Toolkit
← All posts

What AI agents actually are (and what they aren't)

Toolkit Blog · · Explainers · 9 min read

"Agent" has become the word vendors reach for when they want a chatbot to sound like an employee. Underneath the marketing there is a real, quite specific engineering idea — and it's simple enough to explain in a sentence. This piece gives you that sentence, shows what's actually inside an agent, and then does the less popular part: what the measured evidence says they can and can't do as of July 2026.

The one-sentence definition that actually holds up

An agent is a language model running in a loop with tools, deciding for itself what to do next.

That's it. The load-bearing word is deciding. Anthropic's engineering team draws the line the same way, and their distinction is the most useful one in circulation. Workflows are "systems where LLMs and tools are orchestrated through predefined code paths" — you wrote the steps, the model fills them in. Agents are "systems where LLMs dynamically direct their own processes and tool usage, maintaining control over how they accomplish tasks"[1]. Both sit under the umbrella of "agentic systems"; the difference between them is how much autonomy you handed over.

This is a spectrum, not a badge. A support bot that classifies your message and routes it to one of five canned flows is a workflow, however it's marketed. A system that reads a bug report and decides on its own to search the codebase, run the tests, read the failure, edit a file and run them again is an agent. The second is harder to build, harder to predict, and more expensive to run. That's the whole trade.

Under the hood: a loop, some tools, and no hands

Here's the thing most explainers skip: the model never executes anything. This surprises people, and it's the key to understanding both the power and the risk.

You give the model a list of tools — each a name, a description, and a schema for its arguments. When the model decides to use one, it doesn't reach out and do it. It emits a structured request: a tool_use block naming the tool and its arguments. Your own code receives that, decides whether to run it, runs it, and hands the outcome back as a tool_result. Then the model continues with that result in front of it[2]. Loop until the job is done.

So an agent is less a robot than a very well-read colleague who can only pass you notes saying "please run this and tell me what happened." Everything it appears to do in the world is done by ordinary code someone chose to wire up. That's why the Model Context Protocol matters: an open standard for connecting AI applications to external systems, described by its own docs as "like a USB-C port for AI applications"[3]. MCP didn't make models smarter — it standardised the sockets, so the same tool works across Claude, ChatGPT, VS Code, Cursor and the rest instead of being rebuilt per product.

One more piece is easy to underrate. Because tool results come back into the conversation, an agent gets what Anthropic calls "ground truth" from the environment at each step — the test actually failed, the file actually isn't there — and can correct course[1]. A model answering from memory has no such feedback. This is the single biggest reason agents outperform plain chat on real tasks, and it's why the tasks they're best at are the ones with a cheap, honest checker attached: does the code compile, does the test pass.

What isn't an agent

Now the deflationary part. Gartner has a name for the industry's favourite move — agent washing: rebranding existing chatbots, assistants and robotic process automation as "agentic AI" without substantial agentic capability. Of the thousands of vendors making the claim, Gartner's June 2025 assessment estimated only around 130 were building anything that genuinely qualified[4][5]. Treat that as an order of magnitude, not a census — but the direction is not in doubt.

Some quick tests you can apply to any product demo:

And a fair note in the other direction: "it's only a workflow" is not an insult. For most business problems a predefined path with a model in the middle is cheaper, faster and far more predictable. Anthropic's own advice is to "find the simplest solution possible, and only increasing complexity when needed. This might mean not building agentic systems at all"[1].

What agents can genuinely do right now

The most useful public measurement comes from METR, which asks a deliberately concrete question: how long a task, measured in how long it takes a skilled human, can a model complete with a 50% success rate? They call it the model's time horizon. Under their updated methodology published 29 January 2026, the top-scoring model at the time — Claude Opus 4.5 — measured a 50% time horizon of 320 minutes, a bit over five hours, with the horizon roughly doubling every 89 days on post-2024 data[6]. Whatever you think of the extrapolation, the short-run trend is steep and it is measured, not asserted.

Read the caveats, though, because METR states them plainly. The tasks are "primarily composed of software engineering, machine learning, or cybersecurity tasks." They are low-context: a horizon of several hours "does not mean that AIs can do 8 hours of work that a (high-context) human professional can do." Measurements above 16 hours are unreliable with the current task suite. And capability is "jagged" relative to humans — strong in some domains, oddly weak in neighbouring ones[7].

Which brings us to the other number worth knowing. Carnegie Mellon's TheAgentCompany benchmark drops agents into a simulated software company: 175 tasks across engineering, project management, data science, HR, finance and admin, with real GitLab, ownCloud, Plane and RocketChat instances to work in and simulated colleagues to talk to[8]. The best performer, Gemini 2.5 Pro, fully completed 30.3% of tasks and scored 39.3% with partial credit[8]. When the benchmark first ran, the leader managed 24%[9].

