What Is an AI Agent, and How Does It Actually Work?

An AI agent is a system built around a large language model that can plan a multi-step task, call outside tools or software to act on the world, check the results, and keep going until the job is done, largely without a human approving every step. That is the practical difference from a chatbot: a chatbot answers a question, while an agent tries to finish a task. The label covers everything from a browser extension that fills out a form on your behalf to an enterprise system that files support tickets, and "agentic AI" is simply the broader industry name for software built this way.

What is an AI agent, in plain terms?

Strip away the marketing and an AI agent is a fairly specific piece of engineering: a language model wrapped in a loop that lets it take actions, look at what happened, and decide what to do next. Wikipedia's long-standing definition of an intelligent agent already captures the shape of it — an entity that "perceives its environment, takes actions autonomously to achieve goals, and may improve its performance by acquiring knowledge." Classical examples of that pattern go back decades, from thermostats to game-playing programs. What changed in the last few years is the "brain" in the middle: instead of hand-coded rules, an LLM now reads the situation in natural language and decides what to do.

That's also how the field's own builders describe it. In Anthropic's engineering guide to building effective agents, the company draws a specific line between two kinds of LLM-based systems: workflows, where "LLMs and tools are orchestrated through predefined code paths," and agents, where "LLMs dynamically direct their own processes and tool usage, maintaining control over how they accomplish tasks." A workflow is a flowchart with an AI model plugged into a few boxes. An agent decides, turn by turn, which box to go to next — including whether to stop.

Put another way: if you ask a system to "book me the cheapest flight to Chicago next Friday" and it replies with search results for you to click through, that's a well-equipped chatbot. If it opens a booking site, searches, compares a few options against your stated budget, and comes back having actually reserved the flight (or asking you to approve the charge first), that's an agent.

AI agent vs. chatbot: what's actually different

People searching for "AI agents explained" are usually trying to figure out why this is described as a different category from ChatGPT- or Claude-style chat. The honest answer is that the underlying model is often the same — the difference is the scaffolding around it. Three things separate an agent from a plain chatbot:

• Tool use. A chatbot's only output is text. An agent can call functions: search the web, run code, query a database, click buttons in a browser, send an email. Anthropic's open Model Context Protocol exists specifically to standardize how a model connects to those outside tools and data sources, so an agent isn't limited to whatever was baked into its training data.
• Planning and iteration. A chatbot generates one response per turn. An agent breaks a goal into steps, executes one, evaluates the outcome, and revises the plan — sometimes dozens of times — before it considers the task finished.
• Memory across the task. An agent needs to track what it has already tried, what worked, and what the user actually asked for, across a session that might run for minutes or hours rather than a single exchange.

None of this requires a fundamentally different model — it's the harness (the code that lets the model see tool results and decide what to do next) that turns a conversational model into an agent. That's also why the same underlying assistants people already compare for chat, such as the ones in our rundown of ChatGPT, Claude, and Gemini plans, are now shipping agent modes as an added layer on top of the same chat product.

Inside the loop: plan, act, observe, repeat

Nearly every agent framework, regardless of vendor, describes the same basic cycle. Anthropic's engineering guide lays it out plainly: an agent "gains 'ground truth' from the environment at each step (such as tool call results or code execution)" and uses that feedback to decide whether to continue, adjust, or stop. In practice, the loop looks like this:

1. Input: the user states a goal — "reconcile this spreadsheet," "find and book a hotel under $200," "fix this failing test."
2. Plan: the model breaks the goal into a rough sequence of steps.
3. Act: it calls a tool — a search, a code execution, a click, an API request.
4. Observe: it reads the result of that action back in.
5. Reassess: it decides whether the goal is met, whether to retry, or whether to change approach.
6. Repeat or stop: the loop continues until the task is done, a limit is hit, or the agent hands control back to a person.

That last step is where the safety conversation lives. A well-built agent doesn't run forever unsupervised; it's built with stopping conditions, spending or step limits, and — for anything consequential, like sending money or a message — a checkpoint where it asks a human to approve before proceeding.

AI agent vs. agentic AI: the terminology, settled

This is one of the most-searched framings, and the distinction is smaller than it sounds. As Wikipedia's entry on agentic AI puts it, there is "no universally agreed-upon definition," but the working distinction used across the industry is:

In short: you'd say "I used an AI agent to draft the report," but "our platform is built on agentic AI" — one is a noun for a specific tool, the other describes the underlying approach. Wikipedia's list of what separates agentic systems from traditional software is useful shorthand: "goal-directed behavior, use of external tools, the ability to interact with and modify an external environment, and the ability to autonomously perform multi-step tasks."

