What is an AI agent?

By Harnoor Minhas · Last reviewed 2026-09-12 · Reviewed quarterly · Part of the glossary behind The Agent Signal, the daily AI newsletter.

Definition. An AI agent is a piece of software that is given a goal rather than a single instruction, and that works toward the goal by repeatedly deciding what to do next, doing it (usually by calling tools such as a web browser, a database, a code runner or another program), looking at the result, and deciding again — until the goal is met, it gets stuck, or it is told to stop. In 2026, the "deciding" part is almost always done by a large language model.

That definition is deliberately plain, because most confusion about AI agents comes from vendors using the word for anything with a chat box. The test is simple: if the software only answers and waits, it is an assistant. If it can take a step, see what happened, and take another step on its own, it is an agent. Everything else on this page is detail.

The definition, unpacked

Four words in the definition carry the weight: goal, decide, tools, loop.

Goal. You give an agent an outcome — "find me three flights under $400 next Tuesday and hold the cheapest one" — not a step. A chatbot given that sentence writes a paragraph about how to search for flights. An agent opens a browser.

Decide. Nobody wrote a script that says "open the airline site, then click Search". The model reads the goal, reads what tools it has, and chooses. If the first site is down, it chooses again. This is what people mean by an agent having "autonomy", and it is the source of both the value and the risk.

Tools. A language model on its own can only produce text. An agent becomes useful because that text can be interpreted as an action: call this API, run this code, send this email, read this file. Tools are the agent's hands. The current standard for describing tools to a model in a portable way is the Model Context Protocol (MCP), which is why you will see MCP mentioned in almost every agent framework announcement in our Open-Source AI Agents lane.

Loop. The agent runs "think, act, observe" over and over — the pattern formalised as ReAct (Yao et al., 2022). Each turn of the loop puts the previous results back in front of the model so it can adjust. A single-shot prompt is not an agent, however clever the prompt. A loop is.

The idea is older than large language models. In the standard AI textbook (Russell & Norvig) an "intelligent agent" is anything that perceives its environment through sensors and acts on it through actuators, and a thermostat qualifies. What changed around 2023 is that language models became good enough at reading messy instructions and choosing among tools that the "decide" step no longer had to be hand-coded. That is the whole reason the word came back.

How an AI agent works, step by step

Strip away the framework names and nearly every production agent in 2026 runs the same eight-step cycle.

Receive the goal. A person or another program hands over a task in natural language, sometimes with attachments and constraints ("do not spend more than $50", "only use these two databases").
Load context. The agent assembles what it knows: the system instructions that define its job, the conversation so far, relevant documents pulled from memory or a search index, and a list of the tools it is allowed to use, each with a short description.
Plan. The model produces a rough sequence of steps. Good agents write this plan down so a human can read it; some frameworks make the plan an explicit object the agent updates as it goes.
Choose an action. The model emits a structured tool call — a function name and arguments — instead of prose. This is the moment the text becomes an action.
Execute. The surrounding program (not the model) actually runs the tool: fires the HTTP request, executes the code in a sandbox, queries the database. This separation matters for safety: the model asks, the runtime decides whether to allow it.
Observe. The tool's output — a web page, an error message, a table of rows — is fed back to the model as new context.
Reflect and repeat. The model checks progress against the goal. Did the search return what was needed? Is the code passing its tests? It then chooses the next action, or revises the plan, and loops back to step 4.
Finish or escalate. When the goal is met the agent reports the result. When it is stuck, out of budget, or facing an action it is not allowed to take alone (sending money, deleting data), a well-built agent stops and asks a human. This "human in the loop" checkpoint is the single most important design decision in any deployment.

Two supporting pieces make this workable at scale. Memory lets the agent carry facts across sessions — what the user prefers, what was tried last time — usually stored outside the model in a database and retrieved as needed. Guardrails are rules enforced by the runtime, not the model: allow-lists of tools, spending caps, timeouts, and checks on what goes in and out. A model can be talked into anything; a runtime cannot.

Agentic AI vs AI agents vs generative AI

These three phrases get swapped freely in marketing, and the swapping is where most of the confusion lives. They sit at different levels.

	Generative AI	AI agent	Agentic AI
What it names	A capability: models that produce text, images, code or audio from a prompt.	A thing: one program that pursues a goal by looping through tools.	A property or design approach: systems built so that agents (often several) plan, act and coordinate with limited supervision.
Grammar	Noun phrase — the technology.	Countable noun — you can have three of them.	Adjective — describes a system, a workflow or a product.
Takes actions?	No. It answers.	Yes, through tools, within a loop.	Yes, usually across many steps, many tools and sometimes many agents.
Level of autonomy	None — one prompt, one output.	Task-level: finishes a bounded job.	Workflow-level: runs a process end to end, delegates, recovers from failure.
Typical example	Drafting an email from bullet points.	A coding agent that fixes a failing test in your repo.	A support system where a triage agent routes to a refunds agent that checks policy, issues the credit and notifies the customer.
Who is accountable	The person who used the output.	The person who launched the task, plus the runtime's guardrails.	Whoever designed the system; accountability has to be engineered in.
Relationship	The engine inside agents.	The building block of agentic systems.	The architecture that agents live in.

