{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"ai/ai-agent","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/ai/ai-agent/","da":"https://cmaintz.github.io/tech-atlas/da/terms/ai/ai-agent/"},"term":{"en":"AI agent","da":"AI-agent"},"aka":{"en":["agentic AI"],"da":["agentisk AI"]},"domain":["ai"],"cluster":"llm","layer":"agent","status":"emerging","era":2023,"summary":{"en":"An AI system that does not just answer but acts - it plans steps and uses tools such as email, files or web search to reach a goal.","da":"Et AI-system, der ikke bare svarer, men handler - det planlægger trin og bruger værktøjer som mail, filer eller websøgning for at nå et mål."},"body":{"formal":{"en":"A system, usually built around a large language model, that is given a goal and tool access, then chooses and carries out actions in a loop - calling tools, reading results, deciding the next step - with little human input.","da":"Et system, typisk bygget op om en stor sprogmodel, der får et mål og adgang til værktøjer og derefter vælger og udfører handlinger i en løkke - kalder værktøjer, læser resultater, beslutter næste trin - med lidt menneskelig indblanding."},"plain":{"en":"Like an assistant given your keys and a to-do list rather than a chat window - useful, but only as safe as the keys you hand over.","da":"Som en assistent, der får dine nøgler og en huskeliste i stedet for et chatvindue - nyttig, men kun så sikker som de nøgler, du giver fra dig."},"inPractice":{"en":"A ministry tests an agent that arranges meetings - it reads officials' calendars, books rooms and sends invitations under its own account, and every action it takes is logged for review.","da":"Et ministerium afprøver en agent, der arrangerer møder - den læser medarbejdernes kalendere, booker lokaler og sender invitationer fra sin egen konto, og hver handling logges, så den kan gennemgås."},"whyItMatters":{"en":"An agent that reads untrusted text can be tricked into acting against its owner, so the harm it can do is set by what it may reach and do, not by how well it chats.","da":"En agent, der læser tekst, man ikke kan stole på, kan narres til at handle imod sin ejer, så den skade, den kan gøre, afhænger af, hvad den har adgang til og lov til - ikke af, hvor godt den svarer."}},"deepDive":{"en":"Architecturally, an agent is a control loop wrapped around a stateless model. The harness sends the model a context containing the goal, a system prompt, the conversation so far and a set of tool definitions (name, natural-language description, JSON Schema for the arguments). The model replies either with text or with one or more structured tool calls; the harness validates and executes each call, appends the result to the context as a tool-result message, and calls the model again. The loop ends when the model emits a final answer, a step or token budget is exhausted, or a human interrupts. The pattern was popularised by ReAct (Yao et al., 2022), which interleaved \"thought\", \"action\" and \"observation\" steps, and became a product feature with native function calling in commercial APIs from 2023; the Model Context Protocol later standardised how tools and data sources are exposed to such loops.\n\nThe model itself never executes anything. Every capability an agent has is granted by the harness: which tools are registered, which credentials those tools run with, whether calls are auto-approved or queued for confirmation, and what the sandbox allows (file system, network egress, shell). This is why a common distinction, used for example in Anthropic's \"Building effective agents\" (2024), separates workflows, where code fixes the sequence of LLM calls, from agents, where the model chooses the next step dynamically. Workflows are easier to test and audit; agents trade predictability for flexibility on open-ended tasks.\n\nFailure modes differ from those of a chat assistant. Errors compound over many steps, so a small misreading early on can lead to a long chain of confident but wrong actions. Long runs fill the context window with tool output, which degrades recall and is the main driver of context engineering techniques such as summarising or pruning results. Agents can loop, repeat a failing call, or declare success without verifying it, so production harnesses add step limits, cost limits, timeouts and explicit verification steps such as running tests.