Skip to content
Knowledge Hub/Article
Article

What Is an AI Agent? Agentic AI and How AI Agents Work

How AI agents work, how they differ from chatbots, how tool use works, what risks AI browsers bring, and how to run agents safely in an organization.

Oğuzhan Gerçek··10 min read
What Is an AI Agent? Agentic AI and How AI Agents Work

Short answer: An AI agent is a software system that carries out a goal for a user, step by step, by combining a large language model with tools, memory and planning. A chatbot generates text; an agent calls tools, reaches external data and makes decisions across several steps. Agentic AI is the umbrella term for systems that use such agents to reach a goal with limited supervision. The application, not the model, executes each tool call, which is why permissions and approvals belong in the application. The main risk is an agent following an instruction hidden in a web page or email and using its access for an action nobody intended.

What is an AI agent?

Google Cloud defines AI agents as software systems that use AI to pursue goals and complete tasks on behalf of users; they show reasoning, planning and memory, and have a level of autonomy to make decisions. According to AWS, humans set the goals and the agent independently chooses the actions needed to reach them. Microsoft's Agent Framework documentation describes agents as components that use LLMs to process inputs, call tools and MCP servers, and generate responses.

The part of an agent that makes decisions is usually a large language model; we explain how those models work in that article. Our article on AI covers the wider field, and our glossary has a short definition.

What is agentic AI?

According to IBM, agentic AI is an artificial intelligence system that can accomplish a specific goal with limited supervision. Google Cloud's analogy puts it this way: agents are the building blocks of agentic AI, and agentic AI is the coordinated use of those blocks.

Anthropic's Building effective agents, published in December 2024, separates two designs:

  • Workflow: LLMs and tools are orchestrated through predefined code paths.
  • Agent: The LLM dynamically directs its own process and tool usage.

The post notes that agentic systems trade latency and cost for better task performance and recommends starting with the simplest solution possible. Microsoft gives similar advice: if you can write a function to handle the task, do that instead of using an AI agent.

Agents, chatbots and assistants

Google Cloud ranks the three by autonomy:

  • Bot: The least autonomous; it typically follows pre-programmed rules.
  • AI assistant: Works directly with the user and can reason and act on the user's behalf under their supervision.
  • Agent: The most autonomous; it makes decisions independently to achieve a goal.

Microsoft's Foundry documentation sums up the difference in one sentence: unlike a simple chatbot that only generates text, an agent can call tools, access external data and make decisions across multiple steps. IBM likewise calls chatbots without tools, memory or reasoning nonagentic.

How does an AI agent work?

Tool use, which providers also call function calling, works in five steps as OpenAI describes it:

  1. The application sends the model a request with the tools it could call.
  2. The model returns a tool call.
  3. The application runs its own code with the input from the tool call.
  4. The tool's output goes back to the model in a second request.
  5. The model produces a final response, or more tool calls.

As Google's Gemini documentation stresses, the model doesn't execute the function itself. According to AWS, agents extend their capabilities by connecting to external software, APIs or devices; our glossary has a short definition of the term. One protocol that standardizes these connections is MCP (Model Context Protocol): according to its documentation, a client lists the tools a server offers at runtime and then calls them (see our MCP article).

The agent repeats these steps in a loop. The ReAct paper from 2022 proposed generating reasoning traces and actions in an interleaved way; IBM calls the loop Think-Act-Observe. According to Anthropic, an agent should get ground truth from the environment at each step, such as tool call results, be able to pause for human feedback at checkpoints, and run within stopping conditions such as a maximum number of iterations.

Context, memory and human approval

In its post on context engineering, Anthropic treats context as a finite resource with diminishing marginal returns: as the number of tokens grows, the model recalls information from its context less accurately. For long tasks it suggests three techniques: summarizing the conversation (compaction), keeping notes outside the context window, and handing focused work to sub-agents with clean context windows. In AWS's description, the memory module lets an agent retain information across interactions, sessions or tasks.

