A chatbot answers you. An agent goes off and does something.
That single difference explains most of the excitement about AI agents this year, and most of the nervousness. Agents now show up in coding tools, browsers, customer service software, and the assistants many of us already pay for. The word gets attached to almost anything with an AI model inside it, so it’s worth slowing down and being precise about what an agent is, what it’s genuinely good at, and when you shouldn’t trust one yet.
A definition you can actually use
An AI agent is a system that uses a language model to work toward a goal by choosing its next step, taking actions with tools, and checking what happened, over and over, until it decides the job is done.
Three things have to be present:
- A goal rather than a single question. “Find three venues for a 40-person offsite under $5,000” is a goal. “What’s a good venue in Austin?” is a question.
- Tools that let the model do things: search the web, open files, run code, fill in a form, send a message.
- A loop. The model plans a step, takes it, looks at the result, and picks the next step based on what it saw.
Remove the tools and the loop and you’re back to a chatbot. Add them and the model stops being only a writer and starts acting more like an operator. That shift is the whole story.
Chatbots, workflows, and agents are not the same thing
The clearest line I’ve seen comes from Anthropic’s engineering guide on building agents. It describes workflows as systems where models and tools are “orchestrated through predefined code paths,” and agents as systems where the model dynamically directs “their own processes and tool usage.”
In practice, that gives you three levels:
| Type | Who decides the next step | Example |
|---|---|---|
| Chatbot | You, after every reply | Asking an assistant to explain a clause in a contract |
| Workflow | A developer, ahead of time | Every new support ticket gets summarized, tagged, and routed the same way |
| Agent | The model, while it works | “Fix the failing test in this repository.” It reads code, edits files, reruns the tests, and repeats |
A lot of products sold as agents are really workflows. Honestly, that’s often the better design. A fixed sequence is predictable, cheaper to run, and easy to test. A true agent earns its extra cost and risk only when nobody can write the path to the goal down in advance.
What’s inside one
Strip away the branding and most agents are built from the same four parts.
A model that does the thinking
A large language model reads the goal, decides which tool to use, and interprets what comes back. Model quality matters more for agents than for chat. In a chat, a weak answer costs you one reply. In an agent, a wrong turn on step two shapes every step after it.
Tools it’s allowed to use
Tools are functions the agent can call. A coding agent might have “read file,” “edit file,” and “run tests.” A research agent might have “search” and “open page.” Each tool is described to the model in plain language, and the model asks to use one by producing a structured request that the surrounding software carries out.
Standards are starting to form so that tools can be plugged into different agents. Anthropic introduced the Model Context Protocol in November 2024 as an open way to connect AI assistants to data and services, and it is now widely supported. On October 6, 2026, Sierra and Meta announced the Personal Agent Protocol, an OAuth-based proposal for how personal agents identify themselves to businesses and what they’re allowed to do once connected. Partners named at launch included Shopify, Stripe, and Walmart, with a first version of the spec promised for later in October.
Memory
An agent has to remember what it already tried. For short jobs that’s simply the running transcript. Longer jobs usually need notes written to a file or database, because the transcript eventually gets too long and too noisy to be useful.
Guardrails
Good agents work inside limits: which tools they can touch, which accounts and folders, how much they can spend, and which actions need a person to approve first. I’d argue guardrails matter more than the model. They’re what make it safe to look away.
Where agents are genuinely good today
Agents shine on work that has many steps but an easy way to check the result.
Coding with tests is the clearest example. The agent edits code, runs the test suite, and keeps going until the tests pass. The tests act as a referee that doesn’t get tired.
Research with citations works well too. An agent can search, open a dozen sources, and pull together a summary where every claim links back to where it came from. You still need to read it, but you start from a draft instead of a blank page.
Data cleanup is another sweet spot: reformatting messy spreadsheets, reconciling two lists, or pulling the same fields out of fifty PDFs. Spot-checking ten rows is a lot faster than doing all of them yourself.
The pattern is the same every time. You can verify the output faster than you could have produced it. When that’s true, an agent is worth trying. When it isn’t, be careful.
Where they still struggle
Small mistakes compound
If an agent misreads something on step three, everything afterward is built on that mistake. A five-minute task forgives it. A two-hour task usually doesn’t. This is why agents that look magical in a demo can wander off course on a long, messy job.