\n\nThe security model is dominated by the fact that tool results are just more text in the context. Anything the agent reads - a web page, an email, a file in a repository - can carry indirect prompt injection that redirects the next tool call. OWASP's Top 10 for LLM Applications 2025 lists this as LLM01 Prompt Injection and the resulting over-permissioned behaviour as LLM06 Excessive Agency, broken down into excessive functionality, excessive permissions and excessive autonomy. The practical controls follow from that decomposition: register only the tools a task needs, run them under a dedicated service account with least privilege rather than a user's own token, require human-in-the-loop approval for irreversible or costly actions, isolate execution in a sandbox, and log every tool call with its arguments so actions can be reconstructed afterwards.","da":"Arkitektonisk er en agent en kontrolløkke omkring en tilstandsløs model. Harnessen sender modellen en kontekst med målet, en systemprompt, samtalen indtil nu og et sæt værktøjsdefinitioner (navn, beskrivelse i naturligt sprog og et JSON Schema for argumenterne). Modellen svarer enten med tekst eller med et eller flere strukturerede værktøjskald; harnessen validerer og udfører hvert kald, lægger resultatet ind i konteksten som en værktøjsresultat-besked og kalder modellen igen. Løkken stopper, når modellen giver et endeligt svar, når et budget for trin eller tokens er brugt op, eller når et menneske afbryder. Mønstret blev kendt med ReAct (Yao m.fl., 2022), der vekslede mellem \"tanke\", \"handling\" og \"observation\", og blev en produktfunktion med indbygget function calling i de kommercielle API'er fra 2023; Model Context Protocol har siden standardiseret, hvordan værktøjer og datakilder stilles til rådighed for sådanne løkker.\n\nModellen udfører aldrig selv noget. Alle agentens evner gives af harnessen: hvilke værktøjer der er registreret, hvilke legitimationsoplysninger de kører med, om kald godkendes automatisk eller sættes i kø til bekræftelse, og hvad sandkassen tillader (filsystem, udgående netværk, shell). Derfor skelner man ofte, fx i Anthropics \"Building effective agents\" (2024), mellem workflows, hvor koden fastlægger rækkefølgen af LLM-kald, og agenter, hvor modellen selv vælger næste trin. Workflows er lettere at teste og revidere; agenter bytter forudsigelighed for fleksibilitet på åbne opgaver.\n\nFejlmønstrene er anderledes end hos en chatassistent. Fejl hober sig op over mange trin, så en lille fejllæsning tidligt kan føre til en lang kæde af selvsikre, men forkerte handlinger. Lange kørsler fylder kontekstvinduet med værktøjsoutput, hvilket forringer genkaldelsen og er hoveddrivkraften bag context engineering-teknikker som at opsummere eller beskære resultater. Agenter kan køre i ring, gentage et fejlende kald eller melde succes uden at have tjekket den, så produktionsopsætninger tilføjer grænser for antal trin og omkostninger, timeouts og eksplicitte verifikationstrin som at køre tests.\n\nSikkerhedsbilledet domineres af, at værktøjsresultater blot er mere tekst i konteksten. Alt, hvad agenten læser - en webside, en mail, en fil i et repository - kan bære indirekte prompt injection, der omdirigerer det næste værktøjskald. OWASP Top 10 for LLM Applications 2025 har dette som LLM01 Prompt Injection og den deraf følgende overdrevne handlefrihed som LLM06 Excessive Agency, opdelt i for meget funktionalitet, for mange rettigheder og for meget autonomi. De praktiske kontroller følger af den opdeling: registrér kun de værktøjer, opgaven kræver, kør dem under en dedikeret servicekonto med mindste privilegium i stedet for brugerens eget token, kræv menneskelig godkendelse (human-in-the-loop) før uigenkaldelige eller dyre handlinger, isolér udførelsen i en sandkasse, og log hvert værktøjskald med dets argumenter, så handlinger kan rekonstrueres bagefter."},"edges":[{"type":"requires","to":"ai/large-language-model","confidence":"high","strength":"normal"},{"type":"requires","to":"ai/prompt","confidence":"high","strength":"normal"},{"type":"used-with","to":"cs/least-privilege","why":{"en":"Give an agent only the tools and rights its task needs, so a tricked or faulty agent can do little harm.","da":"Giv en agent kun de værktøjer og rettigheder, opgaven kræver, så en narret eller fejlende agent kan gøre lidt skade."},"confidence":"high","strength":"primary"},{"type":"used-with","to":"cs/service-account","why":{"en":"An agent should act through its own account, not a person's, so its rights can be limited and its actions traced.","da":"En agent bør handle gennem sin egen konto, ikke en persons, så dens rettigheder kan begrænses og dens handlinger spores."},"confidence":"medium","strength":"normal"},{"type":"used-with","to":"cs/log","confidence":"high","strength":"normal"},{"type":"used-with","to":"ai/prompt-injection","confidence":"high","strength":"normal"},{"type":"used-with","to":"ai/reinforcement-learning","why":{"en":"Agents that act step by step are often improved with rewards for finishing tasks well.","da":"Agenter, der handler trin for trin, forbedres ofte med belønning for at løse opgaver godt."},"confidence":"medium","strength":"normal"},{"type":"used-with","to":"ai/human-in-the-loop","why":{"en":"An agent that can act should pause for a person before steps that are costly or hard to undo.","da":"En agent, der kan handle, bør stoppe og spørge en person før trin, der er dyre eller svære at gøre om."},"confidence":"medium","strength":"normal"}],"depth":4,"sources":[{"title":"Russell & Norvig, Artificial Intelligence: A Modern Approach","tier":"textbook","publisher":"Pearson"},{"title":"OWASP Top 10 for Large Language Model Applications (Excessive Agency)","tier":"reference","publisher":"OWASP"},{"title":"NIST AI 100-1 - Artificial Intelligence Risk Management Framework (AI RMF 1.0)","tier":"standard","publisher":"NIST"}],"draft":true}