An AI agent is a system built around a model that pursues a goal over several steps by deciding which actions to take, usually by calling tools such as search, APIs, browsers, databases or a code interpreter, and observing the results. The difference from a chatbot is that its outputs change things in the world, not only text on a screen.
How an agent loop works
Most current agents follow a loop popularised by ReAct (Yao et al., 2022): the model reads the goal and context, writes a reasoning step, emits a tool call, receives the tool's output, and repeats until it produces a final answer or hits a step limit. In reinforcement learning terms, the context is the state, each tool call is an action, and the agent's behaviour is a policy. That framing is literal when agents are trained with RL on multi-step tasks.
Worked example
Goal: "Find last quarter's three largest unpaid invoices and email the account owners a reminder." A typical run: query the billing database, sort and filter results, look up each account owner in the CRM, draft three emails, call the send-email tool three times, report back. That is roughly eight tool calls. If each step independently succeeds with probability 0.95, the whole task succeeds with probability . Reliability compounds over steps, which is why agent evaluation looks at the whole trajectory.
Risks specific to agents
- Indirect prompt injection: any page, email or file the agent reads can carry instructions.
- Excessive agency: permissions broader than the task needs turn a manipulated model into a damaging one.
- Compounding errors: an early wrong assumption propagates through later actions.
- Irreversibility: deleted files and sent payments cannot be regenerated like a bad answer.
Common controls are least-privilege tool scopes, tool-call policies enforced outside the model, sandboxes, and human approval for high-impact steps.
Why it matters
Agents move AI risk from "the model said something wrong" to "the system did something wrong". Testing them requires environments with real or simulated tools, success criteria on outcomes and side effects, and adversarial content planted in what the agent reads. Protocols such as the Model Context Protocol make it easier to give agents many tools, which raises the stakes of getting these controls right.
Related terms
- Agent trajectory
- Excessive agency
- Tool-call policy
- Indirect prompt injection
- Model Context Protocol (MCP)
- Human-in-the-loop
Sources
- Shunyu Yao, Jeffrey Zhao, Dian Yu, Nan Du, Izhak Shafran, Karthik Narasimhan, Yuan Cao. ReAct: Synergizing Reasoning and Acting in Language Models, 2022. arxiv.org