AI agents

A chatbot answers a question and waits for the next one. An AI agent gets a goal, such as handling a request or putting together a report, and works through it in a loop: it plans the next step, calls a tool, reads the result and decides what to do next. Tools are functions of other systems, such as a CRM lookup or sending an email. Anthropic sums agents up as language models that use tools in a loop, guided by feedback from their environment.

The word agent comes from AI research, where it has long meant a system that perceives its environment and acts in it. Since 2024, “agentic AI” has become a buzzword, popularized among others by AI researcher Andrew Ng. Vendors stretch the term a long way: Gartner warns of “agent washing,” the rebranding of assistants, chatbots and RPA products that have no real agentic capabilities.

For executives, one difference matters: an agent acts inside real systems. It creates records, writes messages and changes entries. Every agent therefore raises questions that are not technical ones. What permissions does it get, who checks its results, and how much may a single run cost?

How an AI agent works at its core.

Every agent is built from a few parts. OpenAI's guide to building agents names three: the model, which plans and decides; the tools it uses to fetch data or take actions; and the instructions that set the goal, the rules and the limits.

The process is a loop. The agent breaks the goal into steps and picks the next one. It produces a tool call, the application executes it and returns the result. The model reads it and decides whether to continue, change course or stop. This feedback from the environment is the heart of the design, because it is how the agent finds out whether a step worked.

Memory comes in two forms. Short-term memory is the context window, meaning everything the model has in front of it during a run. Long-term memory sits outside the model, for example in a database or in notes the agent reads and writes.

Because the loop is open-ended, it needs stopping conditions: a maximum number of steps, a cost limit, or a handoff to a person when the agent gets stuck.

Chatbot, workflow, agent: the difference is who's in control.

In its December 2024 article “Building effective agents,” Anthropic separates two kinds of systems. In workflows, predefined code paths determine when which model and which tool runs. In agents, the model directs its own process and its use of tools. Anthropic counts both as agentic systems, but only the second is called an agent.

A chatbot sits one step earlier. It answers in a conversation and does not act in other systems. Even a chatbot with a few connected functions is closer to an assistant, as long as each action follows a single input and no plan of its own stands behind it.

Workflows are underrated: they are predictable, cheaper and easier to check. An agent makes sense when you cannot say in advance how many steps a task needs, or which ones. Anthropic advises starting with the simplest solution and adding complexity only when it demonstrably improves the outcome. For many tasks, a workflow is enough.

MCP connects tools, A2A connects agents.

An agent is only as useful as its tools. The technical basis is called tool use or function calling: instead of a text answer, the model produces a structured call that the application executes. The model learns which tools exist from their descriptions, and how clear those are and how well the tools were tested largely determines the agent's quality.

Two open standards cover the connections. The Model Context Protocol (MCP) defines how an agent uses tools and data sources. Anthropic released it in November 2024 and donated it to the Agentic AI Foundation under the Linux Foundation in December 2025; the current revision of the specification is dated July 28, 2026. The Agent2Agent protocol (A2A) defines how agents hand tasks to one another. Google introduced it in April 2025, the Linux Foundation has hosted it since June 2025, and the first stable version, 1.0, shipped in March 2026. Each agent describes its capabilities there in what is called an Agent Card.

The Linux Foundation sums up the division of labor this way: A2A for coordination between agents, MCP for access to internal tools and data. All details as of November 5, 2026.

More agents are no promise of quality.

In a multi-agent system, several specialized agents share one task. A common pattern has a coordinator: a lead agent breaks the task down, hands parts to specialists and merges the results. OpenAI calls this the manager pattern; Anthropic describes it as orchestrator and workers.

The benefit is real but limited. Writing about its own research system, Anthropic reports that multiple agents suit tasks that parallelize well, involve more information than fits in a single context window, or require many complex tools. They are a poor fit when all agents need the same context or depend heavily on one another. Anthropic puts most coding tasks in that group.

Costs rise sharply. According to Anthropic, agents typically use about four times as many tokens as a chat, and multi-agent systems about fifteen times as many. On top of that, every handoff is a point where an error can travel on. The next agent treats a wrong intermediate result as fact.

A single agent with good tools is therefore usually the better place to start. Multiple agents pay off only once a single one demonstrably can no longer handle the task.

Every permission adds risk.

The biggest weakness of agents is prompt injection. A language model does not reliably tell its operator's instructions apart from text it reads along the way. If an email, a document or a web page contains a hidden instruction, the agent may follow it. Developer Simon Willison describes an especially dangerous combination he calls the “lethal trifecta”: access to private data, exposure to untrusted content and the ability to communicate externally. An agent that combines all three can leak data.

The second risk is permissions that are too broad. OWASP's list of the top ten risks for applications built on language models calls it “excessive agency”: an agent has more tools or permissions than its task requires. In December 2025, OWASP published a separate list for agentic applications, covering risks such as tool misuse, poisoned memory and failures that cascade across multiple agents.

Then come error chains and cost. One early misstep sends every following step in the wrong direction, and a loop without limits keeps running until someone stops it. The same measures help against all of this: least privilege, separate tools for reading and writing, a log of every call, hard limits on steps and spending, and an off switch.

When an agent makes sense, and what good looks like.

Two questions settle it. The first: is the process fixed in advance? Then a workflow or RPA, meaning automation by fixed rules, is enough. The second, if the steps are open: can the result be checked? Only then does an AI agent with limited permissions fit. If it cannot, decide how it will be checked before an agent starts.

In a press release dated June 25, 2025, Gartner predicted that over 40 percent of agentic AI projects will be canceled by the end of 2027, due to escalating costs, unclear business value or inadequate risk controls.

Good implementations share a few traits. The agent has a clearly scoped task and only the permissions that task needs. Consequential actions such as sending or deleting run only after a person confirms them; how to design that sign-off so it doesn't turn into a checkbox is covered on the AI automation page. The agent was tested in a sandboxed environment before going live. Every call is logged with its cost, and it is clear who maintains the agent and who shuts it down. Company-wide rules for permissions and access belong to AI governance.

Where the term stops working

An AI agent is not an autonomous employee: it acts only with the tools and permissions set up for it, and it can be wrong while sounding sure. It is distinct from a chatbot, which only answers; from a workflow, whose process is fixed in advance; and from RPA, which runs fixed click sequences by rules. How much leeway an automation gets and where a person signs off is decided by the company, not the agent.