What is an AI agent: a plain definition, where it fails and how to start small

An AI agent is a language model that chooses its own next step

What is an AI agent? Ask five vendors and you will hear five answers, each shaped by what the vendor sells. Anthropic, in its article Building effective agents, describes agents as systems where language models dynamically direct their own processes and tool usage. OpenAI’s practical guide to building agents needs one line: agents are systems that independently accomplish tasks on your behalf. IBM calls an agent a system that autonomously performs tasks by designing workflows with available tools.

Anthropic’s shorthand is blunt: agents are typically just language models using tools in a loop, guided by feedback from their environment. Take a customer who writes that a parcel has not arrived. An agent finds the order, opens the carrier’s tracking page and prepares an answer with the real status for a manager to approve. Nobody wrote those steps down in advance, and that freedom is both the point of an agent and the source of its risks.

Agent, chatbot and automation: three different machines

Automation follows a route that a person drew beforehand: a form arrives, a deal is created, a letter goes out. Anthropic calls such systems workflows, in which models and tools are orchestrated through predefined code paths. The same input gives the same result every time. The weakness shows only when a case falls outside the rules somebody wrote.

A chatbot talks: it answers a question and waits for the next message. OpenAI states that applications which include a language model but do not let it control how the work is carried out, simple chatbots among them, are not agents. IBM describes non-agentic chatbots as ones without tools, memory or reasoning. That is not a defect, because where the job is to answer, a chatbot is the right tool.

An agent borrows from both: it converses like a chatbot and acts like automation, but picks the route itself. Anthropic notes that its own customers use the word both for fully autonomous systems and for tightly prescribed ones. For an owner the label matters less than who decides the next step: the script, the person or the model. A separate guide, linked at the end of this article, compares the three task by task.

The parts of an agent: model, instructions, tools, memory, stop rule

OpenAI’s guide reduces an agent to three core components: the model that reasons and decides, the tools it may use, and the instructions that define how it behaves. The instructions are yours and read like a job description. OpenAI advises building them from documents a company already has, such as operating procedures, support scripts and policies. Where an instruction is vague, the agent fills the gap with a guess.

Tools map onto access rights. The guide separates data tools that fetch context, such as a query to a CRM, from action tools that change something, such as sending an email or updating a record. Memory is a further part: IBM speaks of an agent’s ability to store past interactions. The last part is the rule that ends the work, and OpenAI names an error or a maximum number of turns among common exit conditions.

Tasks a small company can hand to an agent today

OpenAI suggests looking first at work that has resisted ordinary automation and names three signs: decisions that call for judgement, rules too tangled to maintain, and heavy reliance on unstructured data such as letters and documents. If a task shows none of them, the guide says, a deterministic solution may suffice. A small company meets those signs every morning in the inbox. Requests arrive in free form, and somebody has to read them and decide where they go.

That gives a realistic first list. An agent can sort incoming mail and messages by topic and urgency. It can prepare a reply for a manager to approve, gather what is publicly known about a new lead, or assemble a draft of the weekly report. Anthropic singles out customer support as a natural fit, with order history and knowledge base articles as tools and a clear measure of success. In every example the agent collects and drafts, and a person signs.

Where agents fail: compounding errors, cost and hidden instructions

The first weakness follows from the loop itself. Each step rests on the one before, so a small mistake made early is carried forward and enlarged. Anthropic puts it directly: the autonomous nature of agents means higher costs and the potential for compounding errors. IBM adds the agent that cannot build a full plan and keeps calling the same tools in an endless loop.

The second is cost and speed. An agent does not answer in one pass: it reads, calls a tool, reads the result and reasons again, and every round takes time and is paid for. Anthropic notes that agentic systems often trade latency and cost for better task performance, and advises the simplest solution possible, which may mean no agent at all. IBM warns that, depending on the complexity of the task, agents can take several days to finish.

The third is specific to systems that read. An agent cannot always tell your instruction from one that somebody planted in a web page, a file or an incoming email. OWASP gives prompt injection the first place in its 2025 list of risks for language model applications, and notes that the planted text does not even have to be visible to a human reader. It is frank about the defence too: it is unclear whether fool-proof methods of prevention exist.

Guard rails: read-only access, human approval, a log of every step

None of this is a reason to refuse agents; it is a reason to give them less than they could use. OWASP advises restricting the model’s access privileges to the minimum necessary. Its page on excessive agency describes a mail assistant that only has to summarise letters but can also send them, so one crafted incoming email makes it forward private correspondence to a stranger. The remedy listed there is modest: a tool that only reads mail, a read-only scope, and a user who sends every drafted message by hand.

The second rail is a person at the points where a mistake cannot be undone. OpenAI’s guide recommends rating each tool as low, medium or high risk by whether it only reads or also writes, whether its effect can be reversed and what money is at stake. Sensitive, irreversible or high-stakes actions, such as cancelling an order, authorising a large refund or making a payment, go to a human. IBM gives the same advice with its own examples, from mass emails to financial trading.

The third rail is a record. IBM recommends giving users access to a log of the agent’s actions, because it shows how a decision was reached and offers a chance to discover errors. OWASP advises logging and monitoring the activity of the tools as well, and Anthropic adds extensive testing in a sandboxed environment. Together the sources describe one discipline: narrow rights, a human hand on irreversible steps and a trace of every action.

How to tell whether an agent earns its keep

An agent is paid for with attention as well as money, because somebody has to check its work. The measure is therefore set before the launch, not after it. OpenAI advises starting with evaluations that establish a performance baseline, and Anthropic sums up its own approach as measuring performance and iterating. For a small company this is a notebook exercise: write down how long the chosen task takes a person today, how often the result has to be redone and what a mistake costs.

Then count the same things with the agent in place. Few figures are needed. They are the share of drafts a manager accepts without edits, the share of cases the agent hands back, the time from request to answer and the model bill per completed task. If the drafts still need rewriting after several weeks, narrow the task or return to plain automation rather than add a second agent.

One narrow task first, and what to prepare before ordering an agent

On scale, Anthropic and OpenAI agree: start small. OpenAI observes that its customers do better with an incremental approach than with a fully autonomous system built in one go. Choose one task with a clear beginning and end, a tolerable price of error and a person who knows it well. Then put four things on paper: the steps as that person performs them, the documents the work relies on, the systems the agent would open, and a set of past cases with the outcome you consider correct.

Whether to build it yourself depends on where the task lives. If it stays inside one service that already includes an assistant and touches no customer data, trying it on your own teaches a great deal at little risk. If the agent must be connected to a CRM, a mailbox or a payment system, that is development work, and it is reasonable to order it from a team that does this, VITON13 Studio among them. Once the brief exists, the question “what is an AI agent” matters less than a narrower one: which single task deserves to be handed over first.