What is AI Agent?

The plain definition

An ordinary language model call maps text to text. An agent adds two things: tools — functions the model can invoke, such as querying a database, calling an API, or running code — and a loop that feeds each tool's result back in so the model can decide what to do next.

That structure is what turns a text generator into something that can accomplish multi-step work: look up the order, check the policy, compute the refund, issue it, and report back. The model supplies the decision-making; the tools supply the capability and the contact with reality.

What determines whether it works

Agent reliability is mostly a function of tool design, not model choice. Tools want clear names, precise descriptions, tight parameter schemas, and error messages written to be read by a model — 'order_id must be 8 digits, received 6' is actionable, 'invalid input' is not. Narrow, well-specified tools produce dramatically better behaviour than a small number of powerful, ambiguous ones.

The dominant failure mode is compounding error. If each step is 95% reliable, a twenty-step task succeeds about a third of the time. This arithmetic is why ambitious open-ended agents disappoint and why constrained ones succeed: fewer steps, verifiable intermediate results, and a deterministic workflow wherever the sequence is actually known in advance. If you know the order of operations, encode it in code and use the model for the judgement inside each step — do not ask the model to rediscover the plan on every run.

Related traps include loops where the agent retries the same failing action indefinitely, and unbounded cost when a long context meets a retry loop. Both are solved with hard limits: maximum iterations, maximum spend, and a timeout.

Autonomy is a security decision

The moment an agent can take actions, its blast radius becomes a design question rather than an afterthought. Two properties compound dangerously: agents read untrusted content, and agents act. A malicious instruction embedded in a document, web page, or email the agent reads can redirect its behaviour — indirect prompt injection — and if the agent holds credentials for a payments API or a production database, that is a serious exposure.

Practical containment. Give each agent the narrowest possible credentials, scoped per user where relevant. Separate read tools from write tools and require confirmation for anything irreversible — refunds, deletions, external messages. Enforce permissions at the tool boundary in your own code, never by instructing the model to behave; a prompt is not an access control mechanism. Log every tool call with its arguments so behaviour is auditable after the fact.

The honest current position: agents are genuinely useful for bounded tasks with reversible actions and a human in the loop for consequential decisions. Fully autonomous agents operating unsupervised on important systems remain ahead of what reliability and security allow. Scope accordingly, and let the demonstrated reliability of a narrow agent earn it more autonomy over time.