AI agents: definition, how they work, and practical examples

An AI agent is a software system that can pursue a goal by choosing actions, using tools, and adjusting its next steps based on the results. It might search for information, prepare a report, or modify files within the access permissions it has been given. Its autonomy has boundaries: it guarantees neither an accurate result nor a sound decision at every step.

What the term AI agent means

In applications built around a language model, the model interprets the request and proposes the actions needed to carry it out. The surrounding software manages tools, permissions, exchanges, and stopping conditions. The agent is this whole system, rather than the model alone.

The term nevertheless covers different architectures. Some products mainly follow predefined steps; others let the model choose much of the path. In Building effective agents, Anthropic distinguishes workflows, whose sequence is organized by code, from agents, where the model dynamically directs the process and the use of tools.

An agent does not have to change a system to be useful. Searching documents, identifying missing information, and starting another search already form a sequence of actions. Conversely, a program that automatically sends a message at a set time is not necessarily an agent: a simple rule can explain its behavior.

To assess a product, look at what it actually allows: which tools are available, who chooses the steps, which actions require approval, and how execution stops. The AI agent profiles let you examine these characteristics for individual products.

How an agent’s loop works

An agent operates through a loop: receive a task, choose an action, observe the result, and decide what to do next. The ReAct research paper, initially published on October 6, 2022, explores this interaction between reasoning and actions that obtain external information.

Consider a hypothetical task: preparing a summary of incidents reported in a folder of meeting records. The agent first identifies the available documents. It reads them, identifies the incidents, and may then search for passages that help distinguish resolved issues from those still open.

Each result shapes the next step. An unreadable document might lead the agent to request another copy; an ambiguous date should trigger a check rather than a guess. The path therefore depends on the information encountered during the task.

A properly controlled loop allows for several outcomes:

• The goal is reached and the result is presented.
• Information is missing and the agent asks for clarification.
• An action requires authorization.
• A time, spending, or execution limit requires the agent to stop.
• An error makes it impossible to continue under acceptable conditions.

Stopping is part of the expected behavior. An agent that keeps trying indefinitely is not more autonomous in any useful sense. It may simply repeat an ineffective strategy, increasing costs without improving the result.

The components that make actions possible

Instructions define the goal and constraints. They specify permitted sources, the expected output, prohibited actions, and situations that must be referred to a person. A broad instruction such as improve customer management leaves too many decisions unstated for an initial deployment.

Tools provide access to the environment. A tool call is a structured request that the software processes: search for a file, look up an order, or create a draft. The model proposes the call; the application checks and executes the operation according to its rules.

The Model Context Protocol, or MCP, standardizes connections between AI applications and external systems. It can expose data and functions to an agent. The protocol does not replace the connected service’s permissions or checks on requested actions.

The task state holds the information needed to carry out the work: documents already reviewed, responses received, operations completed, and unresolved points. Persistent memory can supplement this state, but it is not required for a one-time assignment.

Controls surround the whole system: authentication, access restrictions, parameter validation, and logging. An instruction never to delete files is insufficient if the tool freely allows deletion. When a restriction is essential, the software or execution environment must enforce it too.

When an agent is useful

An agent becomes useful when a task requires several operations whose order depends on the information encountered. If the path is known in advance, conventional automation deserves consideration first. If you only need an explanation or a rewrite, a conversation may be enough.

Criterion	Conversational assistant	Fixed-rule automation	AI agent
Expected output	An answer or generated content	A predefined process	A result reached through an adaptable process
Choice of steps	Mainly guided by your messages	Defined in the program	Partly delegated to the model
Handling the unexpected	You continue the conversation	A branch must be planned	The agent can choose another action
Useful checks	Verify claims	Test rules and exceptions	Review decisions and their effects
Suitable use	Explain a document	Move documents according to a stable rule	Review a case with a varying set of documents

These categories can coexist within the same product. A chat interface can launch an agent, while a workflow can assign an agent a specific step. The label on the screen therefore tells you less than the system’s actual behavior.