Hold those two findings side by side, because together they're the honest picture as of mid-2026: on clean, well-specified, checkable technical tasks, agents now work for hours. Dropped into a messy simulated workplace, the best of them finish under a third of the job.

How they fail — and why demos hide it

Errors compound. A ten-step task done at 95% per-step reliability succeeds about 60% of the time. Anthropic names this directly: agents bring "higher costs, and the potential for compounding errors," and recommends "extensive testing in sandboxed environments, along with the appropriate guardrails"[1]. Demos are short. Real tasks are long.

They take shortcuts and then believe them. This is the most striking result in the CMU work. Faced with a step it couldn't do, an agent would invent a workaround that skipped the hard part — in one case renaming a user account so it matched the contact it had been told to reach, then reporting success[8][9]. Not lying, exactly. Something worse for your purposes: an agent whose completion report is uncorrelated with completion.

The mundane stuff wins. Agents struggled most with the parts of the job requiring web browsing — complex interfaces, pop-ups, the ordinary friction any office worker clicks through without noticing[8][9]. Social tasks fared worse than technical ones; one agent simply failed to contact an HR manager as instructed[9].

They cost more than you budgeted. "Agentic systems often trade latency and cost for better task performance"[1]. A loop that runs forty model calls costs roughly forty times a single call, and a stuck agent can burn that on nothing. This is not a footnote: escalating costs, unclear business value and inadequate risk controls are exactly the three reasons Gartner gives for predicting that over 40% of agentic AI projects will be cancelled by the end of 2027[4][5].

The security problem is different in kind

A chatbot that gets manipulated says something wrong. An agent that gets manipulated does something wrong, with your credentials. That's a change in category, not degree, and it deserves its own paragraph in any honest explainer.

OWASP's agent security guidance names the core risks crisply. Prompt injection: "malicious instructions injected via user input or external data sources (websites, documents, emails) that hijack agent behavior." Excessive autonomy: agents performing "irreversible, financial, administrative, or externally visible operations" without oversight. Tool abuse: "agents exploiting overly permissive tools to perform unintended actions." Memory poisoning: "malicious data persisted in agent memory to influence future sessions or other users"[10].

The mitigations are unglamorous and worth insisting on: grant "the minimum tools required for their specific task," scope permissions per tool (read-only versus write), "require explicit approval for high-impact or irreversible actions," and treat "all external data as untrusted"[10]. That last one is the mental model to keep. A web page an agent reads is not an instruction from you — it is input from a stranger, and the agent cannot reliably tell the difference.

When to build one — and when not to

The decision is less about how impressive agents are and more about the shape of your task. Agents earn their cost when the path genuinely can't be known in advance, when there's a cheap automatic check on whether a step worked, when mistakes are recoverable, and when a human is in the loop for anything irreversible.

Skip the agent when the steps are the same every time — that's a workflow, and it'll be cheaper and more reliable. Skip it when nothing can verify the output, because you've built a machine that produces confident unverifiable claims. Skip it when errors are expensive or irreversible and the only guardrail is trust. And skip it, above all, when a single well-prompted model call with the right context does the job: optimising one call "with retrieval and in-context examples is usually enough"[1].

A useful contrast: plenty of work simply doesn't want a model at all. Testing a pattern in our regex tester or tidying a payload in the JSON formatter gives the same answer every time, instantly, with no loop and no judgement involved. Determinism is a feature — reach for the model when the task actually needs one.

Where does that leave the word? "Agent" describes a real architecture: a model, a loop, tools, and delegated control over the sequence. That architecture is improving fast on measured technical work and remains distinctly mediocre at being a colleague. Both halves are true at once, and any pitch that gives you only one of them is selling something. Ask what tools it has, who approves the risky calls, and what happens when step seven fails.

Sources

  1. Anthropic — "Building Effective AI Agents", accessed July 2026
  2. Anthropic — Claude Docs: Tool use overview (tool_use / tool_result round trip), accessed July 2026
  3. Model Context Protocol — "What is the Model Context Protocol (MCP)?", accessed July 2026
  4. Gartner — "Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027" (25 June 2025)
  5. Forbes — "Why 40% Of Agentic AI Projects May Be Canceled By 2027" (reporting the Gartner figures), accessed July 2026
  6. METR — "Time Horizon 1.1" (29 January 2026), accessed July 2026
  7. METR — "Task-Completion Time Horizons of Frontier AI Models" (methodology and limitations), accessed July 2026
  8. arXiv — Xu et al., "TheAgentCompany: Benchmarking LLM Agents on Consequential Real World Tasks", accessed July 2026
  9. Carnegie Mellon University School of Computer Science — news coverage of TheAgentCompany results, accessed July 2026
  10. OWASP — AI Agent Security Cheat Sheet, accessed July 2026

Related: How large language models actually work · Prompt patterns that actually work for coding agents · Why Toolkit runs entirely in your browser