent reads untrusted content and also has tools that can change data. External text must be separated from control instructions; permissions should be minimal; consequential actions should require explicit approval. No single classifier can provide a complete defence.[5]
Protection uses several layers: authentication, least privilege, isolation, argument and output validation, limits, logging, policy checks and human oversight. Tools should be classified by consequences. Reading a public page and deleting a file should not pass through the same approval path.[6]
Frequently asked questions
Can a chatbot be an AI agent?
Yes, if the conversation is an interface to a system that controls the task and invokes tools. A chatbot that only generates text is not usually considered an agent.
Does an agent have to be fully autonomous?
No. It may only propose steps, automatically perform low-risk operations and request approval for the rest, or operate independently inside an isolated environment.
How is an agent different from a neural network?
A neural network or language model produces a prediction or response from inputs. An agent is the surrounding software system: model, instructions, state, tools, execution loop and controls.
See also
References
- ↑ 1.0 1.1 1.2 A practical guide to building agents // OpenAI. 15 January 2026.
- ↑ 2.0 2.1 2.2 Building effective agents // Anthropic. 19 December 2024.
- ↑ ReAct: Synergizing Reasoning and Acting in Language Models // Shunyu Yao et al. ICLR, 2023.
- ↑ Demystifying evals for AI agents // Anthropic. 9 January 2026.
- ↑ Understanding prompt injections // OpenAI.
- ↑ Summary Analysis of Responses to the Request for Information Regarding Security Considerations for AI Agents // Jared Riggs et al. NIST, 18 May 2026.