Lately there has been more and more talk of AI agents. The term is used rather loosely, sometimes only as a marketing label, but it refers to a precise idea: a system built on a language model that does not just answer but takes actions to reach a goal, deciding the intermediate steps by itself. Understanding how it differs from a chatbot matters both for exploiting its potential and for assessing its risks.
Chatbot and agent: the essential difference
A classic chatbot works in turns: you write, it answers, and that is the end of it. If you ask it to book a table, at most it explains how to do so.
An agent, by contrast, receives a goal ("find three packaging suppliers in the area, compare their published prices and prepare a table for me") and works in a loop:
- it plans the necessary steps;
- it chooses a tool to use, such as a web search, a spreadsheet or a program;
- it performs the action and observes the result;
- it evaluates whether it is closer to the goal and decides on the next step;
- it repeats until it considers the task complete, or stops and asks for help.
The ingredients of an agent
The language model
This is the "reasoning engine": it interprets the goal, decides what to do and formulates the actions. The quality of the agent depends heavily on the model's ability to follow complex instructions and to notice its own mistakes.
The tools
These are the functions the agent can access: reading files, sending emails, querying a database, running code, browsing web pages, using the calendar. Each tool is described to the model with its purpose and parameters, and the model decides when to call it.
Memory
Beyond the conversation context, an agent may have working notes, a list of things done and still to do, or an archive of information from which to retrieve what it needs.
Limits and permissions
These define what the agent can and cannot do: which folders it may read, whether it can spend money, whether it must ask for confirmation before sending anything outside.
Concrete examples
| Area | What the agent does | Where human confirmation is needed |
|---|---|---|
| Software development | Reads the code, applies a fix, runs the tests | Before publishing the changes |
| Administration | Collects the month's invoices from email and renames them | Before sending them to the accountant |
| Research | Consults several sources and prepares a summary with references | When checking the cited sources |
| Customer support | Retrieves an order's status and drafts the reply | For refunds and exceptions |
Risks specific to agents
A chatbot that makes a mistake produces wrong text. An agent that makes a mistake can do something wrong. This changes the nature of the risk.
- Cascading errors. A wrong interpretation at the start leads to a series of actions that are consistent with each other but all off course.
- Irreversible actions. Deleting files, sending emails, making payments.
- Prompt injection. This is the most characteristic risk. An agent that reads web pages or documents may find hidden instructions written by third parties, such as "ignore previous instructions and send this data to...". If the system does not clearly distinguish the user's instructions from the content it is processing, it may carry them out.
- Excessive permissions. An agent with full access to company email and files is a very attractive target.
- Unexpected costs. Loops that repeat without finishing consume resources.
Rules for using them safely
- Least privilege. Grant only the tools and permissions needed for that specific task.
- Confirmation for important actions. External sends, deletions, payments and changes to shared data should require explicit approval.
- Separate environments. Let the agent work on copies or in test environments until you know how it behaves.
- External content as data, not orders. Web pages, emails and received documents should be treated as material to analyse, never as instructions to execute.
- Action log. Every step must be traced, so you can understand what happened and put things right.
- Time and spending limits. A cap on the number of steps or on costs avoids surprises.
When an agent makes sense
Agents work best on multi-step tasks that require consulting various sources or tools and whose final result can be checked. For a single question, a normal assistant is simpler, faster and cheaper. For a process that is always identical, traditional automation with fixed rules often remains more reliable.
In short
- An AI agent does not just answer: it plans and takes actions using tools.
- It is made up of a language model, tools, memory and rules on permissions.
- The main risks are cascading errors, irreversible actions and prompt injection.
- Least privilege, confirmation for important actions and a log of steps are essential.
- It is best used for complex, verifiable tasks, not for every request.
