What is an AI agent?

How an AI agent works

NIST describes an agent as a software system that prompts a model again and again: it acts on the model's output, for example by calling a function the model selected, and feeds the result back into the next prompt (NIST AI 100-2 E2025 (opens in a new tab), section 3.5). The loop continues until the task is done or a rule stops it. A business agent usually has five parts:

• Model: a large language model (LLM) that reads the request, plans the next step and writes replies.
• Instructions: the system prompt that sets the agent's role and rules, such as which topics it handles and when a person takes over.
• Tools: defined actions the agent can call, such as looking up an order, booking a slot or creating a ticket.
• Memory: the conversation so far and, in some agents, notes kept between sessions, such as a customer's preferences.
• Guardrails: limits outside the model, such as access rights, spending caps, approval steps and checks on each tool call before it runs.

The model decides, but the tools act. An agent that can only read your calendar cannot cancel a meeting, whatever its prompt says. For this reason the tool list and its access rights matter more than the wording of the instructions.

What is an AI agent used for?

Agents fit tasks that repeat often, follow rules you can write down and need a lookup or an update in one of your systems. Typical examples:

• A voice agent answers a call, checks the calendar and books or moves the appointment.
• A support agent confirms who the customer is, finds the order and starts a return within your policy.
• A sales agent replies to a new lead, asks your qualification questions, updates the CRM and books a meeting.
• A back-office agent reads an invoice, matches it to a purchase order and sends exceptions to a person for approval.

A chatbot stops at the answer. It can explain your return policy, but a person still starts the return. Our comparison of an AI agent vs chatbot shows when each one fits.

Why it matters for your business

An agent can finish work that today moves between people and systems by hand. The same ability creates the main risk: a wrong decision, or an attacker's hidden instruction, becomes an action in a real system. NIST notes that because agents act through tools, attacks such as prompt injection (tricking an AI with hidden instructions) can let someone hijack an agent to run code or take data out of its environment.

The OWASP Top 10 for LLM Applications 2026 (opens in a new tab) ranks excessive agency third: an agent with more functions, permissions or autonomy than its task needs. Joint guidance from CISA and partner agencies (opens in a new tab) advises starting with low-risk use cases and avoiding broad or unrestricted access to sensitive data or critical systems.

Four controls keep most mistakes small: least-privilege access for each tool, a person's approval before high-impact actions, a log of every action and attack testing before launch. When we build AI agents, a security team sets these limits before the agent talks to a single customer.

Related terms

• Agentic AI: AI systems that plan and act toward a goal with limited human direction.
• Tool calling: the way a model asks the application to run a defined action.
• Human in the loop: a person reviews or approves the AI's work before it takes effect.
• Prompt injection: an attack that tricks an AI with hidden instructions.