Human approval is part of the design. IBM recommends human approval before high-impact actions, a way to interrupt a sequence of actions, and a log of agent actions that users can see.

Multi-agent systems

According to Google Cloud, in a multi-agent system several agents collaborate or compete to achieve a common objective or individual goals. Anthropic's multi-agent research system uses an orchestrator-worker pattern: a lead agent coordinates the process and delegates work to subagents that run in parallel. The cost is clear: in Anthropic's data, agents use about 4 times as many tokens as chat interactions, and multi-agent systems about 15 times as many. Tasks with many dependencies between agents are a poor fit, and errors in agent systems compound.

Enterprise use cases for AI agents

Google Cloud groups enterprise agents into six types: customer, employee, creative, data, code and security agents. A customer agent answers questions and resolves issues; a security agent mitigates attacks or speeds up investigations.

We explain the order in which authority should be handed to agents in IT operations in our article on AI agents in IT operations, and we handle alert correlation and incident management in our AIOps and intelligent operations service.

What is an AI browser, and what are the risks?

An AI browser is a browser or browser extension with agent capabilities: it reads web pages and navigates, clicks and fills in forms on the user's behalf. The agentic capabilities Google has added to Gemini in Chrome and Anthropic's Chrome extension are examples.

According to Google, indirect prompt injection is the primary new threat facing all agentic browsers: an instruction can be hidden in a malicious site, in third-party content embedded in a page or in a user review. In tests Anthropic shared in August 2025, covering 123 test cases across 29 attack scenarios, attacks succeeded 23.6% of the time without safety mitigations; new mitigations brought that down to 11.2%.

The vendors' safeguards are a useful guide for corporate policy: site-level permissions, user confirmation before steps such as signing in or paying, and blocking the agent on financial sites. Organizations should write down which browsers and extensions are allowed, and keep agent mode off on admin consoles and in sessions signed in with corporate accounts.

Agent security: excessive agency, identity and audit trails

Prompt injection is ranked first in both the 2025 and 2026 editions of OWASP's list for LLM applications. The 2025 edition says indirect prompt injection occurs when a model accepts input from external sources such as websites or files, and that it is unclear whether fool-proof prevention methods exist. Excessive agency, sixth in 2025, climbed to third in the 2026 edition; its root causes are excessive functionality, excessive permissions and excessive autonomy. The UK's National Cyber Security Centre (NCSC) warns that these attacks may never be totally mitigated and recommends reducing the risk and the impact.

  • Least privilege: OWASP calls for keeping an agent's tools and permissions to the minimum necessary. According to the NCSC, an LLM that processes emails from external senders should not have access to privileged tools; OWASP's list for agentic applications extends the idea into a principle of least agency.
  • Identity: It should be clear on whose behalf an agent acts. NIST's NCCoE took up these questions in a concept paper it opened for comment in February 2026. We cover permission design in our IAM article; this layer is the subject of our identity management service.
  • Audit trail: The NCSC recommends logging the LLM's inputs and outputs along with tool use and API calls (see our log article).

We cover poisoning of the knowledge base an agent draws on in our data poisoning article, and agent inventories and risk assessment in our ISO/IEC 42001 article. We handle the infrastructure agents run on in our AI stack design and engineering service.

Frequently asked questions

What does AI agent mean? A software system that carries out a goal for a user step by step, combining a language model with tools and memory.

What is agentic AI? The umbrella term for AI systems that can accomplish a specific goal with limited human supervision. AI agents are their building blocks.

What is the difference between an AI agent and a chatbot? A chatbot answers with text. An agent calls tools, reaches external data and completes a task across several steps.

What is an AI browser? A browser or browser extension with agent capabilities that reads web pages and acts on the user's behalf. Its main risk is indirect prompt injection through instructions hidden in pages.

Are AI agents safe? Design determines how safe they are: the agent gets only the tools and permissions it needs, high-impact actions require human approval, and every action is logged.

Sources