An AI agent is a software system that uses AI to pursue goals and complete tasks on behalf of users, showing reasoning, planning, and memory, plus a level of autonomy to make decisions, learn, and adapt, per Google Cloud documentation.
The software sense of the term applies throughout this entry: Code built around a language model that acts toward a goal, rather than a human agent or a physical robot. Agents sometimes work with no chat interface at all, running in the background and triggered by system events, according to Microsoft Foundry Agent Service documentation.
Key Takeaways
- AI agents pursue goals and complete tasks on behalf of users, showing reasoning, planning, and memory plus a level of autonomy to make decisions, learn, and adapt, per Google Cloud documentation.
- Every agent combines three core components: A model that supplies reasoning and language capabilities, instructions that define goals, constraints, and behavior, and tools that provide access to data or actions, according to Microsoft Foundry Agent Service documentation.
- Applications that integrate LLMs without using them to control workflow execution, such as simple chatbots, single-turn LLMs, or sentiment classifiers, are not agents, according to OpenAI’s practical guide to building agents.
- Anthropic draws an architectural distinction between workflows, where LLMs and tools are orchestrated through predefined code paths, and agents, where LLMs dynamically direct their own processes and tool usage.
- Red teaming run by NIST’s Center for AI Standards and Innovation with the UK AI Security Institute raised attack success from 11% for the strongest baseline attack to 81% for the strongest new attack.
- Repeating each of five injection tasks 25 times lifted the average attack success rate from 57% to 80%, per the same CAISI evaluation.
How Does an AI Agent Work?
An agent reasons about a user request with a model and then takes autonomous actions to fulfill it, calling tools, accessing external data, and making decisions across multiple steps, according to Microsoft Foundry Agent Service documentation. It has access to various tools to interact with external systems, both to gather context and to take actions, OpenAI’s practical guide adds.
1. The model reasons over the request
The model supplies the reasoning and language capabilities an agent runs on, drawn in Microsoft Foundry from the Foundry model catalog. Agents also lean on the multimodal capacity of generative AI and AI foundation models, processing text, voice, video, audio, and code simultaneously, per Google Cloud documentation. Which model sits underneath keeps changing, and our AI model tracker keeps score.
2. Instructions set the goal and the guardrails
Instructions define the goals, constraints, and behavior of an agent, and in Microsoft Foundry they take the form of prompts or code inside a hosted agent. An agent dynamically selects the appropriate tools depending on the workflow’s current state, always operating within clearly defined guardrails, according to OpenAI’s practical guide.
3. Tools connect the agent to data and actions
Tools give an agent access to data or actions such as search, file operations, or API calls. The Model Context Protocol standardizes those connections, and its documentation compares MCP to a USB-C port for AI applications: one standardized way to reach data sources, tools, and workflows. A shared connector standard is the quiet reason tool access spread across vendors so quickly.
4. The loop runs until the goal is met
An agent leverages an LLM to manage workflow execution and make decisions, recognizes when a workflow is complete, corrects its actions proactively if needed, and, in case of failure, halts execution and transfers control back to the user, per OpenAI’s practical guide. Traditional software follows hard-coded instructions, while AI agents identify the next appropriate action based on past data and execute it without continuous human oversight, according to AWS documentation.
| Component | What it does | Example |
|---|---|---|
| Model | Supplies reasoning and language capabilities | A model from the Foundry model catalog |
| Instructions | Define goals, constraints, and behavior | Prompt text or code inside a hosted agent |
| Tools | Provide access to data or actions | Search, file operations, or API calls |
Source: Microsoft Learn, Foundry Agent Service overview, accessed July 2026.
The architecture of current LLM-based agents generally requires combining trusted developer instructions with other task-relevant data into a unified input, and agent hijacking exploits that lack of separation, NIST’s Center for AI Standards and Innovation explains in its technical blog on agent hijacking evaluations. Attackers build a resource that looks like typical data an agent might interact with, such as an email, a file, or a website, while the data carries malicious instructions meant to hijack the agent into a different and potentially harmful task.
Autonomy is the attack surface. An agent earns its value by reading something and then acting on it, and that same freedom carries attacker-controlled text straight through to the action. CAISI staff ran a red teaming exercise with red teamers at the UK AI Security Institute on AgentDojo, an open-source framework developed by researchers at ETH Zurich, testing agents powered by Anthropic’s upgraded Claude 3.5 Sonnet. That exercise increased attack success from 11% for the strongest baseline attack to 81% for the strongest new attack.
