“Agent” is one of the most used, and most stretched, words in AI right now. The idea is straightforward: an AI agent is a system that can pursue a goal over multiple steps, deciding what to do next and using tools to act, rather than producing a single reply.
From chatbot to agent
A chatbot takes a message and returns a message. An agent runs a loop instead. It starts from a goal, something like “Find three suppliers for this part and compare their prices,” and plans the steps needed. Then it acts by using a tool: searching the web, opening a page, running code, reading a file or filling in a form. It looks at the result, decides what to do next, and keeps going until the goal is met or it needs help.
The language model is the reasoning engine in the middle. Tools give it hands and eyes.
What tools agents use
- Web search and browsing to gather information
- Code execution to calculate, analyze data or transform files
- File access to read and write documents
- Application connections to email, calendars, CRMs or project trackers, often through standards such as the Model Context Protocol (MCP), an open standard Anthropic released in November 2024
- Computer use, where the agent operates a browser or desktop by looking at the screen and clicking and typing
Real examples
- Research features in ChatGPT, Claude and Gemini that search dozens of sources and write a report; OpenAI launched its deep research feature in February 2025
- Coding agents that edit a codebase and run tests, as covered in our coding assistants guide
- Browser agents that complete multi-step web tasks
- Business workflows that triage support tickets or reconcile records
Where agents fall short
Errors compound. A small mistake early in a long task can derail everything after it. Agents can also get stuck: they loop, misread a page or give up on an obstacle a person would handle easily. Sometimes they report success when the task is only partly done.
Security is the bigger worry. Agents that read web pages or emails can be targeted by prompt injection, where hidden instructions in content try to hijack the agent. It’s one of the most important unsolved problems in agent safety, and the OWASP Top 10 for applications built on language models ranks prompt injection as the number one risk, including indirect injections hidden in websites or files the model reads. Long tasks also take many model calls, which costs time and money.
Human in the loop The safest agent setups require approval before irreversible actions: sending messages, making purchases, deleting files or changing account settings. Treat an agent like a capable new assistant whose work you check before it goes out.
How to use agents well today
- Start with tasks whose results are easy to verify, such as research with citations or data cleanup you can spot-check.
- Give clear goals, constraints and a definition of done.
- Limit permissions to what the task needs.
- Review the log of what the agent did, not just the final summary.
Where this is heading
The reliability of agents on long tasks has been improving steadily. Research group METR found in 2025 that the length of tasks AI agents can complete with 50% reliability, measured by how long the tasks take human professionals, had been doubling roughly every seven months for six years. Agent features are also being built into browsers, operating systems and office software. As we noted in our 2026 trends piece, the key question this year is not whether agents can do impressive demos, but whether they can be trusted with everyday work. The answer, for now, is: often, with supervision.
Sources
- Introducing the Model Context Protocol, Anthropic, November 2024
- Introducing deep research, OpenAI, February 2025
- LLM01:2025 Prompt Injection, OWASP Gen AI Security Project
- Measuring AI Ability to Complete Long Tasks, METR, March 2025
Related reading: how AI browser assistants work.
