What Is an AI Agent?

An AI agent is an AI system that can take actions to complete a task, not just answer questions. You give it a goal, and it decides which steps to take, uses tools such as a web browser, email, a calendar or business software, and checks its progress as it goes. Today's AI agents can handle many multi-step digital tasks, but they still make mistakes and work best with clear limits and human oversight.

What an AI agent is

The idea of an agent is older than today's AI boom. The standard AI textbook, Artificial Intelligence: A Modern Approach by Stuart Russell and Peter Norvig, defines an agent as anything that can be viewed as perceiving its environment and acting on that environment. A thermostat that senses temperature and switches on the heat fits that broad definition.

When people talk about AI agents today, they usually mean something more specific: software built around a large language model that can decide what to do next and use tools to do it. Anthropic, which makes the Claude models, describes agents as systems where large language models "dynamically direct their own processes and tool usage, maintaining control over how they accomplish tasks."

The key word is decide. A traditional program follows steps a developer wrote in advance. An AI agent works out its own steps toward a goal, within the limits it has been given. The LATHIC Glossary has the short definition of an AI agent.

What an AI agent is made of

Most AI agents combine the same basic parts:

• A model that makes decisions. Usually a large language model. It reads the goal, plans the next step and chooses which tool to use.
• Instructions and a goal. What the agent is for, what it should accomplish and any rules it must follow.
• Tools. Ways to act in the world: searching the web, clicking through websites, reading and sending email, querying a database, running code. This capability is called tool use.
• Memory of the task. A record of what it has already done and learned, so it can keep track across many steps.
• Permissions and guardrails. Limits on what it can access and which actions need a person's approval.

Connecting agents to tools used to require custom work for each tool. Open standards now help. The Model Context Protocol, introduced by Anthropic in November 2024 and later donated to a Linux Foundation initiative, gives AI systems a common way to connect to outside tools and data.

An agent uses these parts in a repeating cycle: decide, act, check the result, decide again. That cycle, and the broader idea of AI that plans and acts, is explained in What Is Agentic AI?.

What AI agents can do today

AI agents are most capable at digital tasks that involve several steps across websites, documents and software. Examples from major AI companies show the range:

• Operating websites. OpenAI introduced ChatGPT agent in July 2025, which could navigate websites on its own virtual computer and asked permission before taking consequential actions. OpenAI has continued to expand its agent features since.
• Working across personal apps. Google launched Gemini Agent as an experimental feature in November 2025, describing it as able to manage calendars, add reminders, organize an inbox and draft replies for the user's approval.
• Writing and running software. Anthropic describes Claude Code as an agentic coding tool that reads a codebase, edits files and runs commands.
• Handling work tasks inside business software. Microsoft said in March 2026 that Copilot can break down complex requests into steps, reason across tools and files, and carry work forward with visible progress.
• Research. Agents can run many searches, read sources and compile the results into a report.

Capabilities are improving quickly. Research group METR found in March 2025 that the length of tasks frontier AI agents could complete with 50% reliability, measured by how long those tasks take human professionals, had been doubling roughly every seven months for six years.

What AI agents cannot do reliably

AI agents are useful, but independent testing shows clear limits.

Long and complex tasks still trip them up. In the same March 2025 research, METR found that the AI models it tested almost always succeeded on tasks that take a skilled person less than four minutes, but succeeded less than 10% of the time on tasks that take more than about four hours. These figures describe models tested in early 2025.

Realistic workplace tasks have low completion rates. TheAgentCompany, a research benchmark that simulates everyday work at a software company, found that the best agent it tested could complete 24% of tasks autonomously in December 2024. In a September 2025 revision, the best agent completed 30%.

Using computers the way people do is still hard. When Anthropic released Claude Sonnet 4.6 in February 2026, it said the model "still lags behind the most skilled humans at using computers."

They can be manipulated. An agent that reads webpages, emails or documents can encounter hidden instructions written to hijack it, a technique called prompt injection. In red-team testing published in August 2025, Anthropic reported that deliberate prompt injection attacks on its browser agent succeeded 23.6% of the time without its new safety measures.

Errors have consequences outside the chat. A misread instruction can mean a booking in the wrong name, a payment to the wrong account or a file saved over the right one, and small errors early in a long task can carry through later steps.

They need a clear goal. Vague instructions leave room for an agent to choose steps you did not intend.

They cannot take responsibility. An agent can carry out a decision, but a person or organization remains accountable for what it does.

AI agent vs chatbot

A chatbot responds to you in conversation. An AI agent takes actions for you. A chatbot's work ends with a reply; an agent's work continues until a task is done.

The line is blurring, because many chatbot products now include agent features. The useful question is not what a product is called, but whether it can take actions on your behalf, and which ones. For more on how chatbots work, see What Is a Chatbot?.

AI agents vs agentic AI

An AI agent is an individual system that takes actions toward a goal. Agentic AI is the broader term for AI that plans and acts with some independence, whether through one agent, several agents working together, or agentic features inside a larger product.

Put simply, agents are the working parts, and agentic AI is the approach they belong to.

AI agents vs traditional automation

Businesses have automated tasks for years with workflow tools and robotic process automation, software that follows fixed rules to repeat the same steps. AI agents differ in one important way: they can choose their steps instead of following a predefined script.

That flexibility is both the strength and the risk. Rule-based automation is predictable and easy to audit, but it breaks when something unexpected happens. An agent can adapt to new situations, but it is less predictable. Anthropic's own guidance for developers recommends starting with simple approaches and adding agentic systems "only when simpler solutions fall short."

Many real systems combine both: fixed rules for approvals and boundaries, with agents handling the steps that require judgment. The LATHIC Glossary covers this pattern under agentic workflow.

When an AI agent is a good fit

AI agents tend to work well when:

• The task is digital and multi-step, such as gathering information from several sources, updating records or preparing a draft.
• Success is easy to check, so a person can quickly confirm the result.
• Mistakes are cheap or reversible, or a person approves before anything irreversible happens.
• Access can be limited to only the accounts and data the task needs, a security practice called least privilege.

They are a poor fit, at least without close supervision, when:

• Decisions are high-stakes or irreversible, such as large payments, legal commitments or medical choices.
• The goal is ambiguous or depends on judgment that is hard to spell out.
• The agent would need broad access to sensitive systems or personal data.
• Nobody is responsible for reviewing its work.

A practical starting point is to give an agent read-only access first, require approval before it sends, buys or deletes anything, and check its activity log before widening what it can do.