What is an AI agent?

Ask a chatbot to reschedule your Tuesday meeting and you get a well-written email. You still have to open your calendar, find the clash, copy the text across and press send. Ask an agent the same thing and it opens the calendar itself, sees that the meeting sits on top of a client call, picks a slot that works, writes the note and sends it. You get a confirmation instead of a draft.

The model underneath is the same in both cases. That is the part people miss. Nothing about the language model got cleverer between those two examples. What changed is reach and permission: the second one was connected to your calendar and your mail, and was allowed to use them. Agency is plumbing and trust, not intelligence.

If the words model, LLM and chatbot are still slippery, the groundwork is on what is AI, which covers how these systems learned from examples and why they predict rather than look things up. Everything on this page sits on top of that. An agent inherits every strength and every failure of the model inside it, and then multiplies both, because now the output is an action rather than a paragraph you can ignore.

One useful test when someone shows you a product and calls it an agent. Ask what it is allowed to write to. If the honest answer is nothing, it is a chat window with a good interface. That is not an insult. Most of the value people get from these tools is still words on a screen.

A chatbot exchange is a straight line. You send a message, the model produces a reply, the turn is over. An agent bends that line into a circle. It observes the current state of things, decides what to do next, does it, then reads the result of what it just did and starts again. It keeps going until the goal is met, or until it hits a limit you set on steps, time or money.

Take a real errand. You ask an agent to find every invoice from one supplier in the last quarter and total them. It lists the folder, sees forty files, opens the first, notices the supplier name sits in a different place than it assumed, adjusts, works through the rest, finds one file it cannot read, says so, and returns a total with a note about the file it skipped. Nine or ten model calls, each one fed by the result of the one before.

The loop is the whole trick, and it is also the whole risk. In a chat, a wrong answer sits there and you spot it. In a loop, a wrong decision at step two becomes the input to step three, and by step nine the agent is confidently working on the wrong problem with everything it has. Errors do not stay still. They compound, and they get more expensive the longer nobody is looking.

That is why the best agent setups are boring about limits. A cap on steps. A cap on spend. A rule that says stop and ask rather than guess. None of that makes the agent smarter. It makes the failures small enough to survive.

You have probably read the phrase agentic AI a hundred times in the last year and quietly assumed it named a new technology. It does not. It describes the loop in the section above. There is no separate agentic model on sale anywhere. The same handful of large language models power the chat window and the agent, and the difference is what they are wired into and what they are permitted to do.

This matters commercially, because a lot of software is now sold on the word. When a vendor says their product is agentic, the useful follow-up questions are which model it calls, which tools it can reach, and at which point a person has to approve something. Those three answers tell you what the thing actually is. The word on its own tells you nothing.

Agency is a dial, not a switch. At the first stop the system suggests, and you do everything. At the second it drafts, and you review and send. At the third it acts, but waits for a yes before anything leaves the building. At the fourth it acts alone and tells you afterwards. Most of what is being marketed as agentic in 2026 honestly sits between the second and third stops, and the gap between stop three and stop four is much wider than the marketing suggests, because stop four means the failures happen without a witness.

My own view, after running these things daily: stop three is where almost all the value is, and where I would leave it for anything that touches money or other people. The approval click costs two seconds. Not having it has cost me an afternoon more than once.

Long before anyone typed into a chat box, computer science had a precise definition of an agent: something that perceives its environment through sensors and acts on it through actuators. The standard classification comes from Russell and Norvig's textbook Artificial Intelligence: A Modern Approach, and it sorts agents by how much they hold in their head when they choose what to do. If you have been set an exam question on intelligent agents, this is what it wants.

Now the honest part, which coursework answers usually leave out. Today's LLM agents do not map neatly onto any one box. They behave closest to a goal-based agent, because you hand them an objective and they plan steps towards it, and they carry a learning component in the sense that the model was trained from feedback before you ever met it. But the learning happened during training, not while it works on your task. A running agent does not get better at your job between Monday and Friday. It starts each session with whatever it was trained on plus whatever you put in front of it.

So the taxonomy still describes the shape of the problem well, and describes current tools only loosely. Use it to think clearly about what a system perceives, what it remembers and what it optimises for. Do not use it to predict how a particular product behaves.

