What is an agent?

What is an agent? It is a program in which a language model does not just answer, but decides what to do next: it picks a tool, uses it, looks at the result and repeats until the task is done or it needs your input. A chatbot replies to one message at a time. An agent works towards a goal over several steps.

Two definitions from the companies building them

Google Cloud defines agents as software systems that pursue goals and complete tasks on behalf of users, showing reasoning, planning and memory, with "a level of autonomy to make decisions, learn, and adapt".

Anthropic draws a line that is useful in practice, between two kinds of "agentic systems":

• Workflows: language models and tools "orchestrated through predefined code paths". The steps are decided in advance by a developer.
• Agents: "systems where LLMs dynamically direct their own processes and tool usage, maintaining control over how they accomplish tasks".

Both definitions agree on the core: a goal, tools, and a loop in which the model chooses the next action.

Agent, assistant or bot?

Google Cloud separates three things that are often mixed up:

The same product can be all three. A chat assistant becomes an agent when it is allowed to plan and use tools on its own, such as searching, writing files or running code, before coming back to you.

How an agent works, step by step

1. It receives a goal, as a command or in a conversation with you.
2. It plans what to do first.
3. It acts by calling a tool: a search, an API, a database query, a code run.
4. It observes the result. Anthropic stresses that agents need "ground truth" from their environment at each step, such as tool results or code execution, to judge progress.
5. It decides the next step, repeating until the goal is met, a stopping condition is hit (for example, a maximum number of steps) or it needs your judgement.

This reason-act-observe loop goes back to research such as ReAct (Yao and colleagues, 2022), which combined reasoning and acting in language models, and which Google Cloud cites as the basis of agents' key features.

Where the tools come from

An agent is only as useful as the tools it can reach. Increasingly those tools are connected through the Model Context Protocol (MCP), an open standard that lets one tool server work with any compatible app.

Real examples

• Coding agents that read a codebase, edit several files and run the tests. Anthropic reports that its agents can solve real GitHub issues in the SWE-bench Verified benchmark "based on the pull request description alone", while noting that "human review remains crucial". Two such tools are compared in Claude Code vs Cursor.
• Customer support agents that combine a chat interface with actions such as looking up an order or issuing a refund.
• Research agents that search, read and summarize several sources before answering. Looking things up in a knowledge base is the job of retrieval-augmented generation, which an agent can use as one of its tools.

Anthropic's description of where agents have worked best fits all three: tasks that need "both conversation and action", have clear success criteria and keep a human in the loop.

When you do not need an agent

Anthropic's advice to developers is to find "the simplest solution possible" and add complexity only when needed: "this might mean not building agentic systems at all". Agents trade speed and cost for better results on open-ended tasks, and their autonomy brings "the potential for compounding errors", which is why Anthropic recommends "extensive testing in sandboxed environments, along with the appropriate guardrails". For a fixed, repeatable process, a predefined workflow is often cheaper and more predictable.

The main risks

The OWASP Top 10 for LLM applications (2025) lists two risks that apply directly to agents:

• Prompt injection (LLM01): instructions hidden in a web page, email or document the agent reads can change what it does.
• Excessive agency (LLM06): giving the agent more permissions or autonomy than the task needs, so a mistake or an injected instruction can do real damage.

The practical answer is the same in both cases: give the agent only the tools and permissions the task needs, require confirmation before irreversible actions and log what it does.

Agents also inherit a basic weakness of language models: they can state false things fluently, and an agent may act on them. Our guide to model hallucinations explains why this happens and how to reduce it.

For costs, use cases and how to decide whether an agent is worth it for your company, see agents for business.