Agentic AI

This page is an overview of agentic AI: language models that do not stop at an answer but take actions to finish a task. It covers what an agent is made of, how the idea developed, and what to watch out for. It stays at the level of concepts; individual agent products appear only as examples.

From chatbot to agent

A chatbot receives a message and returns text. If you ask it to fix a bug, it tells you what to change. You copy the code, run it, and report back. You are the one who acts.

An agent takes over those steps. It reads the files, edits the code, runs the tests, sees that one still fails, and tries again. It works toward a goal over many steps and decides each next step from what it has seen so far.

An agent combines four parts:

• A model that understands the goal and decides what to do next.
• Tools that let it read information and change things outside the conversation.
• A loop that feeds the result of each action back to the model.
• A goal and a condition for when the work is done.

Agency is a scale, not a switch. A system that calls one search before answering is slightly agentic. A system that works for an hour on a codebase, with dozens of tool calls and no human input, is highly agentic.

Agents before language models

The word “agent” is older than language models. AI textbooks have long defined an agent as anything that perceives its environment and acts on it. Earlier agents existed in several forms:

• Rule-based bots followed scripted conversation trees. Customer service bots and frameworks such as the Microsoft Bot Framework worked this way.
• Reinforcement learning agents such as AlphaGo learned to act in one narrow environment, like a board game.
• Robotic process automation (RPA) replayed recorded clicks and keystrokes in business applications.

Each was limited to the situations it was built for. Language models changed that, because one general model can understand a goal written in plain words and decide how to approach it.

The agent loop

Every LLM agent runs some version of the same loop. In 2022, the research paper “ReAct” described it as alternating between reasoning and acting: the model thinks about what to do, takes an action, observes the result, and thinks again.

flowchart TD
  goal["Goal from the user"] --> model["Model decides the next step"]
  model -->|"tool call"| harness["Harness runs the tool"]
  harness -->|"result"| model
  model -->|"done"| answer["Final answer or finished work"]

The model never touches files, the network, or other systems directly. It only produces text. When that text is a request to use a tool, the software around the model executes the request and sends the result back as new input. That software is the harness.

Tools

A tool is a function the model is allowed to request. The application describes each tool with a name, a description, and the parameters it accepts, usually as JSON Schema. A typical definition looks like this; the exact field names differ between providers:

1
{
2
  "name": "get_weather",
3
  "description": "Returns the current weather for a city.",
4
  "input_schema": {
5
    "type": "object",
6
    "properties": {
7
      "city": { "type": "string" }
8
    },
9
    "required": ["city"]
10
  }
11
}

When the model decides it needs the weather, it returns a structured request such as get_weather with {"city": "Vienna"} instead of normal text. The application calls a real weather service and returns the answer to the model. Providers call this function calling or tool use. OpenAI added it to its API in June 2023, and the other major providers followed.

Tools fall into a few groups:

• Read tools fetch information: web search, file reading, database queries.
• Write tools change something: editing files, sending an email, creating a ticket.
• Code execution lets the model write and run a program, which covers exact calculation and data analysis.
• Computer use lets the model see screenshots and control a mouse and keyboard, so it can operate applications that have no API. Anthropic introduced it in October 2024.

Read tools are low risk. Write tools are where an agent’s mistakes have consequences.

The harness

The harness is everything around the model that turns it into a working agent. Two products can use the same model and behave very differently, because their harnesses differ. A harness is responsible for:

• Instructions. A system prompt that describes the agent’s role, rules, and working style. Many coding agents also read project files such as AGENTS.md with conventions for that codebase.
• Tool management. Offering the right tools, executing the calls, and returning results in a form the model can use.
• Context management. Deciding what goes into the limited context window. Long tasks produce more text than fits, so the harness summarizes or drops older steps.
• Memory. Storing facts, notes, or plans in files or a database, so they survive beyond one conversation.
• Permissions. Deciding which actions run automatically and which need human approval, and running risky actions in a sandbox.
• Sub-agents. Splitting a large task and handing parts to separate model instances with their own context.
• Stopping. Recognizing when the goal is reached, when the agent is stuck, or when a budget for time or cost is used up.

