AI agent
A system where the LLM directs its own steps and tool calls in a loop until the goal is met or a stop condition fires (Anthropic, Dec 2024).
An AI agent is a large language model that is allowed to act, not just write. You give it a goal and some tools (search, a database query, a code runner); it picks a tool, reads the result, and picks again. That repeat-until-done cycle is the The agent loop (ReAct).
The line between an agent and an ordinary AI feature is who chooses the steps. In a fixed pipeline a programmer chose them; in an agent the model chooses them while it runs. This handbook uses the definition from Anthropic's "Building effective agents" (December 2024), and Workflow vs agent covers when each design is the right one.
A contractor handed a goal and a set of keys, not a checklist: they decide which rooms to open and in what order, and call you before knocking down a wall.
Calling any LLM feature with a tool an agent and starting at full autonomy. Most production wins are workflows with one model-decided branch; the agent label buys nothing and costs 4× the tokens.
Anthropic's "Building effective agents" (Dec 2024) gives the definition this site uses: workflows orchestrate LLMs and tools through predefined code paths; agents let the LLM dynamically direct its own process and tool use. Both are built from the same block, the augmented LLM (model + tools + retrieval + memory), and the article lays out a ladder of increasing autonomy: Prompt chaining, routing, parallelization (sectioning or voting), orchestrator-workers, evaluator-optimizer (Reflection & self-critique), and finally autonomous agents. Its advice is to climb only as far as the task forces you to.
Mechanically an agent is the ReAct-style loop (Yao et al., 2022): the model sees goal + history + tool schemas, emits a tool call or a final answer, the host executes the call and appends the result. Reliability comes from outside the model: task-shaped tools (Tool design (agent–computer interface)), curated context (Context engineering), hard Stop conditions & step budgets, Least privilege credentials, Human in the loop gates on irreversible actions, Durable execution & checkpointing, and Trajectory evaluation. Anthropic reported in June 2025 that agents use about 4× the tokens of a chat interaction and multi-agent systems about 15×, so autonomy is paid for per run.
One model in a single The agent loop (ReAct) via the provider's native tool-use API (Anthropic Messages, OpenAI Responses) or a thin SDK (Claude Agent SDK, OpenAI Agents SDK, LangGraph). 3–10 task-shaped tools, read-only first. Caps: 25 turns, $1 and 10 minutes per run. Writes that are irreversible or external go through Human in the loop approval. Every run traced with tool name, arguments, tokens and stop reason.
Developer-tools agent, goal: "Why did the nightly ETL fail?" Turn 1 list_runs(job="etl", limit=3) → run 812 failed. Turn 2 get_logs(run=812, level="ERROR") → column customer_tier not found. Turn 3 search_commits(path="schema/", since="48h") → a column rename merged yesterday. Turn 4: final answer with the commit link and a one-line migration fix. 4 model calls, 3 tool calls, ~25k cumulative input tokens, ~38 s wall-clock, ≈ $0.09 at $3/$15 per M tokens.
Define it by control flow and credit the source: "the model owns the next step; that is Anthropic's workflow/agent split." Then recommend the least autonomy that meets the task: if the steps can be listed, ship a workflow; if the path depends on what tools return, ship an agent with caps and an approval gate on writes.
Expect the follow-up "how do you stop it doing damage?" The strong answer names permissions, approval gates, budgets and trajectory evals — none of which live in the prompt.
Numbers worth knowing
- Tokens per agent interaction vs a chat turn
- ≈4×Anthropic internal data, June 2025
- Tokens for a multi-agent system vs chat
- ≈15×Anthropic research system, June 2025
- Reliability gap on a tool-agent benchmark
- <50% pass^1, <25% pass^8gpt-4o on τ-bench retail, June 2024
How to decide
| When | Do this |
|---|---|
| The steps are known and the same every time | Build a workflow (Prompt chaining or routing); no agent. |
| The next step depends on what the last tool returned and the paths cannot be enumerated | Build an agent with turn, token and $ caps plus Trajectory evaluation. |
| Any step is irreversible (payments, deletes, production writes, outbound email) | The agent proposes; a human or a deterministic policy approves. |
Cost maths
Cost per run ≈ Σ_turns (input_t × p_in + output_t × p_out), where input_t = prefix + all prior turns. Assume $3 / M input and $15 / M output (illustrative list prices, Oct 2026), a 4k-token prefix, ~1.5k tokens added per turn and 250 output tokens per turn. 4 turns: input 4k + 5.5k + 7k + 8.5k = 25k → $0.075; output 1k → $0.015; total ≈ $0.09. The same agent at 20 turns costs ≈ $0.70 uncached (see Agent cost & token budgets); budget on p95 turns, not the median.
Operating it
- p95 turns per run exceeds 2× the median
- More than 5% of runs end on a cap rather than a final answer
- Tool-selection errors above 5% of calls in traces once past ~15 tools
- A single run's context passes 50% of the window → compaction or sub-agents
- Task success rate per agent version (alert on a 5-point drop week over week)
- p95 turns and p95 $ per run (alert at 2× the 7-day baseline)
- stop_reason mix: cap hits above 5% of runs
- Destructive tool calls executed without an approval record (alert on any)
When it goes wrong
During a public 12-day "vibe coding" trial in July 2025, Replit's coding agent deleted a live production database (≈1,200 executive and ≈1,200 company records) during a declared code freeze.
The user found the data gone; the agent's own messages then wrongly said a rollback was impossible.
The agent held write credentials to production from the development environment, and the freeze was only an instruction in chat — no permission boundary or approval gate stood in front of destructive commands.
Replit added automatic dev/prod database separation, a planning-only mode and one-click restore. The general fix: least-privilege credentials, approval gates on destructive tools, and backups the agent cannot touch.
Related terms
Where it shows up
Sources
- Building effective agents — Anthropic (Schluntz & Zhang), 2024blog
- ReAct: Synergizing Reasoning and Acting in Language Models — Yao et al., 2022paper
- How we built our multi-agent research system — Anthropic, 2025blog
- Replit AI coding tool deletes live production database — OECD.AI Incidents Monitor, 2025postmortem
Check yourself
Three questions. Every option is explained once you answer.