An AI agent is a software system that pursues a goal by repeatedly observing, deciding and acting through tools, then using the results to decide again. In current practice, the decision-making core is usually a large language model, and the actions are tool calls such as searching, querying a database, running code or sending a request to another application.
The idea is older than language models. Classic artificial intelligence defines an agent as anything that perceives through sensors and acts through actuators, from a thermostat to a chess program. What is new is that LLM-based AI agents can interpret open-ended instructions and choose their own sequence of actions instead of following a fixed script.
How an AI agent works
An AI agent runs in a loop often called the agent loop: observe, reason, act and observe again. The loop continues until the goal is met, a stop condition is reached or a human intervenes.
In each cycle, the model receives the goal, the conversation so far and the results of earlier actions. It then either produces a final answer or emits a structured tool call, which the surrounding software executes and feeds back as a new observation. The model never acts on the world directly; the runtime executes every action, which is where permissions and safeguards belong.
The table lists the components that most agent architectures share.
| Component | Role | Typical implementation |
|---|---|---|
| Model | Interprets the goal, plans and chooses actions | Large language model with tool-calling support |
| Tools | Let the agent read and change external systems | Function definitions, APIs, MCP servers, code sandbox |
| Memory | Keeps relevant state across steps and sessions | Context window, summaries, vector store, files |
| Orchestrator | Runs the loop, executes tools, enforces limits | Agent framework or custom control code |
| Guardrails | Block unsafe or unauthorized actions | Permission rules, approval steps, output validation |
Levels of autonomy in AI agents
AI agents span a range of autonomy, and more autonomy is not automatically better. The right level depends on how predictable the task is and how costly a mistake would be.
| Level | Who decides the steps | Typical example | Risk profile |
|---|---|---|---|
| LLM workflow | Developer defines a fixed sequence | Classify a ticket, then draft a reply | Low and predictable |
| Router | Model picks one of several predefined paths | Send a request to billing or technical support | Low to moderate |
| Tool-using agent | Model chooses tools and order within limits | Research a question across several sources | Moderate |
| Supervised autonomous agent | Model plans multi-step work, humans approve key actions | Fix a software bug and open a pull request | Moderate to high |
| Multi-agent system | Several agents coordinate or delegate | Planner agent assigns subtasks to specialist agents | High, harder to debug |
A widely shared engineering recommendation is to use the simplest level that solves the task. Many problems marketed as agentic are handled more reliably by a well-designed workflow with one or two model calls.
AI agents compared with related systems
The term AI agent is often used loosely. The defining feature is goal-directed action in a loop with real tools, which separates an agent from systems that only converse or only follow scripts.
| System | Acts on external systems | Chooses its own steps | Typical scope |
|---|---|---|---|
| Chatbot | No, it answers in text | No | Single conversation turn |
| Robotic process automation | Yes, through scripted interfaces | No, rules are fixed | Repetitive structured tasks |
| AI agent | Yes, through tool calls | Yes, within permissions | Multi-step goal |
| Agentic AI | Yes, often across many tools | Yes, with planning and reflection | Broader design approach |
Agentic AI describes the broader paradigm and its properties, while an AI agent is a concrete system built under that paradigm. A multi-agent system is a composition of several agents rather than a different kind of agent.
Designing a reliable AI agent
Agent reliability comes mostly from engineering around the model, not from the model alone. Practices that consistently improve results include:
- Few, well-described tools with clear names, typed parameters and informative error messages.
- Explicit stop conditions: a maximum number of steps, a time limit and a token or cost budget.
- Human approval for irreversible actions such as payments, deletions or external messages.
- Least-privilege access: each tool gets only the permissions the task requires, ideally in a sandbox.
- Full tracing of every model call, tool call and result, so failures can be diagnosed.
- Task-level evaluation that measures end-to-end success rate on realistic scenarios, not single answers.
Standard interfaces such as the Model Context Protocol (MCP) make it easier to connect an agent to many tools, but they do not decide which tools an agent should be trusted with. That remains a security and design decision.
Risks and failure modes
The central technical risk is error compounding across steps. If each step succeeds independently with 95 percent probability, a 20-step task succeeds end to end only about 36 percent of the time, because 0.95 raised to the 20th power is roughly 0.36. Real errors are not fully independent, but the arithmetic explains why long autonomous runs need checkpoints.
| Failure | Typical cause | Mitigation |
|---|---|---|
| Endless loops | Agent retries the same failing action | Step limits, loop detection |
| Wrong tool arguments | Ambiguous tool descriptions or schemas | Typed schemas, validation, examples |
| Prompt injection | Malicious instructions inside web pages or files | Treat tool output as data, restrict actions |
| False success reports | Model claims completion without verification | Programmatic checks of the final state |
| Runaway cost | Many long model calls in one task | Budgets, caching, smaller models for subtasks |
Accountability also stays with people: an agent acts on behalf of its operator, so organizations should define who owns its actions before granting it access to production systems.
In simple terms
An AI agent is like a capable assistant who is given a goal rather than a single question. It works out the steps, uses the tools it has been given, such as search, a spreadsheet or an email draft, checks what happened and keeps going until the job is done.
The more freedom it gets, the more useful it can be, but also the more damage a mistake can cause. That is why well-built agents ask a person before doing anything that cannot be undone.
A practical example
The finance team of a logistics company processes about 2,500 supplier invoices per month. Clerks previously opened each PDF, looked up the purchase order and delivery note in the accounting system and checked prices and quantities by hand.
The company deploys an AI agent with three read-only tools, for documents, purchase orders and delivery records, plus one tool that creates a draft payment proposal. For each invoice, the agent extracts the line items, retrieves the matching order and delivery, compares amounts within a set tolerance and either drafts the proposal or writes a short note explaining the discrepancy. The agent has no permission to release payments; a clerk approves every proposal in the accounting system.
After two months, about three quarters of invoices arrive at the clerk already matched and documented, and clerks spend their time on the remaining exceptions. Because every step is logged, auditors can trace each decision back to the source documents.