“Agent” is one of the most used, and most stretched, words in AI right now. At its core the idea is straightforward: an AI agent is a system that can pursue a goal over multiple steps, deciding what to do next and using tools to act, rather than producing a single reply.
Updated September 2026: we added sources on the Model Context Protocol, research agents, prompt injection and research measuring how agent capabilities are growing.
From chatbot to agent
A chatbot takes a message and returns a message. An agent runs a loop:
- Understand the goal: “Find three suppliers for this part and compare their prices.”
- Plan the steps needed.
- Act by using a tool: search the web, open a page, run code, read a file, fill in a form.
- Observe the result.
- Decide what to do next, repeating until the goal is met or it needs help.
The language model is the reasoning engine in the middle. Tools give it hands and eyes.
What tools agents use
- Web search and browsing to gather information
- Code execution to calculate, analyze data or transform files
- File access to read and write documents
- Application connections to email, calendars, CRMs or project trackers, often through standards such as the Model Context Protocol (MCP), an open standard Anthropic released in November 2024
- Computer use, where the agent operates a browser or desktop by looking at the screen and clicking and typing
Real examples
- Research features in ChatGPT, Claude and Gemini that search dozens of sources and write a report; OpenAI launched its deep research feature in February 2025
- Coding agents that edit a codebase and run tests, as covered in our coding assistants guide
- Browser agents that complete multi-step web tasks
- Business workflows that triage support tickets or reconcile records
Where agents fall short
- Compounding errors. A small mistake early in a long task can derail everything after it.
- Getting stuck. Agents can loop, misread a page or give up on an obstacle a person would handle easily.
- Overconfidence. An agent may report success when the task is only partly done.
- Security risks. Agents that read web pages or emails can be targeted by prompt injection: hidden instructions in content that try to hijack the agent. This is one of the most important unsolved problems in agent safety. The OWASP Top 10 for applications built on language models ranks prompt injection as the number one risk, including indirect injections hidden in websites or files the model reads.
- Cost and speed. Long tasks take many model calls, which takes time and money.
Human in the loop The safest agent setups require approval before irreversible actions: sending messages, making purchases, deleting files or changing account settings. Treat an agent like a capable new assistant whose work you check before it goes out.
How to use agents well today
- Start with tasks whose results are easy to verify, such as research with citations or data cleanup you can spot-check.
- Give clear goals, constraints and a definition of done.
- Limit permissions to what the task needs.
- Review the log of what the agent did, not just the final summary.
Where this is heading
The reliability of agents on long tasks has been improving steadily. Research group METR found in 2025 that the length of tasks AI agents can complete with 50% reliability, measured by how long the tasks take human professionals, had been doubling roughly every seven months for six years. Agent features are also being built into browsers, operating systems and office software. As we noted in our 2026 trends piece, the key question this year is not whether agents can do impressive demos, but whether they can be trusted with everyday work. The answer, for now, is: often, with supervision.
Sources
- Introducing the Model Context Protocol, Anthropic, November 2024
- Introducing deep research, OpenAI, February 2025
- LLM01:2025 Prompt Injection, OWASP Gen AI Security Project
- Measuring AI Ability to Complete Long Tasks, METR, March 2025