Coding agents are the most developed harnesses today. Products such as Claude Code, OpenAI’s Codex, Cursor, and GitHub Copilot’s agent mode wrap a model with file access, a terminal, search, and version control. Many harnesses also support skills: folders with instructions and scripts that the agent loads only when a task needs them. AI in software development covers how these tools change programming work.

Protocols that connect agents

Every tool used to need custom integration code for each agent product. Two open protocols reduce that work.

The Model Context Protocol (MCP), published by Anthropic in November 2024, standardizes how an agent connects to external tools and data. A service provides an MCP server once, and any agent that supports MCP can use it. It was adopted widely in 2025, including by OpenAI, Google, and Microsoft.

The Agent2Agent protocol (A2A), announced by Google in April 2025, standardizes how agents from different vendors find each other and hand over tasks.

How agentic AI evolved

The early autonomous agents of 2023 failed mostly because the models made too many small errors, and errors add up over a long chain of steps. The progress since then came from better models, and as much from better harnesses: tighter tools, better context management, and clear points for human review.

Workflows and autonomous agents

Not every AI automation needs full autonomy. A useful distinction separates two designs:

• A workflow follows steps that a person defined in advance. A model may handle some steps, such as summarizing or classifying, but the path is fixed.
• An autonomous agent decides the steps itself, based on the goal and what it observes.

Workflows are predictable, cheaper, and easier to test. Agents handle open-ended tasks where the steps cannot be known in advance. A common recommendation is to start with the simplest design that works and add autonomy only where it pays off. Two well-known tools show the two ends of this range.

n8n

n8n is a workflow automation platform from Berlin, founded in 2019. You build workflows on a visual canvas by connecting nodes: a trigger such as a webhook, a schedule, or a new email, then steps that call services, transform data, and branch on conditions. It has more than a thousand ready-made integrations. You can use it as a cloud service or host it yourself under its source-available “fair-code” license.

n8n added AI nodes for model calls, and an AI Agent node that gives a model memory and a set of tools as one step inside a workflow. That makes it a good fit for the middle ground: a fixed process with an AI step where judgment is needed, such as reading incoming invoices, extracting the fields, and routing anything unusual to a person. n8n has since added standalone agents that keep memory between runs and can use existing workflows as tools, so both designs live in one place. Zapier and Make are commercial tools in the same category.

OpenClaw

OpenClaw is an open-source personal agent, released under the MIT license. Peter Steinberger started it in November 2025 as Clawdbot. After a trademark request from Anthropic it became Moltbot, and on 30 January 2026 OpenClaw, by which time it was one of the most discussed AI projects of the year. An independent non-profit foundation now maintains it. It runs continuously on the user’s own computer or server and is reached through messaging apps such as WhatsApp, Telegram, Slack, or Discord. It works with models from different providers, keeps long-term memory in local files, can run scheduled tasks, and can be extended with skills shared by its community.

OpenClaw shows the autonomous end of the range. With access to email, calendar, files, a browser, and the shell, it can carry out errands without step-by-step instructions. That same access is the risk: security researchers reported installations exposed to the internet and malicious skills shared in its community registry. It is a clear example of why the controls in the next section matter.

Risks and controls

An agent can do anything its tools allow, including the wrong thing. The main risks:

• Compounding errors. A small mistake early in a long task can lead every later step in the wrong direction.
• Prompt injection. An agent reads web pages, emails, and documents. Any of them can contain hidden text that instructs the model to do something else, such as sending private data to an attacker. Models cannot reliably tell the user’s instructions from instructions inside the data.
• Excessive permissions. An agent with broad access to email, files, and payment systems turns a single wrong decision into real damage.
• Cost. Long loops use many tokens. An agent stuck in a loop keeps spending money.

The security researcher Simon Willison named a dangerous combination the “lethal trifecta”: an agent that has access to private data, reads untrusted content, and can communicate externally. An agent with all three can be tricked into sending private data to an attacker.

Common controls follow from those risks. Give an agent only the tools and permissions the task needs. Run it in a sandbox or a separate account. Require human approval for actions that cannot be undone, such as payments, deletions, and sent messages. Log every tool call. Set limits on steps, time, and cost. And treat everything the agent reads from outside as untrusted input. AI safety and risks puts these risks in the wider context of AI safety.