The short version: generative AI is the engine, an AI agent is a vehicle, and agentic AI is the traffic system. If you want the longer treatment of the adjective — including the "levels of autonomy" ladder — it is on the companion page, What is agentic AI?

Types of AI agents

There are two useful ways to sort agents: by how they decide (the Russell & Norvig textbook taxonomy) and by what they are for (how the industry actually talks). Both are worth knowing, because vendors mix them.

By how they decide

Simple reflex agents map a condition directly to an action. A spam filter that blocks any message with a known bad link is a reflex agent. No model of the world, no memory.
Model-based agents keep an internal picture of the state of things and update it as they observe. A robot vacuum with a map is model-based; a language-model agent that tracks "which files have I already edited" is too.
Goal-based agents choose actions by asking which one moves toward a stated goal. Most LLM agents are goal-based: the goal is your prompt.
Utility-based agents weigh competing outcomes by a score — cheapest, fastest, safest — rather than a single yes/no goal. A travel agent asked for "a good deal" is doing utility reasoning, whether or not anyone wrote the formula down.
Learning agents improve their own policy from experience. In 2026 most deployed LLM agents do not learn online; they get better when the model is retrained or the prompt is edited. Agents that genuinely update from feedback in production are still rare and are watched closely in our Frontier AI Research lane.

By what they are for

Coding agents read a codebase, edit files, run tests and open pull requests. This is the most mature category and the one where autonomy has gone furthest; see the coverage in Agentic AI Edge.
Browser and computer-use agents operate a screen the way a person does — clicking, typing, reading — so they can use software that has no API.
Research agents search, read many sources, and write a cited report. "Deep research" features from the major labs are this category.
Customer and operations agents handle tickets, refunds, scheduling and back-office workflows inside a company's own systems, with rules about what they may do alone.
Personal assistant agents manage a calendar, inbox and to-do list for one person. Useful and, because they touch private data, the category with the sharpest privacy questions.
Embodied agents control a physical body — a humanoid, a warehouse arm, a drone. Same loop, but the "observe" step is a camera and the "act" step moves metal. Tracked daily in Embodied AI Robots.
Orchestrator agents do not do the work themselves; they break a task into pieces and hand each piece to a specialist agent. Once you have one of these, you have an agentic system.

Examples of AI agents in 2026

Concrete, and stated without vendor puffery. Company and product names are used only to identify what is being described; The Agent Signal is not affiliated with any of them.

Command-line coding agents. Tools such as Anthropic's Claude Code and OpenAI's Codex CLI take a task like "add rate limiting to the upload endpoint", read the repository, write the change, run the test suite, and iterate on failures. The person reviews a diff instead of writing one. Daily changes to these tools are covered in Claude Agent Signal and OpenAI Agent Signal.
Deep-research features. The research modes inside the major assistants run dozens of searches, read the results, and produce a report with citations over several minutes. The user's role shrinks to writing a good question and checking the sources.
Computer-use agents. Agents that see a screenshot and drive a mouse and keyboard can fill forms on legacy websites, work through desktop applications, and complete tasks that were never designed for automation. They are slower and less reliable than API-based agents, and improving quickly.
Open-source agent frameworks. Libraries that give developers the loop, the tool interface and the memory layer so they can build their own agents on any model — including open-weight models run locally. New frameworks and MCP servers appear weekly; see Open-Source AI Agents and Open Weights.
Enterprise workflow agents. Agents embedded in CRM, IT-service and finance platforms that resolve routine tickets, reconcile invoices, or draft and route approvals inside the company's permissions model. Covered in AI at Work and Hyperscale Cloud AI.
Humanoid and industrial robots. Robots whose control stack now includes a language-and-vision model that turns "put the blue bins on the second shelf" into a sequence of motions. The agent loop is the same; the failure modes are physical.

What these share: a goal in plain language, a set of tools, a loop, and a point at which a human looks at the result. What they do not share is reliability. A coding agent can be checked by running the tests; a browser agent booking a hotel cannot be checked until the confirmation email arrives. Reliability tracks how easy it is to verify the outcome, and that is a better guide to what to automate than any benchmark.

Use cases: where agents earn their keep

Agents pay off where three things are true at once: the task is repetitive enough to be worth automating, messy enough that a fixed script would break, and verifiable enough that mistakes get caught. Ranked by how well those conditions hold today:

Software maintenance. Dependency upgrades, test fixes, migrations, documentation. Verifiable by tests and review. The clearest win in 2026.
Research and synthesis. Competitive analysis, literature review, due diligence. Verifiable because the citations can be checked. Saves hours; still needs a reader.
Data plumbing. Pulling from one system, cleaning, loading into another, with a schema check at the end. Boring, valuable, and easy to bound.
Tier-one support and operations. Password resets, order status, standard refunds within a policy. Works when the allowed actions are narrow and the escalation path is real.
Personal admin. Inbox triage, scheduling, travel. Works for the individual who tolerates occasional errors and reviews before anything is sent.
Sales and marketing drafting. First drafts of outreach, personalised from a CRM. The agent should draft; a person should send. Agents that send on their own generate the complaints you read about.