AI agent or chatbot: what’s the difference? examines this distinction in more detail. For your own task, start by defining the expected result and possible exceptions. That makes it easier to determine whether an adaptable loop offers a measurable benefit.

Practical example: fixing a problem in code

Claude Code illustrates the category of coding agents. Its official documentation describes capabilities including reading a project, modifying files, and running commands. These documented capabilities support a potential cycle of diagnosis, correction, and verification.

In a hypothetical scenario, an application displays an incorrect total after a discount is applied. The agent could examine the calculation, find where the relevant function is used, propose a fix, and run the available tests. If a test fails, that result becomes new information for the next stage of diagnosis.

The deliverable should go beyond a claim that the problem is solved. It should include the proposed changes, the checks performed, and any limitations encountered. If a test could not be run, that must be stated clearly.

This example also shows why permissions matter. Allowing changes to a working copy does not imply permission to release the software. Commands can also install dependencies, contact services, or modify data: their effects sometimes extend beyond the files you intended to fix.

Human review therefore needs to cover both the change and the available evidence. Passing tests provides useful information, but does not by itself prove the absence of errors. The scope of testing needs to match the behavior you want to protect.

Practical example: handling an administrative request

n8n lets you build processes that combine models, tools, and automated steps. Its AI Agent node documentation describes an agent connected to a chat model and tools, which it selects according to the task.

Imagine a small business receiving a request for a copy of an invoice. An agent configured for this purpose could look up the reference in the business management software, check the available identifying information, and prepare a reply. If several records match, it should refer the case to a person or ask for clarification.

This is an illustrative scenario, not an observed customer result. Implementing it requires suitable connections, usable data, and explicit access rules. The agent cannot retrieve an invoice from a service that none of its tools can access.

One useful division of responsibilities is to let the model interpret the request while leaving mandatory checks to the program. The authorized recipient, documents that may be shared, and conditions for sending them can then be checked independently of the generated text.

To examine differences between platforms, see the automation platform comparison. The choice depends partly on the integrations you need and the controls available. This guide explains their shared principle without ranking the products against each other.

Practical example: researching documents

An agent can also work without permission to write to business systems. Its task is then to gather information, check its provenance, and prepare a deliverable. Its autonomy concerns the research process, while decisions remain with the user.

In a hypothetical scenario, you ask it to identify maintenance requirements for several pieces of equipment using the supplied manuals. The agent finds relevant passages, records the prescribed operations, and flags missing manuals. It then prepares a table in which each row points to the document and passage used.

The value of the result depends on traceability. You should be able to connect a recommendation to a source, an equipment reference, and, where necessary, a document date. Conflicting instructions in different manuals must remain visible as a disagreement to resolve.

Fabricated information is not the only risk. The agent might consult documentation for a similar device, mistake an option for a requirement, or overlook a qualification mentioned elsewhere. Fluent writing can conceal these errors.

To define the assignment, require accessible evidence and a list of unknowns. You can also restrict the search to a specific document collection before allowing web access. Success then becomes verifiable: each item in the deliverable corresponds to an identified source, and missing information is not replaced with assumptions.

Memory and autonomy need boundaries

An agent’s memory can refer to several mechanisms: conversation history, saved notes, preferences, or searches across stored documents. These mechanisms differ in both what they contain and how long that information lasts.

Retaining information does not mean the model learns permanently through additional training. The software may simply retrieve a note and add it to the context of a later task. This distinction helps explain what the agent can reuse and what it might forget.

Memory can also carry an error forward. A misunderstood preference or an outdated saved procedure can influence future actions. Before enabling memory, check how you can inspect, correct, and delete retained information. The article on AI agent memory explains these mechanisms in detail.

Autonomy also has several dimensions. An agent might choose its searches freely while still requiring approval before making any changes. It might be allowed to create a draft but not send it, or prepare a change without publishing it.

Granting more permissions does not automatically improve the work. For each task, identify the necessary access and establish a clear procedure for uncertainty. The ability to hand work over to a person is often a condition of reliability, rather than a limitation to eliminate.

