What are AI agents, really: a plain-English explainer

Last week a reader emailed asking whether the “AI agent” his SaaS vendor sold him for $79 a month was actually doing anything, or just running the same chatbot with a new label stuck on it. Good question. I get some version of it every few weeks, because “agent” has turned into one of those words that gets stapled onto anything with an API key and a system prompt.

Here’s the honest version: some of what’s sold as an agent really is a step change from a chatbot. A lot of it isn’t. This is the plain-language version of what actually separates the two, written for someone hearing “AI agent” for the tenth time this month and still not sure what it means.

what it is

An AI agent is a system where a large language model decides what to do next, not just what to say next. Give it a goal, “clear my inbox of anything from vendors, draft replies to the rest”, and it picks tools, runs them, looks at what came back, and decides the next step on its own, in a loop, until the goal’s done or it gives up.

Compare that to a regular chatbot. You ask ChatGPT to write an email, it writes the email, you copy it somewhere yourself. The model never left the chat window. An agent goes and does the thing: checks a calendar, sends the email, reads the reply, decides whether that reply needs a follow-up. Anthropic’s own description of the pattern, from its post on building effective agents, is “systems where LLMs dynamically direct their own processes and tool usage, maintaining control over how they accomplish tasks.” That’s really the whole definition. Everything else is implementation detail.

how it works

Strip away the branding and every agent runs on the same loop: perceive, decide, act, check.

The model reads the current state, your calendar, a webpage, a file, the result of the last step it took. It decides on a next action based on the goal you gave it. It calls a tool to execute that action, a calendar API, a browser, a code interpreter, a database query. Then it looks at what the tool returned and loops back to deciding again. This keeps going until the model judges the goal is met, or it hits a limit you set: a step count, a time budget, a human approval gate.

The “calls a tool” part is where most of the last two years’ plumbing got built. OpenAI shipped its Agents SDK and Responses API in March 2025 specifically to standardize how a model requests a tool call and gets structured results back. Anthropic went a different route with the Model Context Protocol, an open standard announced in November 2024 for connecting a model to external data sources and tools without writing custom glue code for each one. Both solve the same problem: the model needs a consistent way to ask for something outside its own weights and get a usable answer back.

The part that actually makes an agent risky, and the part most explainers skip, is that the model’s “decide” step is a probability guess, not a plan. It can call the wrong tool, misread what a tool returned, or loop on a step that isn’t working. Every agent setup I’ve run, including ones I use daily for content and ops work, needs guardrails: a max step count, a cost ceiling, a human checkpoint before anything irreversible, sending money, deleting a file, emailing a customer. Skip the guardrails and you’ll eventually get a fat API bill from a model stuck retrying the same failed tool call. Ask me how I know.

why it matters

A few reasons this distinction actually changes what you’d buy or build, not just semantics.

it changes what you can automate. A chatbot can draft your reply. An agent can read the whole thread, check your calendar for conflicts, draft the reply, and hold the calendar slot, without you touching four different tabs.
it changes where the risk sits. When a model only talks, the worst case is a bad paragraph. When a model acts, the worst case is a wrong invoice or a real email sent to a real customer. Getting “how it works” right matters a lot more once the model can act.
pricing follows capability. Products that genuinely run multi-step tasks tend to charge per task or per outcome rather than per message, because the compute cost of a fifteen-step loop bears no resemblance to one chat reply.
it’s the direction every major lab is building toward. If you’re evaluating any “AI” tool right now, whether it’s agentic or just a chat wrapper is the single most useful question to ask, because it tells you what the thing can actually be trusted to do unsupervised.

common misconceptions

A few wrong ideas keep showing up in the emails I get.

“Agent” always means fully autonomous. Most products calling themselves agents still stop and ask for approval before anything consequential, a payment, a send, a delete. That’s a design choice, not a limitation, and it’s the sane default until the track record on a given task is proven.

It can just figure out any goal you throw at it. It can’t. Give an agent a vague goal like “grow my newsletter” and it’ll either do something narrow and unhelpful or burn through your token budget trying. Agents work best on goals with a clear finish line and tools that actually exist to reach it.

It’s a new kind of intelligence. It’s mostly a new kind of plumbing. The model itself didn’t get smarter to become an “agent.” What changed is the scaffolding around it, the loop, the tool access, the memory of what already happened. Worth knowing because it means the failure modes are mostly engineering failures, bad tool descriptions, missing error handling, no step limit, not some mysterious AI behavior.

Giving an agent tool access is the same as giving a person tool access. It isn’t, and this is the one that should actually worry you. An agent with access to your email, files, or payment method has that access every time it runs, with no fatigue, no second-guessing, and no instinct that something looks off. If you’re wiring an agent into anything with real data or real money behind it, read up on the permissions side before you flip it on, not after. The Privacy Wire has covered access-control questions like this in more depth if you want to go further before connecting anything sensitive.

where to go from here

A few places to go next, depending on what you’re actually trying to do.

If you want to see what people are shipping right now, the best AI agent frameworks in 2026 covers the tools actually in use, not just the demos.

If “large language model” itself is still fuzzy, it’s worth going a level down to what is an LLM: a plain-English explainer before coming back to this.

Curious where agents stop and plain automation, Zapier-style, no model reasoning involved, begins? That’s covered in AI agents vs automation: what’s the difference.

And if none of this answered your specific question, the blog index has the rest of what we’ve written on the space, updated as the tools change, which at this rate is roughly monthly.

Written by Xavier Fok

disclosure: this article may contain affiliate links. if you buy through them we may earn a commission at no extra cost to you. verdicts are independent of payouts. last reviewed by Xavier Fok on 2026-08-18.