What Are AI Agents? How They Work and Where They Fail

What are AI agents?

An AI agent is a system that uses an AI model to work towards a goal, deciding which steps to take and carrying them out with tools, rather than only answering a single question. OpenAI's guide for builders puts it simply: agents are 'systems that independently accomplish tasks on your behalf' ^[2]. It adds that applications which use a large language model (LLM) but do not let it control the workflow, such as simple chatbots, single-turn models or sentiment classifiers, are not agents ^[2].

The UK's National Cyber Security Centre (NCSC) describes agentic systems as able to access data sources, remember context, make decisions, use tools and take actions in pursuit of a goal, sometimes without continuous human involvement and even by creating sub-agents ^[3]. It notes that this is what makes them useful but also more hazardous than non-agentic AI tools ^[3].

Are agents and workflows the same thing?

Not quite. Anthropic, the company behind Claude, calls both 'agentic systems' but draws a line between them. Workflows are systems in which LLMs and tools follow predefined code paths. Agents are systems in which the LLM dynamically directs its own process and tool use, keeping control over how it completes the task ^[1]. A customer-service bot that always follows the same three steps is a workflow; a system that decides for itself which pages to read, which files to change and when it is finished is an agent.

How do AI agents work?

OpenAI describes three core components ^[2]:

• Model: the LLM that does the reasoning and makes decisions.
• Tools: external functions or APIs, such as search, a code runner or a booking system, that the agent can use to gather information or take action.
• Instructions: explicit guidelines and guardrails that define how the agent should behave.

Anthropic calls the basic building block an 'augmented LLM': a model enhanced with retrieval, tools and memory, which can generate its own search queries, choose tools and decide what information to keep ^[1].

What does the agent loop look like?

According to Anthropic, an agent starts from a command or a discussion with a person. Once the task is clear, it plans and works independently, checking the 'ground truth' from its environment at each step, for example the result of a tool call or of running code ^[1]. It can pause for human feedback at checkpoints or when it gets stuck, and builders often add stopping conditions such as a maximum number of steps ^[1]. In Anthropic's words, agents are 'typically just LLMs using tools based on environmental feedback in a loop' ^[1].

OpenAI adds that an agent should recognise when a workflow is complete, correct its own actions where needed and, if it fails, stop and hand control back to the user ^[2].

How do agents connect to other apps?

Many agents use the Model Context Protocol (MCP), an open standard Anthropic released in November 2024 for connecting AI systems to data sources and tools ^[6]. In December 2025 Anthropic donated MCP to the Agentic AI Foundation, a directed fund under the Linux Foundation co-founded by Anthropic, Block and OpenAI; it said MCP had more than 10,000 active public servers and had been adopted by ChatGPT, Cursor, Gemini, Microsoft Copilot and Visual Studio Code ^[7].

What can AI agents do today?

As of 3 November 2026, the major AI assistants include agent features, though availability depends on plan and country. Examples:

• ChatGPT agent. Launched in July 2025, it works on its own virtual computer with a visual browser, a text browser, a terminal and API access, and can use connectors to apps such as Gmail and GitHub ^[4]. OpenAI says it asks permission before 'actions of consequence' and that users can interrupt or take over at any time ^[4]. OpenAI now marks that launch post as outdated and points readers to newer products, Workspace agents and ChatGPT Work ^[4].
• Gemini Spark. Google introduced it on 19 May 2026 as a '24/7 personal AI agent', first for trusted testers and in beta for Google AI Ultra subscribers aged 18 and over in the United States ^[5]. On 13 October 2026 Google built its Antigravity coding agent into the Gemini app for macOS; the agent builds and tests code in the background and notifies the user for review ^[5].
• Coding agents. These edit many files in a code base from a task description; Anthropic lists a coding agent that resolves SWE-bench software tasks and a 'computer use' agent among its own examples ^[1].

Developers are using agents, but not yet universally. In the 2025 Stack Overflow Developer Survey, among the 31,877 respondents who answered the question, 14.1% used AI agents at work daily, 9% weekly and 7.8% monthly or less often, while 37.9% said they did not plan to use them ^[12].

One attempt to track agent ability over time, by the research organisation METR, is described in the outlook section below ^[8].

How are AI agents different from chatbots and ordinary automation?

The differences come down to who decides the next step and whether the system acts in the world. A chatbot answers; an automation script follows fixed rules; an agent decides and acts.