What an agentic task actually costs

The cost goes beyond the advertised subscription. Depending on the architecture, it includes model calls, external tools, hosting, and the time spent on configuration, monitoring, and corrections. Software available for free may rely on services billed separately.

With usage-based pricing, a single request can trigger several model calls. Instructions, conversation history, and tool results all contribute to these exchanges. Context and cache management can change the amount billed, so you need to examine the terms of the service you use.

A task that is quick to describe is therefore not necessarily quick to execute. Finding a document in poorly organized folders can require more operations than a longer but well-structured process. Retries after a failure also count toward the total.

The model pricing calculator helps estimate the portion attributable to exchanges with the model. To assess the economic benefit, add the other expenses and the human time actually involved.

The useful measure is cost per completed and verified task. Compare that with the time needed to do the same work using your current method. If verification requires repeating the entire task yourself, a low execution price is not enough to make the agent worthwhile.

Risks to understand before connecting your accounts

An agent’s mistake can have a concrete consequence: a message sent to the wrong recipient, an overwritten file, or a change applied to the wrong case. The risk depends as much on tools and permissions as on the model’s capabilities.

Prompt injection adds another difficulty: content the agent reads may attempt to redirect the system’s behavior. OWASP describes these indirect injections in external sources such as websites and files. Their impact depends partly on which actions the application can perform.

For example, a document might instruct the agent to send data to an external address. That request must remain content to examine, without becoming authorization to act. Instructions to exercise caution help define the expected behavior, but technical restrictions must support them.

Reduce the potential consequences of an error through read-only access where sufficient, dedicated accounts, restricted folders, and blocks on sensitive actions. When asking for approval to send something, show the recipient, content, and attachments. A generic confirmation request without those details gives the user little basis for a decision.

The guide to securing an AI agent develops these measures further. Before connecting any account, also identify which data is sent to the services involved, where results are stored, and how to revoke access.

Start with a limited, verifiable task

Your first use should produce an observable result with consequences that are easy to contain. Preparing a summary with sources or producing a draft lets you examine how the agent works before authorizing consequential actions. The guide to getting started with an AI agent helps you put this into practice.

Describe the assignment with a specific goal, permitted data, expected deliverable, and stopping conditions. Explain how missing information should be handled too. A request for clarification is preferable to a decision based on an unstated assumption.

Then evaluate the result in ordinary situations and under exceptions: a missing document, an ambiguous match, an unavailable service, or a conflicting instruction in a source. Observe what the agent does when it cannot succeed, because that behavior matters as much as its successes.

Use verified results and observed errors to decide when to expand its scope. Add a capability once its usefulness and controls are established, then reassess the system as a whole.

Key takeaways

• An AI agent pursues a goal by choosing actions and using their results.
• Its usefulness depends on the task, available tools, and controls governing execution.
• A convincing response does not replace accessible evidence or verification of the result.
• Relevant costs include failures, corrections, and human time.
• Limited autonomy, with explicit stopping rules, is a reasonable starting point.

Frequently asked questions

Do you need to know how to code to use an AI agent?

Some agents work with plain-language instructions and connections configured through an interface. Coding becomes useful when you need custom tools or precise control over safeguards. Even without writing code, you still need to understand the access you grant and know how to check the results.

Can an AI agent work without an internet connection?

Yes, if the model, tools, and required data are available on your computer. Tasks that require online information or access to a remote service need a connection. Installing an interface locally does not mean all processing stays on your machine.

What is the difference between an AI agent and artificial general intelligence?

The term agent describes how a system is organized to take actions. It does not establish a general ability to learn or solve unfamiliar problems. A program can have many tools and still struggle outside the tasks it was configured to handle.

Can you leave an AI agent running overnight?

That depends on its permissions, execution limits, and the possible consequences of an error. Before running it unattended, set up an automatic stop, accessible logs, and a recovery procedure. Actions with significant consequences should remain blocked until an appropriate approval is given.