An AI agent is software that carries out a task for you instead of only answering a question. You give it a goal, such as "handle this return", and it works out the steps itself: it looks up the order, checks the returns policy, creates a return label and drafts a reply to the customer. It uses your own systems and stops to ask you when something is unclear.
How does an agent differ from a chatbot?
A chatbot answers one message at a time (see chatbot vs AI agent). Anthropic defines an agent as an AI model that directs its own process and tool use, deciding for itself how to achieve what the user wants instead of following a fixed script (Trustworthy agents in practice, April 2026). The word is older than language models. In AI research an intelligent agent is anything that perceives its environment and acts on it to reach a goal; in Russell and Norvig's textbook even a thermostat counts. An AI agent in the sense used here has a large language model at its core, so you can instruct it in plain language.
What is an agent made of?
The April 2026 article names four parts, each of which is also a place to keep control:
- The model: the language model that does the reasoning.
- The harness: the instructions and guardrails the model works under, such as a rule to flag anything over a hundred dollars or never to submit expenses without the user's confirmation.
- The tools: services it may use, such as email, calendar or accounting software. Without tools it can read a receipt but not file it.
- The environment: where it runs, and which files, websites and systems it can reach.
Earlier descriptions put planning, memory and tool use around the model, as Lilian Weng did in June 2023, or use profile, memory, planning and action modules, as in the survey by Wang et al. (2023).
How does it work?
Anthropic's Building effective agents (December 2024) describes the loop. The task starts with a command or a conversation with the user. Once it is clear, the agent plans and acts on its own: it calls a tool through function calling or the Model Context Protocol (MCP), reads the result as "ground truth" from its environment, and decides the next step. It can pause for human feedback at checkpoints or when it gets stuck. The task ends when it is done or when a stopping condition applies, such as a maximum number of steps.
Where does it go wrong?
- Costs rise and errors can compound. Anthropic names both as the price of autonomy and advises extensive testing in a sandbox, with guardrails.
- It misreads what you want. With less human oversight there is more room for actions with unintended consequences. Anthropic trains its models to ask when unsure; on complex tasks, Claude checks in about twice as often as on simple ones.
- Prompt injection: instructions hidden in an email or web page that the agent reads.
One safeguard is a permission per action. In Claude's apps a user can set each action to always allowed, needs approval or blocked, for example reading the calendar freely but approving each invitation (human-in-the-loop).
Example
Suppose a webshop lets an agent handle returns. The model reads the customer's email. The harness says that refunds above €100 need approval from a staff member. The tools are the order system, the returns portal and email. The environment is a server that can reach those three systems and nothing else. A customer writes that a jacket is too small. The agent looks up the order, checks the return period in the policy, creates a label and drafts the reply. The refund is €120, so it waits for a staff member to approve it.