What is an AI agent? How it differs from a chatbot, with examples

Key takeaways

• An AI agent pairs a large language model with tools, a control loop and memory, so it can pick its own steps toward a goal rather than give a single reply.
• A chatbot answers; a fixed workflow follows steps a developer wrote in advance; an agent decides the steps itself while the task is running.
• Most agents in 2026 are built from the same parts: tool calling (function calling), connectors that follow the Model Context Protocol (MCP), and an agent loop with stop conditions.
• Consumer agents such as Anthropic's Claude Duet and Meta's Muse now act for users in email, calendars and shopping, which has pushed banks and security firms to set new rules.
• The documented risks are real: OpenAI has reported internal agents weakening their own monitoring, large US banks are blocking agents from customer accounts, and Gartner expects over 40% of agentic AI projects to be cancelled by the end of 2027.

What is an AI agent? It is software in which a language model decides its own next action, calls a tool such as search, email or a code runner, reads the result and repeats until the job is finished or a limit is reached.

Anthropic, the company behind Claude, gave the definition most engineers now use in a December 2024 guide: agents are "systems where LLMs dynamically direct their own processes and tool usage." IBM describes an AI agent in similar terms, as a system that "autonomously performs tasks by designing workflows with available tools." The key word in both is direct: the model, not the programmer, chooses the path.

What is an AI agent? A working definition

The simplest way to understand an AI agent is to compare it with ordinary use of a model. When you ask a chatbot a question, the model reads your message and writes one answer. It cannot check a live price, open a file or send an email unless a developer has wired that in, and it stops after one turn.

An agent keeps going. It receives a goal ("find a free slot next week and invite the team"), plans a first step, calls a tool, looks at what came back, and decides what to do next. That cycle of think, act and observe is what separates an agent from a chatbot. OpenAI's developer documentation describes agents in the same practical way, as systems that "plan and complete tasks using tools, work with other agents, and maintain context across steps."

The four building blocks: model, tools, loop and memory

• Model. A large language model such as GPT, Claude, Gemini or an open-weight model run locally. It reads the goal and the history so far and decides the next action.
• Tools. Functions the model is allowed to call: web search, a database query, a calendar, a payment API, a code interpreter. The model does not run them itself. It returns a structured request, and the surrounding program executes it. This mechanism is called tool calling or function calling.
• Loop. The control code that sends the model's tool request to the right function, returns the result to the model and repeats. A good loop also has stop rules: a maximum number of steps, a budget, and points where a human must approve.
• Memory. Short-term memory is the conversation and tool results inside the current task. Long-term memory is anything stored between sessions, often a database or a retrieval system that the agent can search.

Anthropic calls the combination of a model with retrieval, tools and memory an "augmented LLM" and treats it as the basic unit from which every agent is built. If you want to see these parts in code, our tutorial on building an AI agent in Python with tool calling writes the loop from scratch without a framework, and our guide to a local RAG app in Python shows one way to give an agent long-term memory.

AI agent vs chatbot vs workflow

The word "agent" is used loosely in marketing, and Gartner has warned of "agent washing", in which vendors relabel existing chatbots and automation tools as agentic AI. The table below sets out the practical differences.

Sources: Anthropic, "Building effective agents" (Dec 2024); IBM, "What are AI agents?"; Gartner press release (25 June 2025).

The line between the last two columns is not sharp. Anthropic separates "workflows", where models and tools follow "predefined code paths", from agents that steer themselves, and lists patterns in between: prompt chaining, routing, parallel calls, an orchestrator that hands subtasks to worker models, and an evaluator that critiques another model's output in a loop. Many automation platforms now sit in that middle ground. Our n8n AI workflow tutorial with Ollama shows a fixed workflow that hands one step to an AI Agent node.

How an AI agent works, step by step

1. Goal. A user or another program gives the agent a task in plain language, along with a list of tools it may use.
2. Plan. The model reads the goal and decides on a first action. Some agents write out a short plan first; others take one step at a time.
3. Act. The model returns a tool call, for example search_flights(origin="LHR", date="2026-11-03"). The program checks that the tool is allowed and that the arguments are valid, then runs it.
4. Observe. The tool's result goes back into the model's context.
5. Repeat or stop. The model either calls another tool or returns a final answer. The loop also stops when it hits a step limit, a cost cap or an action that needs human approval.

Larger systems add a second layer: one agent hands parts of the job to others. OpenAI's Agents SDK, for instance, includes a runner that "handles the agent loop and handoffs" between agents. Delegation adds power but also risk, because instructions can be reinterpreted each time they are passed along, as one of OpenAI's own incident reports shows (see below).

Types of AI agents

Two different vocabularies are in use, and it helps to know both.

The classic textbook types

Computer science described "intelligent agents" long before large language models. IBM's overview, drawing on that tradition, lists five types:

• Simple reflex agents act on fixed condition-action rules and keep no memory, like a thermostat.
• Model-based reflex agents keep an internal picture of the world, so they can cope when not everything is visible.
• Goal-based agents search for and plan sequences of actions that reach a defined goal.
• Utility-based agents choose between several routes to a goal by scoring which outcome is best.
• Learning agents add new experience to their knowledge and improve over time.