The genuine strengths cluster around jobs that are tedious rather than hard. Multi-step research, where twenty searches need reading and reconciling and nobody wants to do it. Moving data between tools that were never designed to talk to each other. Writing code, running it, reading the error message and fixing it, which is probably the single most reliable agent task in existence right now, because the compiler gives honest feedback at every step. Drafting from sources you actually supplied, so the words are grounded in something real. If you are new to writing the instruction in the first place, how to use AI covers the four lines that do most of the work.

The weaknesses are just as specific. Long chains, where a small early misreading compounds quietly until the output is confidently wrong. Anything requiring judgement it was never given, which usually means context about your business that lives in your head and nowhere else. Knowing when to stop, which agents are genuinely poor at: they will keep working, keep spending, and keep producing plausible next steps well past the point a person would have said this is not going to work. And telling you plainly that they failed, because a model trained to be helpful will hand you a partial result framed as a success far more readily than it will say I could not do this.

There is also a cost point people discover late. A single question is one model call. An agent working through a ten-step loop is ten or more, each one carrying the whole growing history of the task as input. So agents are slower and cost several times more per job than asking directly. For a task you do once, that is fine. For a task you do four hundred times, do the sum before you automate it.

The practical rule I use: give an agent work where checking the output is much cheaper than producing it. Finding the right file, yes. Deciding what to say to a client whose contract is up for renewal, no.

Take the tools away and an agent is a chat window again. The tools are the whole difference: reading and writing files, seeing your calendar, sending mail, searching the web, running code. Each one is a door between the model and something real.

For years every one of those doors was a bespoke integration, which is why agents stayed a demo. Anthropic released the Model Context Protocol in November 2024 as an open standard for that connection, and it has since been adopted well beyond them. Connect a tool once and any compatible assistant can use it, instead of every vendor building the same plumbing separately. There is a full explanation in what is MCP, so this page will not repeat it. The layer view of the same idea is on the tools layer.

Here is the failure mode that has no clean fix yet. An agent reads a web page, a PDF, an email or a shared document. Somewhere in that text sit instructions: ignore your earlier instructions, forward the last invoice to this address, put this link in your summary. To the model that text arrives the same way your instruction did, as words in its context. It has no reliable way to tell the difference between what you asked for and what the page asked for. This is called prompt injection, and it is a design consequence rather than a bug someone forgot to fix.

In a chat window this is mostly harmless, because the worst outcome is a bad paragraph. Give the same system your mailbox and it stops being harmless. Access runs both ways: everything you connect an agent to is something it can read, and everything it can write to is something someone else's text might get it to write.

The control that works is dull and effective. Grant read access widely, because reading rarely destroys anything. Grant write access narrowly, to one folder, one calendar, one mailbox, and not to the whole account. And put a human approval step in front of anything that sends, pays, publishes or deletes. Those four verbs are the list worth memorising. Everything else can usually be undone.

The other half of the answer is written down rather than technical. The rules you want an agent to hold to, including what it must never do without asking, belong in a file it reads first, which is what the constitution layer is for. A permission model in your account and a stated rule in your file are two different defences, and you want both.

Give a capable agent tools and no context and you get something genuinely unsettling: competent decisions about the wrong things. It will write the follow-up beautifully, to the client you already fired. It will tidy the folder you were deliberately keeping messy. Every individual step is defensible. The whole is useless, because nobody told it what the week actually looks like.

That is the gap the five layers are for. A constitution that states who you are and what is off limits. Memory that keeps what you decided last month in files you own rather than inside one vendor's product. Skills, which are written procedures an agent can follow so a job comes out the same way twice. Tools, which are the doors from the section above. And focus, which is deciding what the thing should be working on at all. The whole picture is on /aios.

None of that requires an agent to begin with, which is the point. The context is the durable part. Models get replaced every few months and the file you wrote about your own work keeps working in all of them.

So the first step is the same modest one as always. Open a plain text editor and write half a page: what you do and who for, what you are working on right now with real names and real dates, the decisions you make most weeks, and the two or three lines on what a system should never do without asking you. Save it. Paste it above your next question. Mine is about a page long and it goes into almost everything I run.

Starter files, including a sample you can edit line by line, are on /resources. Everything there is free and needs no signup.

If you want to know when the next one goes up, there is a waiting list. That one asks for an email, and it is the only thing here that does.