Suppose you ask an assistant to suggest an outfit for today. It needs the local weather and your calendar, then must combine what it finds into a useful recommendation. A conventional voice assistant may answer a request it was programmed to handle; an agent can work through the steps of a broader goal, provided it has access to the necessary information. section 6.7
An AI agent is a system that takes actions autonomously while interacting with an environment. That environment might be a room, an application, or the web. A thermostat illustrates the basic idea: it senses temperature and adjusts heating or cooling. Today’s agents can go further by using information from tools to choose a next step, rather than only following a fixed response. section 8.1
Figure 8.1 An agent receives information from an environment and takes actions based on that information, its context, and prior training.
The diagram shows the central loop: an agent receives information from its environment and uses it, along with context and prior training, to select an action. section 8.1
Many current agents use a large language model (LLM), a system that generates text in response to input. Connecting its outputs to available actions lets it search, read files, call application interfaces, or execute other permitted tasks. A simple setup might use one tool and return an answer. A more capable setup can inspect a result, choose another tool, and continue until it can respond. For example, answering a question about a restaurant franchise might require reading sales data to identify its highest-grossing location, then searching the web for that location’s current review rating. section 8.1 section 8.12
Agents are being used for personal assistance, software development, security operations, research, and industrial workflows. Some assistants can carry context across sessions and break a high-level request, such as planning a trip, into actions. These capabilities should not be mistaken for reliable independence: full autonomy remains rare, and high-stakes decisions generally still call for human supervision. section 8.2 section 8.3 section 8.10
The ability to act raises the cost of mistakes. An incorrect answer can be corrected; an agent authorized to send an email, delete a file, or make a transaction may cause a harder-to-reverse problem. Vague goals can produce actions that satisfy the wording of a request but miss what a person intended. Malicious instructions hidden in a webpage or document can also redirect an agent that reads it—a risk called indirect prompt injection. section 8.18 section 8.20
Safer deployment therefore depends on limiting permissions, seeking approval before consequential actions, testing agents, and monitoring what they do after release. Tests alone cannot establish lasting safety: an agent’s behavior may change as its data, tools, or surroundings change. The practical question is not only what an agent can accomplish, but which actions people should allow it to take without checking first. section 8.20 section 8.24 section 8.25
