What are AI agents and how do they carry out tasks

When you chat with an artificial intelligence assistant, the exchange is usually simple: you ask, it answers. An AI agent works differently. You hand over a goal, and the system decides on its own which steps to take, consults sources, runs programs and checks whether it got where it needed to go.

This difference seems small, but it changes the kind of risk involved. A wrong piece of text you read and discard. A wrong action (an email sent, a file deleted, an order canceled) may already have happened by the time you notice. That is why it is worth understanding the mechanism before delegating any task.

What an AI agent is

There is no single official definition, but the companies developing these systems largely converge. OpenAI’s practical guide to agents sums it up this way: agents are systems that independently accomplish tasks on the user’s behalf. The same guide adds a useful caveat: applications that use a language model but do not let it control workflow execution, such as simple chatbots or sentiment classifiers, are not agents.

Anthropic, in the December 2024 engineering post Building effective agents, draws a similar line. It separates two types of system:

• Workflow: the model and tools follow paths defined in advance, in code. The programmer decides the order of the steps.
• Agent: the model itself decides the steps and which tools to use, keeping control over how it accomplishes the task.

At the center of it all is a large language model (LLM), the type of model that generates text from patterns learned from large volumes of data. To review this concept, see what are LLMs.

The three parts of an agent

According to OpenAI’s guide, an agent in its most basic form has three components:

1. Model: the LLM that reasons and makes decisions.
2. Tools: external functions or APIs the agent uses to take action. An API (application programming interface) is the door through which one program talks to another.
3. Instructions: explicit guidelines and guardrails that define how the agent should behave.

Anthropic describes the same idea under another name: the “augmented LLM,” a model enhanced with retrieval, tools and memory. Retrieval is what lets it consult documents (the subject of our article on RAG). Memory is discussed in context and memory in AI.

How the model “uses” a tool

Here is the point that causes the most confusion: the language model does not execute actions directly. It only produces text. What changes is that this text can be a structured request to call a tool.

OpenAI’s function calling documentation describes the cycle in five steps:

1. The application sends the model the list of available tools, with name, description and parameters.
2. The model responds with a call request: which tool to use and with which arguments.
3. The application executes the corresponding code.
4. The application returns the result to the model in a new request.
5. The model gives the final answer or requests another call.

The documentation is explicit: your application executes the function, not the model. Anthropic’s tool use documentation describes the same back-and-forth and adds a distinction. Some tools run in your application (client tools) and some run on the provider’s infrastructure, such as web search (server tools).

A hypothetical example helps. Imagine a customer service agent with access to a “lookup_order” tool. You ask where your package is. The model does not know the answer, so it returns something like: call “lookup_order” with number 12345. The store’s system runs the lookup, gets “in transit, expected Friday” and hands that to the model, which writes the answer for you.

The think, act and observe cycle

A single tool call does not yet make an agent. What characterizes an agent is repetition: it acts, observes the result and decides the next step based on what it saw.

An important academic reference for this pattern is the ReAct paper, posted on arXiv in October 2022 by Shunyu Yao and co-authors and later presented at the ICLR conference. The name comes from reasoning and acting. The proposal is to have the model alternate stretches of reasoning with concrete actions, such as querying a simple Wikipedia API.

According to the authors, interleaving reasoning with external lookups reduced the hallucination and error propagation problems that appeared when the model only reasoned, without checking facts. In two interactive decision-making environments, ALFWorld and WebShop, ReAct outperformed imitation and reinforcement learning methods by absolute success rate gains of 34 and 10 percentage points, using only one or two examples in the prompt.

In practice, the cycle looks like this, for a task such as “find supplier X’s September invoice and summarize the amounts”:

1. Think: I need to locate the invoice; I’ll search the email.
2. Act: calls the email search tool.
3. Observe: found three messages; one has a PDF attached.
4. Think: the PDF looks like the invoice; I’ll open it.
5. Act and observe again, until it has the summary.

Anthropic recommends that the agent obtain “ground truth” from the environment at each step, such as the actual result of a tool or of executed code, rather than assuming what happened. It also recommends stopping conditions, such as a maximum number of iterations, so the agent does not loop indefinitely.

When an agent makes sense

An agent is not the default solution for everything. Anthropic recommends starting with the simplest possible solution and only increasing complexity when needed. In many cases, the post says, a single well-prepared call to the model, with document retrieval and examples, is enough.

OpenAI’s guide points to three situations where agents tend to add value:

• Complex decisions, with exceptions and context-dependent judgment, such as approving a refund.
• Rules that are hard to maintain, when a rules system has grown too large and fragile.
• Unstructured data, such as interpreting documents or conversing in natural language.

If your case does not clearly fit these, the guide itself suggests that a deterministic solution, that is, an ordinary program with fixed rules, may be enough.

Risks and limits you need to know

Compounding errors

Each step an agent takes depends on the previous one. Anthropic warns that autonomy brings higher cost and the risk of compounding errors: a mistake early on contaminates everything that follows. An answer invented by the model, what is called an AI hallucination, stops being just wrong text and becomes the basis for an action.

Cost and response time

Agentic systems often trade latency and cost for better performance, according to Anthropic. There is a mechanical reason for this. Anthropic’s documentation states that tool definitions, call requests and returned results all count toward the tokens of each request, and each turn of the cycle is a new request. To understand the billing unit, see tokens in AI models.

Prompt injection

This is the most discussed security risk. Prompt injection happens when malicious instructions reach the model mixed in with the content it is processing. In the indirect case, the attacker does not even talk to the agent: they plant the instructions on a web page, in an email or in a document the agent will read.

The 2023 paper by Greshake and co-authors demonstrated this type of attack against real applications. The authors argue that these applications blur the line between data and instructions, and they list impacts such as data theft.

In November 2025, Anthropic published a post about agents that browse the web with a concrete example: an email with white text, invisible to the reader, telling the agent to forward confidential messages to an external address. The company states that “no browser agent is immune” and that a 1% rate of successful attacks, while an improvement, still represents meaningful risk.

Irreversible actions

OpenAI’s guide recommends planning for human intervention in two cases: when the agent exceeds a threshold of failures or retries, and when the action is sensitive, irreversible or high-impact. The examples given are canceling orders, authorizing large refunds and making payments.

How to use agents more safely

The recommendations below combine what the cited sources say with the editorial team’s assessment:

• Grant the minimum access necessary. In the editorial team’s assessment, an agent that only needs to read a calendar should not have permission to send emails.
• Require confirmation for high-risk actions, such as payments, deletions and sends, as OpenAI’s guide suggests.
• Test in a sandboxed environment before granting access to real systems, as Anthropic recommends.
• Set limits on steps and spending, to stop cycles that do not converge.
• Treat all external content as untrusted: pages, attachments and messages can contain hidden instructions.
• Check the outcome, not just the agent’s report. Look at what actually changed in the system. For checking criteria, read how to evaluate AI responses.
• Write clear, well-bounded instructions. Techniques for this are in prompt engineering.

Key takeaways

An AI agent is a language model placed in a loop: it decides on a step, requests a tool execution, observes the result and repeats. This autonomy makes it possible to automate tasks that fixed rules do not handle well.

The price is greater exposure. Errors compound, each turn of the loop costs tokens, and any content the agent reads may try to hijack it. Use agents where the flexibility pays off, start simple and keep a person in control of actions that cannot be undone.