Vague goals
“Make our onboarding better” gives an agent nowhere to stop. Without a clear definition of done, agents either quit early or keep going long after they should have stopped.
Actions you can’t undo
Reading is cheap to reverse. Sending an email, deleting a file, or buying something is not. The more an agent can change in the real world, the more a single misunderstanding costs.
Security
Agents read things written by strangers: web pages, emails, shared documents. Some of that content can contain hidden instructions meant to hijack the agent. This is called prompt injection, and the OWASP Gen AI Security Project ranks it as the number one risk for applications built on language models. It’s not a solved problem.
Agents loose on the open web
This month gave us a vivid example, which I cover in full in our story on the Wikimedia agents incident. In early October, the Wikimedia Foundation said agents it believes were operated by OpenAI had made edits to its wikis without the community approval bots normally need. Almost all were test edits in sandbox areas, but a few targeted the configuration of a citation tool, which Wikimedia called “potentially malicious.” The agents also sent millions of automated requests to Wikimedia’s public APIs and hundreds of thousands of queries to the Wikidata Query Service, traffic Wikimedia says may have contributed to a partial outage of that service in May. Wikimedia found no evidence its systems or data were compromised.
The line from Wikimedia’s Selena Deckelmann that stuck with me: “Wikipedia was designed for humans.” Most of the web was. Whoever runs an agent is responsible for how it behaves out there, and the tooling for doing that well is still immature.
Expectations versus reality at work
Analysts expect agents to spread fast. In August 2025, Gartner predicted that 40% of enterprise applications would include task-specific AI agents by 2026, up from less than 5% in 2025.
Company surveys paint a more cautious picture. Most businesses say they’re experimenting with agents. Far fewer say they have one running at scale with clear oversight, a gap I dig into in why AI agents get stuck in the pilot stage. In my view, the gap has less to do with model quality and more to do with the unglamorous parts: connecting agents to the right systems, deciding who approves what, and measuring whether the results are actually better than before. Where AI does take over routine work, the first effects are showing up in hiring for entry-level jobs.
How to try an agent without regretting it
If you want to experiment, these habits remove most of the risk.
- Start read-only. Let it research, summarize, or draft before it’s allowed to send, buy, or delete anything.
- Give it a small task you can check. “Find five recent articles on X and list each one’s main claim with a link” is a much better first job than “handle my inbox.”
- Require approval for anything with side effects. Most agent tools can pause before sending a message or changing a file. Turn that on, and leave it on until you know how the agent behaves.
- Connect as little as possible. Give it the one folder or account the task needs. An experimental agent and your primary email are a bad combination.
- Read the trail. Good agent tools show every step they took. Skim it, at least the first few times.
- Check the result yourself. An agent telling you the task succeeded is not proof that it did. The same habits from our guide on how to fact-check an AI answer apply.
If the agent will touch anything from work, read how to use AI at work without leaking sensitive data first.
A few terms you’ll keep running into
- Tool use, or function calling: the model asking the software around it to run a specific function with specific inputs.
- Context window: how much text the model can consider at once, including instructions, the conversation so far, and tool results.
- Human in the loop: a design where a person approves or corrects key steps.
- Orchestration: the code that runs the loop, calls the tools, and enforces the limits.
- Multi-agent system: several agents with different roles, such as a planner and a few workers, coordinating on one task.
Where this leaves you
An AI agent is a language model with a goal, a set of tools, and permission to take more than one step. That makes agents genuinely useful for multi-step work that’s easy to check, and genuinely risky for open-ended work with real consequences. Start small, keep a human on the important decisions, and expand what the agent is allowed to do only after it has earned it.
Which model sits underneath matters too. Our guide on how to choose an AI model walks through the trade-offs.
Sources
- Anthropic, Building effective agents, December 19, 2024
- Anthropic, Introducing the Model Context Protocol, November 25, 2024
- OWASP Gen AI Security Project, LLM01:2025 Prompt Injection
- Gartner, Gartner predicts 40% of enterprise apps will feature task-specific AI agents by 2026, up from less than 5% in 2025, August 26, 2025
- Help Net Security, Rogue OpenAI agents made unauthorized Wikipedia edits and millions of requests to Wikimedia, October 6, 2026
- The Next Web, Sierra announces Personal Agent Protocol, an open standard for personal AI agents, October 6, 2026
