Ask a chatbot to plan a trip and it hands you a list. Ask an AI agent and it may try to book the flights. The writing is not what separates the two. The agent is connected to tools, such as a search engine, a calendar or a payment system, and it is allowed to use them without a person approving each step.
What counts as an agent?
The term is used loosely, so a definition helps. Anthropic’s engineering team, in a widely read guide to building agents, draws a line inside what it calls agentic systems. In a workflow, language models and tools follow code paths that a developer has fixed in advance. In an agent, the model “dynamically” directs its own process and tool use. Most agents, Anthropic says, are “typically just LLMs using tools based on environmental feedback in a loop.”
That loop is the core idea. The model reads the goal, picks an action, receives the result and decides what to do next. It keeps going until it judges the job finished or a limit stops it.
What happens inside the loop
Take a request such as “find out why last night’s report failed.” A coding agent might open a log file, notice an error, search the codebase for the failing function, edit it, run the tests and read the output. Each tool call returns real information, and Anthropic stresses that agents need this kind of “ground truth” from the environment at every step to judge whether they are making progress.
Well-built agents also have brakes. The same guide describes pausing for human feedback at checkpoints and setting stopping conditions, such as a maximum number of iterations, “to maintain control.”
When an agent is the wrong tool
Agents are more expensive than they look, and the guide is blunt about it. Because they are autonomous, “agentic systems often trade latency and cost for better task performance,” and they bring “the potential for compounding errors.” Its advice is to find the simplest solution that works. For many problems, a single model call with the right documents attached is enough, which is the idea behind retrieval-augmented generation. Agents earn their place on open-ended problems where nobody can predict the number of steps in advance.
Where agents go wrong
Errors behave differently once a model can act. A chatbot’s mistake sits on the screen, waiting for a reader to catch it. An agent’s mistake can become a deleted file or a sent email. A false statement of the kind described in our piece on why chatbots make things up turns into the premise for the next step, and a long chain of steps gives small misreadings time to grow.
The security problem unique to agents
Agents read content they did not write: web pages, emails, documents, tool output. The US National Institute of Standards and Technology (NIST) calls the resulting attack agent hijacking, a form of indirect prompt injection. An attacker plants instructions in data the agent is likely to read, and the agent may follow them. NIST’s AI-security researchers explain why this works: current agents typically merge the developer’s instructions and the task data into a single input, so malicious text can look like any other email or web page.
The UK’s National Cyber Security Centre goes further. In a blog post titled “Prompt injection is not SQL injection (it may be worse),” it argued that large language models do not enforce a security boundary between instructions and data, and that prompt injection may therefore never be fully mitigated the way SQL injection largely can be. The practical lesson is to assume an injection will sometimes succeed and to limit what a hijacked agent could do.
What a sensible deployment looks like
Anthropic’s guidance and the security agencies’ warnings point the same way:
- Give the agent only the access the task needs, so a hijacked agent has little to abuse.
- Require a person to approve anything irreversible, such as payments, deletions or messages to customers.
- Keep a log of every action so mistakes can be traced and undone.
- Test in a sandbox before connecting real accounts. Anthropic’s guide recommends extensive sandbox testing and says human review remains crucial.
None of this makes agents unusable. It does mean the question worth asking about any agent product is not how smart the model is, but what the agent is allowed to touch and who checks its work.