AI Agent vs Chatbot vs Workflow
A simple chatbot only generates text, while an agent calls tools, accesses external data, and makes decisions across multiple steps to complete a task, according to Microsoft Foundry Agent Service documentation. Anthropic categorizes every variation as an agentic system while drawing an architectural distinction: workflows orchestrate LLMs and tools through predefined code paths, and agents let LLMs dynamically direct their own processes and tool usage.
Agentic systems often trade latency and cost for better task performance, so workflows keep the edge in predictability and consistency for well-defined tasks, while agents suit cases where flexibility and model-driven decision-making are needed at scale, per Anthropic’s engineering write-up. For many applications, optimizing single LLM calls with retrieval and in-context examples is usually enough.
| Dimension | Chatbot | Workflow | Agent |
|---|---|---|---|
| Controls execution | No | Predefined code paths | The model directs its own process |
| Tool use | None or fixed | Orchestrated by developers | Selected dynamically by the model |
| Predictability | High | High | Lower, model-driven |
| Best fit | Single-turn answers | Well-defined tasks | Flexibility at scale |
Source: OpenAI, A Practical Guide to Building Agents; Anthropic Engineering, Building Effective Agents, December 2024.
What is the difference between an AI agent and a chatbot?
Control over workflow execution separates the two. Applications that integrate LLMs without using them to control workflow execution, including simple chatbots, single-turn LLMs, and sentiment classifiers, are not agents, OpenAI’s practical guide states. An agent instead leverages an LLM to manage workflow execution and make decisions across the steps that meet the user’s goal.
Types of AI Agents
Vendor documentation groups agents by autonomy and coordination rather than textbook taxonomy. Some customers define agents as fully autonomous systems that operate independently over extended periods, using various tools to accomplish complex tasks, while others use the term for more prescriptive implementations that follow predefined workflows.
Individual AI agents can be specialized to perform specific subtasks with accuracy, and an orchestrator agent coordinates the activities of different specialist agents to complete larger, more complex tasks, according to AWS documentation. Multiple AI agents also collaborate to automate complex workflows, exchanging data with each other so the entire system works toward common goals.
Google Cloud lists six features for an AI agent: reasoning, acting, observing, planning, collaborating, and self-refining, with reasoning and acting the key features described in the ReAct Framework. Each added feature buys capability and incurs oversight, a trade we track in our agent autonomy level data.
What is agentic AI?
Agentic AI is an advancement in autonomous systems, increasingly enabled by large language models and generative AI, according to the OWASP GenAI Security Project. Agentic AI predates modern LLMs, and its integration with generative AI has significantly expanded its scale, capabilities, and associated risks.
Why Do AI Agents Matter?
Humans set goals, but an AI agent independently chooses the best actions it needs to perform to achieve those goals, according to AWS documentation. A contact center AI agent automatically asks the customer different questions, looks up information in internal documents, responds with a solution, and decides from the customer responses whether to resolve the query itself or pass it on to a human.
A workflow here is a sequence of steps that must be executed to meet the user’s goal, whether that is resolving a customer service issue, booking a restaurant reservation, committing a code change, or generating a report, OpenAI’s guide notes. The shift worth watching sits in the failure mode: a model that answers badly produces a bad sentence, while an agent that acts badly produces a bad action.
MCP reduces development time and complexity when building or integrating with an AI application or agent, its documentation states. Standardized tool access explains much of that spread, and the adoption curve sits in our AI agent adoption data.
The OWASP Agentic Security Initiative published the first in a series of guides giving a threat-model-based reference of emerging agentic threats and mitigations on February 17, 2025. Governance bodies moved on agents faster than they moved on chatbots.
Pros, Cons, and Risks of AI Agents
Advantages
- Agents perform whole workflows on the users’ behalf with a high degree of independence, where conventional software only helps users automate those workflows themselves.
- Agents act autonomously, without constant human intervention, identifying the next appropriate action based on past data.
- Specialist agents handle specific subtasks with accuracy while an orchestrator agent coordinates them into larger, more complex tasks.
- An agent recognizes when a workflow is complete and can proactively correct its actions if needed.
- Agents work with other agents to coordinate and perform more complex workflows, and they learn over time and facilitate transactions and business processes.
