An AI agent is a language model given three extra things: a goal, a set of tools it can use, and a loop that lets it keep going until the goal is met or it gives up. That is the whole idea. Everything else is engineering around those three parts.
The three pieces
Take a normal chat assistant. You type, it replies, the exchange ends. It cannot check today's weather, edit your spreadsheet, or send an email, because it has no way to touch anything outside the conversation. It produces text and stops.
Now add the three pieces:
A goal. Instead of a single question, you give it an outcome: "find the three cheapest flights for the dates in my note and put them in a table." The goal persists across many steps.
Tools. The software around the model is told: here are actions you may request — search the web, read a file, run a query, send a message. Each tool has a name and a list of inputs it accepts.
A loop. After the model requests an action, the surrounding program actually performs it, feeds the result back, and asks the model what to do next. That repeats until the model says it is finished.
An agent is that arrangement. Not a different kind of AI, not a mind with intentions — the same next-token prediction you already know, wrapped in a program that acts on what it predicts.
What the model actually does
This is the part worth being precise about, because it dissolves most of the mystery.
The model never touches your files. When it decides to use a tool, it outputs a small piece of structured text: the tool's name and the inputs, formatted the way the surrounding program expects. The program reads that text, runs the real operation, and pastes the outcome back into the conversation as new context.
So the model's only power is producing text that a program has agreed to act on. That is why permissions matter so much, and it is the reason a badly configured agent is dangerous in a way a chatbot is not: the harness, not the model, decides what a request is allowed to touch.
What an agent is not
It is not a system that understands your intent the way a colleague would. It has your instruction and whatever it can observe through its tools, and nothing else.
It is not reliable simply because it is autonomous. Autonomy multiplies whatever accuracy the underlying model has. A step that is right nine times in ten sounds good until you chain ten of them together.
It is not learning from your corrections between sessions unless someone built that in. Most agents start each run with no memory of the last one.
And it is not a legal or moral actor. If an agent sends the wrong email, the responsibility sits with whoever set it running.
A concrete picture
Suppose you ask an agent to summarize every invoice in a folder. It might: list the folder, read the first file, notice it is a scanned image, ask an image-reading tool for the text, extract the amount, move to the next file, hit one that is password protected, note the failure, continue, and finally write a summary that says which files it could not read.
Every one of those steps is the same operation repeating: the model sees the conversation so far, predicts the most plausible next action, and the harness carries it out. The intelligence is real, but it is intelligence about what to do next, applied over and over.
Key takeaway: an agent is a model plus tools plus a loop plus a goal. Its power comes from acting in the world; its risk comes from exactly the same place.