What Is an AI Agent?

If you search this question you will mostly find the same answer: an AI agent perceives its environment, reasons about a goal, acts through tools, and learns from the result. Then a taxonomy of five types — simple reflex, model-based reflex, goal-based, utility-based, learning.

That taxonomy is real. It comes from Russell and Norvig's Artificial Intelligence: A Modern Approach, it has been taught for thirty years, and it is close to useless if you are trying to decide what to build on Tuesday. Nobody has ever shipped something and thought this is a utility-based agent, therefore I should do X.

Here is the definition that does change what you build.

Agents versus workflows

In Building Effective Agents, published in December 2024, Anthropic's engineering team drew the line that matters. Both are agentic systems. The difference is who decides the path:

Workflows are systems where LLMs and tools are orchestrated through predefined code paths.

Agents are systems where LLMs dynamically direct their own processes and tool usage, maintaining control over how they accomplish tasks.

That is the whole distinction, and it is architectural rather than philosophical. In a workflow, you wrote the sequence: extract the invoice fields, look up the vendor, flag anything over a threshold, write to the ledger. The model does the hard cognitive bits at each step, but the steps are yours and they are the same every time.

In an agent, you hand the model a goal and a set of tools, and it decides which tool to call, in what order, and when it is finished. You do not know in advance how many steps it will take, because you cannot know.

Everything that is genuinely different about agents follows from that one property. You cannot unit-test a path you did not write. You cannot predict the cost of a run whose length is decided at runtime. Errors compound across steps you did not enumerate. This is why should this be an agent? is a real engineering question and not a branding one — and we have a longer treatment of exactly that decision in AI agent vs workflow vs single call.

The four parts of an agent

Strip away the marketing and every agent is the same four things wired into a loop.

A model that decides what to do next. Tools it can call to affect the world or gather information. Context — the instructions, history, and retrieved material it reasons over. A loop that feeds each tool result back in and asks for the next decision, until the model says it is done or a limit stops it.

The loop is the part people underestimate. It is what turns a language model into something that can take twenty actions on your behalf, and it is also where the failure modes live. The agentic loop explained covers the mechanics; how to design tools your AI agent can actually use covers the part most teams get wrong first, because a tool description is a prompt the model reads and most of them are written like internal API docs.

Notice what is not on that list: learning. Almost no production agent updates its own weights. The learning agent of the textbook taxonomy is, in practice, a memory system and an eval suite — see memory for AI agents.

Autonomy is a dial, not a category

The useful mental model is not is this an agent, yes or no. It is: how much of the path did the model choose?

At one end, a single call with no tools. Then a fixed pipeline of several calls. Then a workflow with a routing step, where the model picks a branch but you wrote the branches. Then an agent with a bounded loop — free choice of tools, but a hard cap on iterations, spend, and blast radius. Then, at the far end, an open-ended agent that runs until it decides otherwise.

Almost all good production systems sit in the middle, and Anthropic's own guidance says so plainly:

When building applications with LLMs, we recommend finding the simplest solution possible, and only increasing complexity when needed.

Agents earn their complexity in a specific case, which they also name: open-ended problems where it's difficult or impossible to predict the required number of steps, and where you can't hardcode a fixed path. Debugging an unfamiliar codebase qualifies. Extracting fields from an invoice does not, however much nicer invoice agent sounds on a slide.

The evidence for restraint

There is a real result worth sitting with before you commit to autonomy.

In July 2025, METR ran a randomised controlled trial with 16 experienced open-source developers across 246 tasks in repositories they already knew well. Before starting, the developers forecast that AI tooling would make them 24% faster. Afterwards, they estimated they had been 20% faster. Measured against the clock, they were 19% slower.

The narrowness matters and should be stated: experienced developers, mature codebases they knew intimately, a specific set of tools at a specific moment. It does not generalise to all AI-assisted work, and the authors are careful about that. But the perception gap is the finding, and it is the one that should inform how you evaluate your own agent. Everyone involved believed they were faster. The belief was sincere, universal, and wrong by nearly forty points.

Which is the argument for writing evals before you scale anything. Whether an agent works is a measurement, and your impression of it is not evidence.

Where the risk changes

The moment a system chooses its own actions, its security model changes, and this is the part most what is an AI agent explainers omit entirely.

An agent that reads untrusted content — a web page, an email, a PDF, a tool result — is reading text that may contain instructions. Language models do not reliably distinguish content to reason about from instructions to follow, which is why prompt injection is an architectural problem rather than a prompting one. Combine that with tool access and the ability to send data outward, and you have built something an attacker can drive.

Guardrails and safety for AI agents covers the layered controls. The short version: scope tools to least privilege, cap iterations and spend, and require human approval for anything irreversible.

So: what is an AI agent?

A system where a language model decides its own sequence of actions using tools, in a loop, to reach a goal you specified.

Not a chatbot with a personality. Not a workflow with a good marketing name. Not a model with a long context window. The test is whether you could draw the flowchart before the run — if you could, you have a workflow, and that is usually the better thing to have.

If you are deciding right now, Decide Whether Your Task Actually Needs an Agent runs the compounding-reliability arithmetic and prices the cheaper architectures against it. How to build your first AI agent is the next step once you have concluded that you genuinely need one, and the AI development pack collects the rest.

Sources

• Anthropic, Building Effective Agents, 19 December 2024 — the workflow/agent distinction, and the recommendation to find the simplest solution and add complexity only when needed
• METR, Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity, July 2025 — 16 developers, 246 tasks in familiar repositories; forecast 24% faster, self-assessed 20% faster, measured 19% slower
• Stuart Russell and Peter Norvig, Artificial Intelligence: A Modern Approach — the origin of the simple-reflex / model-based / goal-based / utility-based / learning agent taxonomy