Trade-offs and Risks
- Many AI agents are currently vulnerable to agent hijacking, a type of indirect prompt injection in which an attacker inserts malicious instructions into data that may be ingested by an AI agent, causing it to take unintended, harmful actions.
- Repeated attempts change the picture: taking five injection tasks and attempting each attack 25 times moved the average attack success rate from 57% to 80%.
- AI systems are subject to novel security vulnerabilities that need to be considered alongside standard cybersecurity threats, and when the pace of development is high, as it is with AI, security can often be a secondary consideration, the UK National Cyber Security Centre states.
- Agentic systems often trade latency and cost for better task performance, so the flexibility carries a running bill.
- Integration with generative AI has significantly expanded the scale, capabilities, and associated risks of agentic systems.
| Risk | What it looks like | Direction of mitigation |
|---|---|---|
| Agent hijacking | Malicious instructions hidden in an email, file, or website the agent reads | Separate trusted instructions from untrusted data |
| Evaluations that age badly | A single-attempt benchmark understates a persistent attacker | Retry attacks and re-baseline after model upgrades |
| Novel AI vulnerabilities | Weaknesses sitting alongside standard cyber threats | Controls across design, development, deployment, operation |
| Expanded blast radius | Broader scale and capability bring broader associated risk | Threat-model the agent, not the model alone |
Source: NIST Center for AI Standards and Innovation, January 2025; UK National Cyber Security Centre; OWASP GenAI Security Project, February 2025.
The NCSC guidelines split the AI system development life cycle into four key areas: secure design, secure development, secure deployment, and secure operation and maintenance, and follow a secure by default approach. Their considerations and mitigations help reduce the overall risk to an organizational AI system development process. Nothing there removes the risk. It lowers it.
Indirect prompt injection is the delivery mechanism behind most of the agent-specific failures, and the volume behind it sits in our prompt injection research.
Agents that employees stand up outside the security team’s line of sight widen the same exposure, a pattern visible in our unsanctioned enterprise AI tool data.
Real-World Applications of AI Agents
Managed agent platforms
Microsoft Foundry Agent Service runs agents that work autonomously in the background, triggered by system events, to accomplish tasks on a user’s or organization’s behalf, sometimes with no chat interface at all. Each of those agents draws its reasoning from a model in the Foundry model catalog and reaches data through tools such as search, file operations, or API calls.
Security evaluation at a national standards body
CAISI used AgentDojo, a leading open-source framework for testing the vulnerability of AI agents developed by researchers at ETH Zurich, which consists of four environments that simulate real-world contexts: Workspace, Travel, Slack, and Banking. CAISI also augmented AgentDojo with new injection tasks covering remote code execution, database exfiltration, and automated phishing. The technical blog carrying those results was released on January 17, 2025, and updated on December 19, 2025.
Tool-connected assistants
Agents reach a user’s Google Calendar and Notion through MCP, acting as a more personalized AI assistant, while Claude Code can generate an entire web app using a Figma design, and enterprise chatbots connect to multiple databases across an organization.
Scenario: an agent handles a support request
A contact center agent asks the customer questions, looks up information in internal documents, and responds with a solution. Tools let it interact with external systems both to gather context and to take actions, selected dynamically depending on the workflow’s current state. If the attempt fails, the agent halts execution and transfers control back to the user.
Are AI Agents Safe to Deploy Without Human Oversight?
Not without controls. Many AI agents are currently vulnerable to agent hijacking through malicious instructions inserted into data the agent ingests, causing it to take unintended, harmful actions. Security must be a core requirement throughout the life cycle of the system, per the NCSC guidelines, which follow a secure-by-default approach. Human review at the moment an agent acts, rather than when it produces text, is the control most deployments still need.
Conclusion
Google Cloud, OpenAI, Microsoft, and AWS documentation all describe an AI agent as software that pursues goals and completes tasks on a user’s behalf, with enough autonomy to choose its own next action. Three components carry it: a model, instructions, and tools, per Microsoft Foundry Agent Service documentation. Everything else is packaging.
Attack success moved from 11% to 81% once red teamers adapted their attacks, and from 57% to 80% once each attack was retried 25 times. Read any capability list next to those numbers before signing off on a deployment. Autonomy is what the technology sells, and it is also what an attacker borrows.
