# What is an AI agent? A model that uses tools in a loop, deciding each next step from what the last one returned, until the task is done. - Page: https://tecyfy.com/concepts/agent - Subject: AI agents (https://tecyfy.com/concepts) - Level: beginner - Also called: AI Agent - The lesson: Inside an AI agent: what happens after you press Enter (https://tecyfy.com/learn/ai-agents/inside-an-ai-agent) - Last checked: 2026-10-14 A chatbot answers in one go. An agent works in steps. Anthropic's short definition is a good one to keep: an agent is a model using tools in a loop, based on feedback from its environment. Ask an agent why last week's sales fell and it does not reply straight away. It might open the sales report, then query the order system, then read a log, and only then answer. Each of those is one lap of the loop. ## The loop Every lap has the same 4 steps. 1. **Think.** The model reads everything so far and picks a next step. 2. **Act.** It asks for a tool, with the inputs it wants. 3. **Observe.** The tool's result comes back into the conversation. 4. **Decide.** Answer now, or go round again. The loop usually ends when the model has enough to answer. It can also stop at a token limit, on a refusal, or when it pauses to ask you something. ## The model does not act This is the part people miss. The model only writes text. A request to use a tool is a structured piece of text: this tool, with these inputs. Code around the model reads that request, runs the tool and passes the result back. That code, with the loop, is often called the harness. It can be your own program, the provider's servers, or a managed agent where the provider runs the whole thing for you. To the model, each tool is a card with a name, a description and the inputs it takes. It can only ask for what is on those cards. ## Why it matters to you An agent can do far more than a chatbot, and it can also do more damage. It acts on what it reads, so a hidden line in a web page or an email can steer it. This is called [prompt injection](https://tecyfy.com/concepts/prompt-injection). Careful setups give an agent only the access the task needs, and ask a person before anything that matters, such as sending, paying or deleting. Even then, agents can make mistakes or be tricked. So before you let one loose, ask 2 questions. What can it reach? And what must it ask me before it acts? ## Related - [Tool Use](https://tecyfy.com/concepts/tool-use): Giving a model a list of things it can ask to have done, such as search the web or read a file. The model asks; the program around it does the work and hands back the result. - [Function Calling](https://tecyfy.com/concepts/function-calling): The developer's name for tool use. The model replies with the name of a function and its arguments in a fixed format, and your code runs it. - [Agent Memory](https://tecyfy.com/concepts/agent-memory): The ways an agent keeps what it needs beyond a single context window, such as summaries, notes in files, and saved facts it reads back later. The model itself remembers nothing. - [Context Window](https://tecyfy.com/concepts/context-window): Everything a model can see at once while it writes an answer, counted in tokens. When the window is full, something has to be left out. - [Large Language Model](https://tecyfy.com/concepts/large-language-model): A model trained on a huge amount of text to predict the next token. Further training turns it into an assistant that follows instructions. ## Sources - [Building effective agents](https://www.anthropic.com/engineering/building-effective-agents), Anthropic, 2026-09-25. An agent is a model using tools in a loop, based on feedback from its environment. - [How tool use works](https://platform.claude.com/docs/en/agents-and-tools/tool-use/how-tool-use-works), Anthropic, Claude API documentation, 2026-09-25. The model never executes anything on its own. It emits a structured request, your code or the provider's servers run it, and the result comes back into the conversation. The loop usually ends when the model has enough to answer, and can also stop at a token limit, on a refusal or on a pause. - [Define tools](https://platform.claude.com/docs/en/agents-and-tools/tool-use/define-tools), Anthropic, Claude API documentation, 2026-09-25. A tool is given to the model as a name, a description and the inputs it takes. - [Claude Managed Agents overview](https://platform.claude.com/docs/en/managed-agents/overview), Anthropic, Claude API documentation, 2026-09-25. The agent is the system around the model that runs the loop and the tools, often called the harness. With a managed agent the provider runs the loop and the tools in its own infrastructure. - [Mitigate jailbreaks and prompt injections](https://platform.claude.com/docs/en/test-and-evaluate/strengthen-guardrails/mitigate-jailbreaks), Anthropic, Claude API documentation, 2026-09-25. Indirect injection hides in a web page, an email, a document or a tool result the model reads. The agent should get only the data and permissions the task needs. - [Safety in building agents](https://developers.openai.com/api/docs/guides/agent-builder-safety), OpenAI API documentation, 2026-09-25. A person should approve consequential actions. Even with these measures, agents can still make mistakes or be tricked.