What is an AI agent? A definition without the marketing
An AI agent is software that plans and executes multi-step tasks on its own: model, tools, memory, and an action loop. How it differs from a chatbot and from automation, what it's good for, and which risks to control from day one.
Definition
An AI agent is a software system that pursues a goal across many steps without supervision of each one: a language model plans, calls tools (APIs, a browser, a database), observes results, and corrects course. What separates it from a chatbot is the ability to act — an agent doesn't just answer questions, it performs tasks in real systems.
Definitions of AI agents are usually written by marketing departments. This one is written from the perspective of a team that has to keep an agent running in production — action loop, costs, and risk included.
An AI agent is a software system that pursues an assigned goal across many steps without supervision of each one: a language model plans, calls tools, observes results, and corrects course until the task is done or needs a human. A chatbot answers; an agent acts — and that one word changes everything about how it should be deployed.
How does an AI agent work?
Every agent — regardless of framework — consists of four components and one loop:
- The model (the brain). A large language model handles goal understanding, planning, and decisions. It knows nothing about your company beyond what lands in its context — which is why context engineering is a craft, not a detail.
- Tools. APIs, search, a database, a file editor, a browser. They are what turn the model’s text into real actions — and they define the maximum blast radius.
- Memory. Short-term (the current task’s context) and long-term (notes and knowledge across sessions). Memory architecture determines whether an agent learns from mistakes or entrenches them.
- Instructions and policies. The system prompt, rules, permission limits. This is the only layer you control completely.
The action loop is simple: goal → plan → tool action → observe the result → revise the plan — repeated until done. An agent’s autonomy is nothing mystical: it is the number of loop iterations you allow it to run without asking you for approval.
How does an AI agent differ from a chatbot and from automation?
| Dimension | Chatbot | Automation (RPA, scripts) | AI agent |
|---|---|---|---|
| Input | a user’s question | an event or a schedule | a goal to achieve |
| Execution | a single answer | a rigid sequence of steps | a plan built on the fly |
| Unexpected situations | not applicable | halt or error | attempts to work around the problem |
| Changes system state | no | yes, within a known scope | yes, within granted permissions |
| Main risk | a wrong answer | brittle rigidity | confident, wrong action |
Rigid automation breaks when the world deviates from the script. That is exactly when an agent is most useful — and most dangerous, because it improvises with real permissions. Choosing between a single agent and a multi-agent system is only the second question; the first is whether the task requires improvisation at all.
What do companies use AI agents for?
The pattern across mature deployments is clear: agents first get reading tasks, then drafting tasks, and only then acting tasks:
- Ticket handling — triage, gathering complete information, drafting a response; a human approves.
- Research and synthesis — reviewing sources, comparing offers, internal reports.
- IT and data operations — alert diagnostics, record cleanup, regression testing.
- Back office — invoices, payment reconciliation, document preparation.
The common denominator: tasks that are repetitive, multi-step, and verifiable. Where the output cannot be verified cheaply, an agent is often still more expensive than the human it was meant to replace.
Where do agents fail?
An honest definition requires this section. Three failure modes recur in production:
- Non-determinism. Same goal, two runs, two different outcomes. Without regression testing and production metrics you won’t even know quality has dropped.
- Error cascades. A mistake in step 2 becomes a “fact” by step 7. The longer the loop, the more expensive the error — and token costs grow with every iteration.
- Susceptibility to manipulation. Agents read external content, and content can carry instructions. Indirect prompt injection is today’s primary attack vector against agentic systems.
Which risks must be controlled from day one?
One principle governs everything: the damage from an agent’s mistake is bounded by what the agent can do, not by how rarely it errs. In practice that means least-privilege tools instead of faith in the model’s judgment (excessive agency is the most common deployment sin), human oversight over irreversible actions, and a kill switch before you need one. The full threat map is organized by the OWASP Top 10 for agentic systems, and the regulatory obligations by the EU AI Act timeline for agents.
Where to start?
- Pick one process — painful, measurable, with a limited blast radius.
- Write the rules down — a one-page AI policy: access, approvals, accountability.
- Start at the lowest autonomy and expand it gradually, based on metrics, not impressions.
- Measure from day one — quality, cost, human interventions.
An AI agent is not a “smarter chatbot” but a new class of software: non-deterministic, action-taking, and demanding its own operational discipline — the one this site is about. The terms used here are defined in the glossary.
Frequently asked questions
How is an AI agent different from ChatGPT?
ChatGPT in its basic form is a conversational interface: it receives a question, returns an answer, and its involvement ends there. An AI agent uses the same kind of language model, but inside an action loop: it receives a goal, breaks it into steps, calls tools — a search engine, your company's APIs, a file editor — checks the results, and decides what to do next. The difference is practical, not academic: you can ignore a chat answer, but an agent's action changes the state of a real system — it sends the email, modifies the record, places the order. That is why deploying an agent is not 'plugging in a chat'; it is a decision about which permissions you hand to software and under whose oversight. The boundary is blurring, too: agent modes are appearing inside chat products, so the real question is not 'chat or agent' but how much autonomy you grant and how you control it.
Can an AI agent operate entirely without human oversight?
Technically yes, and that is precisely the problem. A language model is non-deterministic and fallible, and an agent converts its mistakes into real actions. Mature practice graduates autonomy: a new agent starts read-only or with human approval before every consequential action, and earns each additional degree of freedom only when metrics show it performs at the current level. Full automation without checkpoints can be justified for cheap, reversible actions; for irreversible or costly ones, human oversight remains the rule — and oversight requirements are appearing in regulation, with the AI Act mandating effective human oversight for high-risk systems. So the honest answer is: it can, but mature teams deliberately choose where to allow it.
Where should a company start with AI agents?
With one process that hurts, has a clear success criterion, and a limited blast radius — for example ticket triage, market research, or drafting responses. Before the agent gets access to anything, write a short AI policy: what it may do, what it may access, who approves its output. Then run it at the lowest autonomy level and measure quality, cost, and human interventions from day one. Expand permissions based on data, not enthusiasm. The most common deployment mistake is the reverse order: broad access and a spectacular demo first, then a search for ways to control it — by which point cost and risk grow faster than value.
Are AI agents covered by the EU AI Act?
Yes — the AI Act never uses the word 'agent', but its definition of an AI system covers systems operating with varying levels of autonomy, so agents fall squarely within it. Which obligations you carry depends on the use case: an agent in recruitment or credit scoring is a candidate for a high-risk system with the full package of requirements, while an agent drafting emails faces at most transparency obligations. For companies deploying agents, three things matter in practice: knowing which processes touch high-risk areas, meeting disclosure obligations wherever the agent talks to people or generates content, and maintaining human oversight plus event logs that let you demonstrate control over the system.