Start here: the basics
What is an AI agent?
An AI agent is an AI model that's been given a goal and some tools, and keeps working until the goal is done.
When people say AI right now, they nearly always mean a large language model: a program trained on a huge amount of text that predicts what should come next. Ask it something and it writes a reply. On its own, writing is all it can do.
An agent is what you get when you let that model act. You give it a goal and some tools, and it works in a loop. It picks a step, uses a tool, looks at what came back, and goes again until it's done.
The loop keeps going until the model decides the goal is met.Agent or chatbot
Ask a chatbot "which of last week's orders failed?" and it can only explain how you'd find out.
Ask an agent that can query your order system and it runs the search. Maybe it notices half the results are refunds, filters those out, and hands you the real list. Nobody told it about the refunds. It saw them in the results and adjusted.
A tool is anything the agent can call outside the model, like a web search or a database query. A lot of tools reach agents through MCP now. What is an MCP server? explains that part.
Real examples
Claude Code works inside your project. It reads your code, edits files and runs commands like your test suite. By default it asks before editing a file or running most commands, but reading files in the project needs no approval.
GitHub Copilot's cloud agent picks up a task, often straight from an issue, and works on it in a temporary cloud machine. Each task stays in one repository and one branch, and ends as a pull request you review. Sessions stop after 59 minutes.
Intercom's Fin answers customer questions from your help center. If you set up data connectors, it can also act in other systems for the customer. It hands the conversation to a person when that's the safer option.
Plenty of agents are built in-house instead of bought. One team might have an agent answering "how many signups came from the newsletter?" by querying a read-only copy of the database, so it has no way to change the data.
Most of each description above is about limits. That's normal for an agent anyone trusts at work.
Types of agents
Textbooks sort agents by how they decide. A reflex agent follows fixed rules, a goal-based agent picks actions that get it closer to a goal, and a learning agent improves from feedback. Today's AI agents are mostly goal-based ones built on language models.
In practice people sort them by job (coding agents, support agents) and by what they're allowed to reach.
Where they go wrong
An agent can misread the goal and confidently do the wrong thing. It can also be steered by text it reads along the way. An issue or an email written to manipulate it is called prompt injection, and it works more often than you'd hope.
The worse problem is access. Agents often run on an engineer's personal key, so they can do anything that engineer can, and the logs show the engineer's name. When something gets deleted, nobody can tell which agent did it, or switch off just that one.
The fix starts with giving each agent its own identity, covered in Agent identity. After that, grant it only the tools its job needs. MCP permissions explains doing that one tool at a time, and MCP audit logs covers keeping a record of what each agent did.
To connect an agent to real tools yourself, start with How to add MCP servers to Claude Code.