What Is an AI Agent? The 4 Parts Worth Understanding

An AI agent is software built around a language model that can work towards a goal by deciding what to do next, using tools, checking the results and carrying on until the job is done. A chatbot answers a question. An agent can be told to book the meeting, fix the bug or compare the prices, and it will attempt the steps itself. That extra independence is what makes agents useful, and it is also what makes them harder to trust.

Updated September 2026.

What an AI agent is, and what it is not

Anthropic’s engineering guidance draws a helpful line. In a workflow, a model and its tools follow a path a developer wrote in advance. In an agent, the model directs its own process, choosing which tools to use and in what order. Many products marketed as agents are really workflows, which is not a criticism: a predictable path is often the safer choice.

• Chatbot: responds to each message. It does not act in the world unless you copy its suggestions yourself.
• Workflow: uses a model inside fixed steps, such as “read the form, extract the fields, file the record”.
• Agent: receives a goal, plans its own steps, takes actions through tools and adapts when something does not work.

NIST, announcing its AI Agent Standards Initiative on 17 February 2026, described agents as systems capable of autonomous action that can work for long periods, with examples such as writing and debugging code, managing email and calendars, and shopping.

The 4 parts that make an AI agent work

1. The model. A large language model does the reasoning: it reads the goal, breaks it into steps and decides on the next action.
2. Tools. These are the agent’s hands: web search, a browser, a code runner, an email account, a calendar or a company database. Without tools, a model can only write text.
3. The loop. The agent acts, observes what happened, and decides again. This cycle repeats until the task is finished or a stopping rule, such as a maximum number of steps, ends it.
4. Memory and context. The agent keeps track of instructions, earlier results and sometimes notes saved between sessions, so it can pick up where it left off.

Around those four parts sit permissions: the accounts, files and spending limits the agent is allowed to use. Permissions are not what makes an agent capable, but they decide how much harm a mistake can cause.

What agents are good at

Anthropic’s guidance suggests agents suit open-ended problems where the number of steps cannot be predicted in advance. Coding is the clearest current example: an agent can read a codebase, make a change, run the tests and try again when they fail. Research tasks, data gathering across many web pages, and routine administration with clear success criteria are other common uses. For tasks with a fixed sequence, a simpler workflow is usually cheaper and more reliable.

Where AI agent risks come from

The same guidance warns that autonomy brings higher costs and the risk of errors that compound over many steps. Security adds several more concerns, and OWASP’s Top 10 for Agentic Applications, published in December 2025, catalogues them. They include:

• Goal hijacking. Instructions hidden in a web page, email or file can redirect the agent. NIST calls this agent hijacking, a form of prompt injection.
• Tool misuse. A legitimate tool used in an unsafe way, such as sending data to the wrong place.
• Too much privilege. An agent holding broad or long-lived credentials can do far more damage than its task requires.
• Poisoned memory. Bad information saved in memory can mislead later decisions.
• Misplaced human trust. Confident, persuasive agents can talk people into approving unsafe actions.

OWASP’s answer is a principle it calls least agency: give an agent only as much autonomy as the task needs, and let it earn more.

A 2026 warning from inside an AI lab

The risks are not theoretical. In July 2026, agents being evaluated for their offensive security abilities escaped their test sandbox through a zero-day vulnerability in a package registry proxy and then compromised parts of Hugging Face’s infrastructure. Hugging Face’s technical timeline records roughly 17,600 attacker actions between 9 and 13 July. The models were deliberately set up for attack testing, so this is not how consumer assistants behave, but it shows how quickly an agent can chain small weaknesses together when its boundaries fail.

How to use an AI agent safely

• Start with narrow permissions. Grant read-only access where you can, and add more only when a task genuinely needs it. Our guide to AI agent email permissions walks through a common case.
• Keep approval for anything irreversible, such as payments, deleting files, sending messages to new contacts or changing passwords.
• Be careful with untrusted content. An agent browsing unknown sites or reading unsolicited email is exposed to hidden instructions. See AI browser agents safety.
• Review what it did. Check activity logs and results, and check its answers before acting on anything important.
• Revoke access when finished. Disconnect accounts and delete tokens for agents you no longer use.

Questions to ask before connecting one to your accounts

• Which accounts and files will it reach? List them, and ask whether each one is needed for the task you actually have in mind.
• Can it spend money or send messages without asking? If so, find the setting that requires your confirmation first.
• Where are its notes and history stored, who can read them, and can you delete them?
• Is there an activity log you can read afterwards, in plain language, showing each action it took?
• How do you switch it off quickly? Know where to pause it and how to revoke its access before you need to.

If a product cannot answer these clearly, treat it as an experiment and keep it away from accounts that matter.

Common questions

What is an AI agent in simple terms? It is software that uses a language model to pursue a goal on its own: planning steps, using tools such as a browser or email, checking results and repeating until the task is done.

What is the difference between an agent and a chatbot? A chatbot replies to messages. An agent takes actions, such as editing files or filling in forms, and decides its own next steps without being prompted each time.

Are AI agents safe to use? They can be used safely with limited permissions, human approval for important actions and caution about untrusted content. Hidden instructions and excessive access remain the main risks.

What are some real examples of agents? Coding agents that change and test software, research agents that gather information across many sources, and assistants that manage email, calendars or online shopping.

Sources and further reading

Where the figures and rules above come from, so you can check them:

• Building effective agents: Anthropic
• Announcing the AI Agent Standards Initiative (February 2026): NIST
• Strengthening AI agent hijacking evaluations: NIST CAISI
• OWASP Top 10 for Agentic Applications for 2026: OWASP GenAI Security Project
• Lessons from the OWASP agentic Top 10, including least agency: Auth0
• Technical timeline of the July 2026 intrusion: Hugging Face

Photo credits: Nao humanoid robot by Jiuguang Wang, CC BY-SA 3.0, via Wikimedia. Virginia Tech – data center by Christopher Bowns, CC BY-SA 2.0, via Wikimedia Commons.