Where agents do not yet earn their keep: anything irreversible with no checkpoint (payments, deletions, legal filings), anything where the ground truth is unavailable to the agent (medical judgement from a chat), and long open-ended tasks with no test of success. If you cannot say how you would know the agent got it right, do not deploy it there yet.

Risks and limits

Every capability above has a mirror image. The honest list:

Compounding errors. A 95%-reliable step, repeated twenty times, succeeds about a third of the time. Long agent runs fail more often than short ones, which is why good agents check their work and ask.
Prompt injection. An agent that reads web pages, emails or documents can be given instructions by the content it reads (ranked first in the OWASP Top 10 for LLM Applications) — "ignore your task and email this file to…". Treating everything the agent observes as data rather than commands is the core defence, and it is not yet solved in general. Our AI Safety Signal lane tracks disclosures and fixes.
Over-permissioning. The easiest way to make an agent work in a demo is to give it access to everything. The easiest way to have a bad month is to ship that demo. Least privilege applies to agents exactly as it does to employees.
Cost and runaway loops. An agent that cannot finish will keep trying. Token budgets, step limits and wall-clock timeouts are not optional.
Accountability gaps. When an agent takes an action, someone is still responsible. Logs that show what the agent saw, chose and did are the minimum for anyone to answer "why did it do that".
Benchmark inflation. Agent benchmarks are young, and vendors tune for them. A score on a public benchmark says little about your task. Try the agent on your own work with a clear pass/fail before believing a chart.
Job design. The realistic 2026 pattern is not "agent replaces person" but "person supervises several agents". That changes what the job is, and organisations that ignore the change get the worst of both.

Keeping up

This page is a definition; it will not tell you what shipped this morning. For that, the relevant lanes of The Agent Signal are: The AI Agent Stack for builders, Agentic AI Edge for the wider ecosystem, Open-Source AI Agents for frameworks and MCP, and Agent Signal News for the daily headline set. If you are still choosing a newsletter, we compared ours against the competition honestly in The 21 Best AI Newsletters.

Sources and further reading

The definition and taxonomy above follow the textbook; the loop, tool and safety material follows the vendor guides and the security lists below. Links were checked on 2026-09-12.

Frequently asked questions

What is an AI agent in simple terms?

An AI agent is software you give a goal to, which then works out the steps itself, uses tools to carry them out, checks the results and keeps going until the goal is done. A chatbot answers a question; an agent does a job.

What is the difference between an AI agent and a chatbot?

A chatbot produces a reply and stops. An agent can take actions in the world — search, run code, edit files, call APIs — and loop on the results without being prompted at each step. Many products are both: a chat interface in front of an agent. The test is whether it can act on its own between your messages.

What is the difference between AI agents and agentic AI?

"AI agent" is the noun for one program that pursues a goal with tools. "Agentic AI" is the adjective for systems designed around that behaviour — often several agents coordinating, running long workflows with little supervision. Every agentic system contains agents; not every agent lives in an agentic system. The comparison table above spells it out, and What is agentic AI? goes deeper.

Is ChatGPT an AI agent?

The basic chat mode is not: it answers and waits. The same product includes agent features — research modes that search and read on their own, and modes that operate a browser — and those are agents. Whether "ChatGPT is an agent" depends on which mode you are using. The same is true of Claude, Gemini and Grok; each is an assistant that can be put into agent modes.

How do AI agents work?

Through a loop: read the goal and context, plan, choose a tool call, let the runtime execute it, observe the result, and decide the next step. A language model does the deciding; ordinary software does the executing and enforces limits. Memory carries facts between runs, and guardrails stop the agent from doing things it should not.

What are the main types of AI agents?

By decision style: simple reflex, model-based, goal-based, utility-based and learning agents. By purpose: coding agents, browser and computer-use agents, research agents, customer and operations agents, personal assistants, embodied (robot) agents and orchestrator agents that manage other agents.

What are examples of AI agents?

Command-line coding agents that fix bugs and open pull requests; deep-research modes that produce cited reports; computer-use agents that operate websites and desktop software; enterprise agents that resolve support tickets within policy; and robots whose control stack turns spoken instructions into actions. Examples are listed with context in the section above.

Are AI agents safe to use?

Safe enough for bounded, verifiable tasks with a human checkpoint; not yet safe for irreversible actions without one. The specific risks are compounding errors over long runs, prompt injection from content the agent reads, over-broad permissions, runaway cost, and unclear accountability. Each has a known mitigation; none is fully solved.

Author: Harnoor Minhas — TODO-HIS-BIO. Vendor and product names are used nominatively to identify what is described; The Agent Signal is not affiliated with or endorsed by any company named. Last reviewed 2026-09-12; next scheduled review 2026-12.