OpenAI argues that agents suit work where rule-based approaches fall short, giving the example of payment fraud analysis: a rules engine works like a checklist, while an LLM agent can weigh context and subtle patterns ^[2]. It also says that if a task does not clearly need those abilities, 'a deterministic solution may suffice' ^[2]. Anthropic makes a similar point: start with the simplest solution and add complexity only when needed, which 'might mean not building agentic systems at all' ^[1]. Agentic systems often trade latency and cost for better task performance ^[1].

What are the risks of AI agents?

According to the NCSC, agentic systems inherit known LLM risks such as susceptibility to jailbreaking and prompt injection, and add new ones because they can act. It lists four additional risks ^[3]:

• Broader access to external systems, data and tools.
• Unpredictable behaviour, especially when a goal can be interpreted in ways a person would not expect.
• Problems that are harder to spot, because actions can happen faster than people can review them.
• Actions that are hard to explain, given the range of behaviours and tools involved.

What is prompt injection?

Prompt injection happens when input changes a model's behaviour in unintended ways ^[11]. In the indirect form, the harmful instructions sit in external content the agent reads, such as a website or a file ^[11]. OpenAI gives the example of a malicious prompt hidden in a web page and calls prompt injection a risk for agentic systems generally ^[4]. The OWASP Gen AI Security Project says it is unclear whether there are fool-proof ways to prevent it ^[11].

What happens when agents get it wrong?

Anthropic notes that autonomy brings higher costs and the potential for compounding errors ^[1]. In July 2025 Fortune reported that Replit's AI coding agent had deleted a live production database during a code freeze while the SaaStr founder Jason Lemkin was testing it; Replit's chief executive, Amjad Masad, called the deletion 'unacceptable' ^[13]. The business risk is real too: Gartner predicted in June 2025 that over 40% of agentic AI projects will be cancelled by the end of 2027 because of escalating costs, unclear business value or inadequate risk controls ^[10]. It also warned of 'agent washing', the rebranding of existing products such as AI assistants, robotic process automation and chatbots without substantial agentic capabilities, and estimated that only about 130 of the thousands of agentic AI vendors are real ^[10].

How can you use AI agents safely?

The following steps come from the NCSC, OWASP and the agent builders' own guidance. They apply to individuals as well as organisations.

1. Ask whether you need an agent. The NCSC suggests checking whether a process could be simplified or automated in a lower-risk way ^[3].
2. Start small. Begin with tightly bounded pilots and clearly defined, low-risk tasks, then widen the scope as confidence grows ^[3].
3. Give the least access possible. Grant only the minimum permissions, for the shortest time, and use temporary rather than long-lived credentials ^[3].
4. Keep a human in the loop for high-risk actions such as payments, deletions or messages sent in your name ^[11]. OpenAI calls human intervention a critical safeguard, especially early in a deployment ^[2].
5. Treat outside content as untrusted. OWASP recommends separating and clearly marking untrusted content such as web pages and documents ^[11].
6. Test in a sandbox first. Anthropic recommends extensive testing in sandboxed environments with appropriate guardrails ^[1].
7. Know who is accountable. The NCSC says humans remain responsible for deploying an agent, the access it was given and the consequences, and that someone must be able to stop it ^[3].

The NCSC's test is blunt: if you cannot understand, monitor or contain an agent's actions, it is not ready for deployment ^[3].

For readers in Iran: as of 3 November 2026, OpenAI's list of countries where ChatGPT is supported does not include Iran, and OpenAI warns that access from unlisted countries may lead to an account being blocked or suspended ^[14].

How fast are AI agents improving?

The research group METR proposed measuring agents by the length of tasks, timed by how long they take skilled humans, that an agent can complete ^[8]. In March 2025 it reported that this 'time horizon' had grown exponentially for six years, doubling roughly every seven months ^[8]. At that time, models succeeded almost always on tasks taking humans under 4 minutes but less than 10% of the time on tasks taking more than about 4 hours ^[8]. METR now notes that some of these original figures, including the doubling time, have been superseded by later estimates ^[8].

Measuring the newest systems has become harder. In May 2026 METR noted that measurements above 16 hours were unreliable with its current task suite, and on 8 September 2026 it said its time-horizon page was no longer actively updated ^[9]. METR also cautions that its tasks are mainly software, machine-learning and cybersecurity work, so a time horizon does not mean an AI can do every intellectual task of that length ^[9].

Forecasts remain uncertain. Gartner predicted that at least 15% of day-to-day work decisions will be made autonomously through agentic AI by 2028, up from none in 2024, and that 33% of enterprise software applications will include agentic AI by 2028, up from less than 1% in 2024 ^[10]. The NCSC expects significant benefits where tasks are repetitive, well understood and low risk, and urges organisations to plan for failure ^[3].