What is an AI agent, really?

You type: “Move my Thursday dentist appointment to any morning next week when I'm free.” A chatbot replies with friendly instructions for calling the surgery. An agent opens your calendar, sees you are busy Monday and Wednesday mornings, checks the surgery's booking system, finds 9:30 on Tuesday, asks you to confirm, books it, cancels Thursday, and tells you it is done.

Both are built on the same kind of language model. The difference is not intelligence. It is that the second one is allowed to take actions, look at what happened, and decide what to do next on its own. That is what the word agent should mean, and most of what gets labelled an agent does not meet it.

A language model can only produce text. To read a calendar it needs hands, and in AI systems those hands are tools: specific abilities a developer hands over, like “read calendar”, “search appointment slots” or “book slot”. The model cannot run a tool itself. It writes a request (“please run search-slots for next week, mornings”), ordinary software runs it, and the result is handed back. That arrangement is tool use.

This split is the most important safety fact about agents. The model only ever asks. A program written by people decides whether to carry out the request, and that gap is where every rule and check lives.

What makes it an agent rather than a single tool call is repetition. It goes round a cycle until the job is done:

In the dentist example the loop runs about five times: read calendar, search slots, (wait for your yes), book, cancel. Crucially, nobody wrote that sequence in advance. If Tuesday had been full, the agent would have searched again for Friday. This cycle is called the agent loop; researchers described the pattern of alternating reasoning and actions as ReAct in 2022.

Many useful AI products are not agents, and that is usually a good thing. If the steps are known in advance (“summarise each new support ticket, then tag it”), a fixed sequence written by a developer, a workflow, is cheaper, faster and far easier to trust. Anthropic's widely cited guide Building effective agents (2024) draws the line exactly there: workflows follow predefined code paths, while agents direct their own process and tool use. It also gives the advice most teams learn the hard way: use the simplest pattern that works, and reach for an agent only when the steps genuinely cannot be known ahead of time. The full trade-off has its own page: workflow versus agent.

In July 2025 a widely reported incident saw an AI coding agent on the Replit platform delete a user's production database during a declared code freeze, then describe what it had done. It was pursuing the task it had been given. It was also holding permissions it should never have had, with no one asked to approve a destructive step.

Agents fail in a few predictable ways: they misread a result, repeat a failing step, or take an action that cannot be undone. Every pass round the loop also costs time and money. So a well-built agent has guardrails, and the common ones are easy to picture:

• A step budget. Stop after, say, 10 rounds and report, even if unfinished. These are stop conditions; they turn a runaway loop into a visible, bounded failure.
• Only the tools the job needs. The dentist agent can read your calendar and book slots; it cannot email your contacts. That is least privilege.
• A person approves anything irreversible. Searching is free; booking, paying, deleting or sending waits for a human click. That is human in the loop.
• A fenced-off workspace. Agents that run code or browse the web work inside a sandbox, where a mistake cannot reach real systems.

• Who chooses the next step: the model, or a script someone wrote in advance?
• Can it act through tools, or only talk?
• What stops it: a step budget, an approval, a narrow set of tools?

“The model chooses, it acts through tools, and here is exactly what limits it” describes an agent in the meaningful sense. If the answer to the first question is “a script”, it is a workflow, and that is often the better product.