AI agent

Architecturally, an agent is a control loop wrapped around a stateless model. The harness sends the model a context containing the goal, a system prompt, the conversation so far and a set of tool definitions (name, natural-language description, JSON Schema for the arguments). The model replies either with text or with one or more structured tool calls; the harness validates and executes each call, appends the result to the context as a tool-result message, and calls the model again. The loop ends when the model emits a final answer, a step or token budget is exhausted, or a human interrupts. The pattern was popularised by ReAct (Yao et al., 2022), which interleaved "thought", "action" and "observation" steps, and became a product feature with native function calling in commercial APIs from 2023; the Model Context Protocol later standardised how tools and data sources are exposed to such loops.

The model itself never executes anything. Every capability an agent has is granted by the harness: which tools are registered, which credentials those tools run with, whether calls are auto-approved or queued for confirmation, and what the sandbox allows (file system, network egress, shell). This is why a common distinction, used for example in Anthropic's "Building effective agents" (2024), separates workflows, where code fixes the sequence of LLM calls, from agents, where the model chooses the next step dynamically. Workflows are easier to test and audit; agents trade predictability for flexibility on open-ended tasks.

Failure modes differ from those of a chat assistant. Errors compound over many steps, so a small misreading early on can lead to a long chain of confident but wrong actions. Long runs fill the context window with tool output, which degrades recall and is the main driver of context engineering techniques such as summarising or pruning results. Agents can loop, repeat a failing call, or declare success without verifying it, so production harnesses add step limits, cost limits, timeouts and explicit verification steps such as running tests.

The security model is dominated by the fact that tool results are just more text in the context. Anything the agent reads - a web page, an email, a file in a repository - can carry indirect prompt injection that redirects the next tool call. OWASP's Top 10 for LLM Applications 2025 lists this as LLM01 Prompt Injection and the resulting over-permissioned behaviour as LLM06 Excessive Agency, broken down into excessive functionality, excessive permissions and excessive autonomy. The practical controls follow from that decomposition: register only the tools a task needs, run them under a dedicated service account with least privilege rather than a user's own token, require human-in-the-loop approval for irreversible or costly actions, isolate execution in a sandbox, and log every tool call with its arguments so actions can be reconstructed afterwards.