An AI agent is a program you give a goal instead of a list of instructions. It works out the steps, uses tools to carry them out, looks at what happened and keeps going until the job is done or it needs your help. That loop of planning, acting and checking is what separates an agent from a chatbot that answers one message at a time.
What counts as an AI agent
The idea is older than chatbots. Stuart Russell and Peter Norvig's textbook Artificial Intelligence: A Modern Approach, first published in 1995, defines an agent as "anything that perceives its environment through sensors and acts upon that environment through actuators." A thermostat fits that definition, and so does a self-driving car.
When software companies say "AI agent" today, they usually mean something narrower: a large language model (LLM) that can call tools and choose its own next step. Anthropic's engineering team drew a useful line in a post on December 19, 2024. In a workflow, developers fix the path in code and the model fills in steps along it. In an agent, "LLMs dynamically direct their own processes and tool usage, maintaining control over how they accomplish tasks."
Plenty of products sold as agents are workflows by that definition. For a predictable job, a workflow is often the better design, because it is cheaper and easier to test.
How an AI agent works
Most agents run the same cycle:
- You give it a goal, such as "Find the head of marketing at each of these 20 companies and draft a first email to each."
- The model plans a first step and picks a tool, for example a web search.
- The tool runs and returns a result, such as a page of search results.
- The model reads the result, updates its plan and picks the next tool.
- The cycle repeats until the model decides the goal is met, reaches a limit you set, or stops to ask you a question.
Steps 3 and 4 make the difference. A plain chatbot writes its answer from what it already knows. An agent can look something up, try an action, see that it failed and try another way.
Anthropic calls the basic building block an "augmented LLM": a model that has been given retrieval, tools and memory. Developers also set stopping conditions, such as a maximum number of steps, so that a confused agent does not loop for an hour and run up a bill.
The parts of an agent
Whatever a product calls them, an agent has five parts:
- A model that reads, plans and writes. This is usually an LLM from OpenAI, Anthropic or Google, or an open-source model.
- Instructions: the goal, the rules and the tone, written by you, the vendor or both.
- Tools the model is allowed to call, such as web search, a browser, a code sandbox, or actions in your apps like "create a CRM contact" or "post in Slack."
- Memory, which can be as small as the current conversation or as large as a database of your documents and past tasks.
- Guardrails: step limits, spending limits, approval prompts and a log of everything the agent did.
Kinds of AI agents you can use now
The textbook sorts agents into five types by how they decide: simple reflex agents, model-based reflex agents, goal-based agents, utility-based agents and learning agents. That scheme still helps in a computer science class. As a buyer, you are more likely to meet agents grouped by where they do their work.
Assistant agents live inside a chat app and operate a computer or browser to finish a task. Anthropic released computer use in public beta on October 22, 2024, letting Claude look at a screen, move a cursor, click buttons and type. Anthropic described the feature at launch as experimental and error-prone, and it struggled with actions such as scrolling and dragging. OpenAI released ChatGPT agent in July 2025; it works on its own virtual computer.
Automation agents live inside workflow tools. Zapier Agents, for example, can act across the 9,000+ apps Zapier connects to, with templates for jobs such as preparing a briefing before a meeting or qualifying leads that arrive through a form.
Coding agents read a codebase, write changes and run the tests. More than 60,000 open-source projects and agent frameworks use AGENTS.md, a file format OpenAI started for giving coding agents project instructions, according to the Linux Foundation.
Support agents answer customer questions from your help articles and pass the harder cases to a person.
How agents connect to your apps
An agent can only work with the tools it can reach. Until recently, every connection between an AI product and another app had to be built separately. Anthropic released the Model Context Protocol (MCP) on November 25, 2024 as an open standard for connecting AI assistants to data and tools. An app builds one MCP server, and any AI product that supports MCP can use it.
On December 9, 2025, the Linux Foundation launched the Agentic AI Foundation with three founding projects: MCP, OpenAI's AGENTS.md and Block's goose agent framework. Its launch announcement counted more than 10,000 published MCP servers and named Claude, ChatGPT, Microsoft Copilot, Gemini, Cursor and VS Code among the products that support the protocol. A second standard, Agent2Agent (A2A), was first developed by Google and is now also run under the Linux Foundation. A2A covers agents handing work to other agents, while MCP connects an agent to its tools.
When you compare agent products, ask which of your apps each one can reach, and whether it reaches them through MCP, a native integration or a browser it clicks around in. Native integrations and MCP are usually more reliable than screen clicking.
What agents do well today
Agents earn their keep on jobs that have many small steps, a clear finish and a low cost when something goes wrong:
- researching a list of companies or prospects and filling in a spreadsheet
- sorting incoming support tickets or emails and drafting replies for a person to send
- pulling figures from several reports into one weekly summary
- fixing small bugs and writing tests in a codebase
- watching for an event, such as a new form entry, and doing the follow-up admin
In each of these you can check the output quickly and undo a mistake.
Where agents still go wrong
Errors compound. If an agent misreads something at step two, every later step builds on the mistake. Anthropic's guidance says the autonomy of agents brings "higher costs, and the potential for compounding errors," and recommends extensive testing in sandboxed environments with guardrails.
Long tasks are less reliable than short ones. In METR's March 2025 study, frontier models succeeded almost every time on tasks that take a person under four minutes, and less than 10% of the time on tasks that take a person more than about four hours. Models have improved a lot since then, and the length of task they can finish keeps growing, but the odds of a slip still rise with every extra step.
Agents can be tricked. OWASP ranks prompt injection first (LLM01:2025) in its Top 10 for LLM applications. It happens when text the agent reads, such as a web page, an email or a file, contains instructions that change what the agent does. An agent that can read your inbox and also send email is the risky combination. OWASP's advice is to give the model the least access it needs and to require human approval for privileged actions.
Costs add up. Each turn of the loop is another model call, so an agent that takes 40 steps to finish a job costs many times more than a single chatbot answer.
How to try an agent safely
- Pick one repetitive task you already do by hand and can check in a few minutes.
- Start with read-only access. Let the agent search, read and draft, but not send, pay or delete.
- Require your approval for anything that leaves your account, such as an email, a payment or a change to customer records.
- Run it on ten real examples and compare its work with what you would have done.
- Read the activity log. If the product does not show you what the agent did, do not give it more access.
- Set a spending cap with the vendor before you scale up.
Our guide to the top AI agent platforms compares tools for building and running agents, and the future of AI agents looks at where the technology is heading next.
