Agentic AI, explained: what changes when the model can act

Every vendor pitch this year has the same noun in it. Last year they sold you a chatbot; this year they sell you an agent. The word has drifted far enough from any fixed meaning that it is worth pinning down before deciding whether to build on it.

Strip away the marketing and an agent is a simple idea. It is a language model placed inside a loop. The model is given a goal and a set of tools — functions it can call, like searching a database, sending an email, or running code. It proposes an action, something outside the model executes that action, the result is fed back in, and the model decides what to do next. That loop runs until the task is done or a limit is hit.

The only real change is the loop

A chatbot answers. An agent acts, observes, and acts again. That is the whole distinction, and it is a bigger one than it sounds.

Once a model can take actions and read their consequences, it stops being a text generator and starts being a decision-maker with hands. It can break a vague instruction into steps, recover from a step that failed, and chain a dozen tool calls toward an outcome nobody spelled out in advance. This is why the demos are so seductive: 'book me a table and put it on the calendar' becomes a sequence the machine works out on its own.

The capability that makes agents useful — acting without a script — is the same capability that makes them hard to trust.

Tool use is the load-bearing part

None of this works without a reliable way to connect the model to the outside world. For a while every framework invented its own glue. The emergence of shared standards — most visibly Anthropic's Model Context Protocol, introduced in late 2024 — matters because it turns 'connect the model to your systems' from bespoke plumbing into something closer to a USB port. A tool exposed once can be used by many models.

That standardisation is quietly the most important development in the space. Agents are only as good as the tools they can reach, and tools are only worth building if they work everywhere.

Where it breaks

The failure modes are not exotic. They are boring, and that is exactly why they are dangerous in production.

• Compounding errors. A model that is 95% reliable on a single step is far less reliable across a twenty-step chain. Small mistakes early become confident nonsense later.
• No natural stopping point. Agents will happily loop, retry, and burn tokens on a task that a human would have abandoned. Cost and latency are real design constraints, not afterthoughts.
• The blast radius of a wrong action. A chatbot that hallucinates writes a bad sentence. An agent that hallucinates can send the bad sentence to a customer, or run the wrong query against production.
• Prompt injection. The moment an agent reads untrusted content — a web page, an email, a document — that content can try to hijack its instructions. This is not a theoretical risk; it is the central unsolved security problem of the pattern.

What this means if you are building

The teams getting value from agents are not the ones handing them the widest possible mandate. They are the ones scoping tightly: a narrow task, a small set of tools, a human checkpoint before anything irreversible happens, and hard limits on how long the loop can run.

Think of an agent less like an employee you delegate to and more like a very fast, very literal contractor who needs a clear brief and a supervisor for anything that touches the real world. Used that way, the pattern is genuinely powerful. Sold as autonomy, it will disappoint — and occasionally, expensively, misbehave.

The agent era is real. The word is just running ahead of the engineering.