What is an AI agent?
AI foundations, models and capabilities
An AI agent is software that uses a model plus instructions, tools, and runtime controls to work through a task over multiple steps. Instead of only answering once, it can decide what to do next, call tools, maintain state, and sometimes pause for approval. In practice, useful agents are bounded by permissions, guardrails, and review points.
Reviewed by Jackie, Head of Learning & Development, Levellers · Last reviewed 8 June 2026
What this means
An AI agent is not just a chat response. In OpenAI's documentation, an agent is an LLM configured with instructions, tools and optional runtime behaviour such as handoffs, guardrails and structured outputs. That means the system can do more than generate text, it can take steps in a workflow.
The broader idea of an agent is older than current LLM products. Survey literature describes agents as entities that sense an environment, make decisions and take actions, while NIST defines AI systems more generally as systems that operate with varying levels of autonomy. Modern LLM agents are one practical implementation of that wider idea.
Why it matters
Agents matter when work is multi-step, tool-dependent and hard to compress into one prompt. Anthropic recommends them for open-ended problems where you cannot hardcode a fixed path and the model may need many turns of action, feedback and adjustment.
That does not mean every task should become agentic. Anthropic makes a clear distinction between workflows, where code defines the path in advance, and agents, where the model dynamically directs tool use and process. For many business tasks, the simpler workflow is the better design.
How it works
A practical agent usually combines five things: instructions that set role and scope, tools that let it act outside plain text, state or session history so it can continue across turns, orchestration so it can hand off or delegate when needed, and controls such as guardrails or approvals. OpenAI documents each of those building blocks directly in its Agents SDK.
Tools are especially important. OpenAI states that tools let agents take actions such as fetching data, running code, calling APIs or using a computer. Anthropic describes agents in similarly practical terms: an LLM using tools, environmental feedback, and a loop that continues until the task is finished or a stopping condition is met.
Human control also sits inside the runtime. OpenAI's human-in-the-loop flow pauses agent execution until a person approves or rejects sensitive tool calls, while guardrails can check inputs, outputs and some tool interactions before work continues.
Examples
Support operations. An agent can read a customer message, check CRM or order data, draft a response, and route the case to a specialist if needed. That is more than a single answer, because it involves lookup, judgement and action across steps.
Coding and maintenance. Anthropic highlights coding agents as a strong fit because outputs can be checked against tests and objective task criteria. That makes them easier to evaluate than purely subjective work.
Research and triage. Anthropic's orchestrator-worker pattern is useful when the needed subtasks are not known in advance, such as search tasks that gather and analyse information from multiple sources before producing a result.
Common misunderstandings
Not every chatbot is an agent. If a system mainly performs one prompt in and one answer out, with no tool use or multi-step control loop, it may be useful AI, but it is not necessarily an agent in the operational sense described by current provider docs.
An agent does not have to be fully autonomous. OpenAI documents approval pauses, and Anthropic recommends checkpoints, blockers and stopping conditions. Well-run agents are usually bounded, not left fully unchecked.
More agents is not automatically better. Anthropic explicitly recommends starting with the simplest approach possible and only adding complexity when that demonstrably improves outcomes.
Risks and boundaries
The main risks come from the gap between model output and real-world action. NIST's Generative AI Profile flags prompt injection as a security risk, including indirect prompt injection through retrieved external content.
OWASP describes excessive agency as the vulnerability that allows damaging actions to happen because of unexpected, ambiguous or manipulated model outputs. It identifies excessive functionality, permissions and autonomy as common root causes.
That is why controls matter. OpenAI recommends adversarial testing and human review in practice, especially in high-stakes use cases and code generation, and its SDK provides guardrails plus approval interrupts for sensitive tool calls.
What to do next
Pick one open-ended workflow where the next step is not always known in advance, then define a bounded agent brief: what tools it may use, what it may never do, when it must stop, and which actions require human approval. That follows the fit criteria Anthropic gives for agents and the control patterns OpenAI documents for guardrails and approvals.
Have a question or a suggestion, or want to understand how we research and review these guides? Read about our editorial standards and how to reach us.
FAQs
Does an AI agent need tools?
Tools are what make most business agents operationally useful, because tools let them fetch data, run code or act in other systems. Without that, you are often closer to a multi-step assistant than an agent that can execute work.
Is a chatbot an AI agent?
Sometimes, but not always. Anthropic distinguishes fixed workflows from agents, and OpenAI defines agents around tools, guardrails, handoffs and runtime behaviour. A plain chat interface can exist without those features.
When should you avoid agents?
Avoid them when the work is predictable, low-variance and easy to encode as a fixed workflow. Anthropic recommends starting simple and only adding agentic complexity when it clearly improves outcomes.
How do you keep an agent under control?
Use least-privilege tool access, guardrails, approval gates and testing. OWASP, OpenAI and NIST all point toward those kinds of controls for systems that can act through tools or external integrations.