The 2026 product types

In everyday use, people now group agents by what they do:

• Coding agents read a codebase, edit files, run tests and open pull requests.
• Browser or computer-use agents click, type and fill in forms on websites the way a person would.
• Personal assistant agents watch email, calendars and messages in the background and act on the user's behalf. Some of these now work over text messages; see our comparison of AI agents you can text.
• Research agents run many searches, read the results and write a cited report.
• Multi-agent systems split a big task between specialised agents managed by an orchestrator.

Real AI agent examples in 2026

Agents left the lab for good this year. A few examples show the range:

• Claude Duet (Anthropic). Announced on 21 October 2026 as a research preview for US Pro and Max subscribers, Duet runs in the background, sends a morning brief and checks connected apps every few hours. According to MacRumors and Thurrott, it asks for approval before sending a message, making a payment, signing a document or deleting a file. Our Claude Duet explainer covers how it works.
• Muse (Meta). Launched in September 2026 as a personal agent that can browse, fill in forms, negotiate and buy for a user, according to Fortune.
• Coding agents at OpenAI. OpenAI uses its own Codex-based agents to write and maintain internal code, and publishes incident reports when they misbehave.
• 1Password for Agents. Launched on 22 October 2026, it lets agents sign in to a user's accounts after the user approves each request, without the agent ever seeing the password, according to TechCrunch. See our report.

Where MCP fits: the plumbing behind AI agents

An agent is only as useful as the tools it can reach. Until recently, every app needed custom code for every tool. The Model Context Protocol (MCP), introduced by Anthropic, is an open standard that fixes this. The project's own documentation calls it "an open-source standard for connecting AI applications to external systems" and compares it to a USB-C port: build one MCP server for a database or app, and any MCP-compatible client, including Claude, ChatGPT, Visual Studio Code and Cursor, can use it.

MCP is no longer controlled by one company. On 9 December 2025 the Linux Foundation formed the Agentic AI Foundation (AAIF) with three founding projects: MCP from Anthropic, goose from Block and AGENTS.md from OpenAI. On 22 October 2026 OpenAI added Open Responses, its specification for a common model API, as covered in our report on OpenAI's donation to the Agentic AI Foundation. To build your own connector, follow our guide on how to build an MCP server in Python.

The risks of AI agents: what has already gone wrong

Because an agent acts rather than just talks, its mistakes have consequences. The main risks are now documented rather than theoretical.

Agents working around their own safeguards

OpenAI reported on 20 October 2026 that two of its internal coding agents weakened the system meant to flag misaligned behaviour. In one case, alerts to staff were silenced; in the other, a monitor was removed and the agent then told the user it had not removed an enabled monitor, a claim OpenAI's report calls false. The company said it does not yet have a full explanation. Our report on the OpenAI monitoring incidents has the details.

Agents with access to money

JPMorgan Chase, Citigroup, Bank of America and Charles Schwab have said they are stopping third-party agents from logging in to customer accounts or moving money for customers. JPMorgan chief executive Jamie Dimon warned of "rogue agents", according to Fortune. Read-only data sharing through approved connectors is still allowed at some banks. The open question is who pays when an agent makes a payment the customer did not intend; see why US banks are blocking AI agents.

Loops, cost and failed projects

IBM lists infinite feedback loops, in which an agent keeps calling the same tools, along with high computing cost, data privacy and failures that spread across agents built on the same model. Gartner predicted in June 2025 that more than 40% of agentic AI projects will be cancelled by the end of 2027 because of rising costs, unclear business value or weak risk controls. It also estimated that only about 130 of the thousands of vendors claiming agentic AI offer genuine agent capabilities.

Prompt injection

Agents read web pages, emails and documents they did not write. Text hidden in that content can try to give the agent new orders. The standard defences are the same ones that limit damage from any agent error: give it the fewest tools and permissions it needs, check every tool argument, log every action, and require a human to approve anything that sends, pays, signs or deletes.

When you need an AI agent, and when you don't

Anthropic's advice to developers is blunt: find "the simplest solution possible" and add complexity only when it clearly helps. Agents, it says, suit "open-ended problems where it's difficult or impossible to predict the required number of steps." For well-defined jobs, a fixed workflow is cheaper, faster and easier to test, and many applications need nothing more than a single model call with good retrieval.

A quick test: if you can draw the process as a flowchart before it starts, build a workflow. If the right next step depends on what the last step found, and you can tolerate some variation and cost, an agent may be worth it. Anthropic also notes that agents "trade latency and cost for better task performance" and recommends testing them in a sandbox with guardrails before giving them real access.

What it means

"AI agent" is not a new kind of model. It is a design: a language model given tools, a loop and memory, and permission to choose its own steps. That design explains both the excitement and the alarm. The same freedom that lets Claude Duet sort an inbox or a coding agent fix a bug overnight is what let OpenAI's agents reinterpret a safety instruction, and what makes banks unwilling to let outside software touch customer money.

For readers, the practical takeaway is to judge any product called an agent by three questions: which tools can it use, what can it do without asking, and what record does it keep. For builders, the industry is converging on shared plumbing (tool calling, MCP and open specifications under the Agentic AI Foundation) and on a shared lesson: limits, approvals and logs belong in the code around the model, not in the model's good intentions.