Real AI agents shipping right now

The concept can feel abstract until you see what's actually live. A few concrete, currently available examples:

A specific and common subcategory is the coding agent — a system that reads a codebase, writes and tests changes, and iterates until the tests pass. If that's the angle you're interested in, our comparison of Cursor, GitHub Copilot, Claude Code, and Codex pricing covers that specific product category in depth.

How developers actually build one

Under the hood, most agents are assembled from the same handful of parts, and the major AI labs now each publish their own version of the recipe. Anthropic's guidance is deliberately minimalist: "start with direct LLM APIs," since "many patterns are achievable with a few lines of code," and add orchestration frameworks only once a simpler approach falls short. OpenAI's public documentation for its agent-building tools describes a similar stack of building blocks — tool/function calling, reusable "skills," state and conversation memory, and either a fully hosted orchestration layer or a lower-level API for building an agent from scratch.

The piece that ties an agent to the outside world is its tool layer. That's the specific gap the Model Context Protocol was built to close — Anthropic describes it as "an open standard that enables developers to build secure, two-way connections between their data sources and AI-powered tools," replacing one-off custom integrations with a single protocol that any compliant agent can speak. In practice, that means an agent built by one company can plug into a pre-built connector for Slack, GitHub, or Google Drive rather than every developer writing that integration from scratch.

For anyone who wants to run models locally rather than through a hosted agent product, our step-by-step guide to running AI models locally with Ollama covers the groundwork most self-hosted agent setups are built on.

The catch: safety, guardrails, and prompt injection

Handing a model the ability to click, type, and spend is a meaningfully bigger trust decision than letting it draft an email you'll review before sending. The specific risk vendors flag most often is prompt injection — hidden instructions embedded in a webpage or document that try to hijack an agent mid-task. Anthropic's own announcement of Claude in Chrome's general release is explicit about treating this as an active threat rather than a solved problem, describing layered safeguards including a real-time safety classifier that checks each action against the user's original request before it executes.

The practical guardrails that responsible agent products converge on look similar across vendors: scoping what data and accounts an agent can touch, requiring explicit approval before high-stakes actions like payments or sending messages, logging every action so it can be audited, and giving the user an easy way to interrupt or shut the agent down mid-task. If you're evaluating an agent product for yourself or a team, checking whether these controls exist — and whether they're on by default — is a reasonable first filter.

How to try an AI agent yourself

You don't need to write code to get a feel for this. The lowest-friction ways in for a normal reader:

• Turn on an agent mode inside an assistant you already use. Chat apps from the major labs increasingly ship an opt-in "agent" or "extended" mode alongside the regular chat interface — start with something low-stakes, like research or drafting, before letting it take actions on accounts that matter.
• Install a browser-based agent extension for a specific task, such as filling out repetitive web forms, and review what it's about to do before approving the action if the tool offers that option.
• Try a coding agent if you write any code at all — this is currently the category with the clearest, most measurable feedback loop (tests pass or they don't), which is a large part of why Anthropic's own guidance points to coding as one of the tasks agents suit best.

Start with a task you could verify yourself in under a minute. Agents are still capable of confidently getting something wrong, and the fastest way to build a sense of what to trust them with is watching one work on something small before handing over anything with real stakes attached.

What's next for AI agents

The trend across every major lab right now is the same: move agent capability out of standalone research demos and into the products people already use daily — a chat app, a browser, an IDE — rather than a separate destination. Expect the terminology to keep settling ("agent" for the product, "agentic AI" for the approach) even as the underlying engineering keeps changing quickly. The parts worth watching are less about raw model capability and more about trust infrastructure: how much an agent can do before it needs a human's sign-off, how well it resists having its instructions hijacked, and how clearly it shows its work — since that, more than any benchmark, will decide how much of daily digital life people actually hand over to one.

Written byTheo Park

Theo Park runs the AI desk at Pandromeda. He follows model launches from the frontier labs and the open-weight community, tracks the assistants and developer tools built on them, and explains what each release changes on pricing, capability and safety. His reporting leans on primary sources: model cards, technical reports, API documentation and the companies' own announcements.

More from Theo ParkAll AI coverage