What Is an AI Agent? How Agents Work and Stay Safe

What is an AI agent? An AI agent is an AI model that works toward a goal by using tools in a loop. It decides a step, takes an action such as reading a file, running a command or calling an API, looks at the result, and decides the next step, until the task is done. That's the difference from a chatbot: AI agents act, not just answer.

By Gary, Greenlight My App. Checked Nov 2, 2026. How we checked this: we read Anthropic's "Building effective agents" guide, the Claude Code permissions docs, the MCP security best practices and Microsoft's Oct 30, 2026 security write-up on Nov 2, 2026, and quote them below. Our team also ran a tiny demo agent loop with a mock model (no API key, no network) in a throwaway folder on Nov 2, 2026; that run's screenshots are below, and everything else is quoted from the sources. Drafted with AI tools and reviewed by a person before publishing.

What is an AI agent?

An AI agent is software where a language model directs its own steps toward a goal. You give it a task; it chooses which tools to use, uses them, reads what happened, and keeps going until it's finished or stuck. Its tools might be a file editor, a terminal, a web browser or an API. That autonomy is the whole point, and the whole risk.

Anthropic's widely cited guide (Building effective agents (external), Dec 19, 2024) draws a useful line between two kinds of AI systems:

• "Workflows are systems where LLMs and tools are orchestrated through predefined code paths."
• "Agents, on the other hand, are systems where LLMs dynamically direct their own processes and tool usage, maintaining control over how they accomplish tasks."

So "agent" isn't a brand or a product. It's a design: the model, not your code, decides what happens next.

What is agentic AI? It's the umbrella term for AI systems that act with some autonomy, including agents and agent-like workflows. This post sticks to agents themselves.

How do AI agents work? (model, tools, memory, loop)

AI agents work in a loop. The model reads the goal and any context, picks a tool and calls it, gets the result back, and decides what to do next. Tools let it act; memory lets it carry facts between steps; the loop repeats until the task is done or a stopping condition hits, such as a step limit or a human check-in.

Anthropic describes the building block as "the augmented LLM": a model "enhanced with augmentations such as retrieval, tools, and memory." Then the loop: agents "gain 'ground truth' from the environment at each step (such as tool call results or code execution) to assess its progress," and can "pause for human feedback at checkpoints or when encountering blockers."

The guide is frank that it's simpler than it sounds: "They are typically just LLMs using tools based on environmental feedback in a loop." And it recommends a brake: "it's also common to include stopping conditions (such as a maximum number of iterations) to maintain control."

Worked example. You ask a coding agent to "add a dark mode toggle." It reads your layout file (tool: read), edits two components (tool: edit), runs npm run build (tool: shell), sees a type error in the output (observe), fixes the error (edit), reruns the build (shell), and reports back. Six tool calls, none of them scripted in advance. That loop is what makes it an agent.

Types of AI agents

You can sort AI agents by how much they decide for themselves. At one end sit workflows with fixed steps; at the other, fully autonomous agents that plan their own path. Anthropic lists five common workflow patterns before true agents: prompt chaining, routing, parallelization, orchestrator-workers and evaluator-optimizer.

The first five are what Anthropic calls workflows; only the last is an agent in its strict sense. Textbooks also use older categories (simple reflex, model-based, goal-based, utility-based and learning agents). Those come from classic AI and describe how an agent chooses actions, but the practical question for builders is the same: how much can it do without asking you?

Anthropic's advice on choosing: start simple. The guide says to find "the simplest solution possible, and only increasing complexity when needed," and its three principles for agents are simplicity, transparency ("explicitly showing the agent's planning steps") and a well-designed agent-computer interface.

AI agent examples (incl. coding agents)

The most common AI agents builders use today are coding agents: Claude Code, OpenAI's Codex, Cursor's agent mode and open-source tools like OpenCode. Others include research agents that browse and summarize, customer support agents that look up orders and issue refunds, and browser agents that click through websites for you.

Getting started with the coding ones: our guides to installing Claude Code, Codex CLI and OpenCode cover setup. Many agents connect to outside tools through MCP; see what is MCP for how that works.

What are the top AI agents? For builders, widely used coding agents include Claude Code, Codex and Cursor's agent, plus open-source options like OpenCode. "Top" changes monthly, so pick one by what it can access and how you control it, not by hype.

AI agent vs chatbot vs assistant

A chatbot answers questions in a conversation. An assistant answers and can do a few simple actions you ask for, like setting a reminder. An AI agent takes a goal and carries out many steps on its own, choosing tools as it goes. The more it can do without asking, the more agent-like it is, and the more its access matters.

Is ChatGPT an AI agent? Plain chat is a chatbot or assistant. When it browses, runs code or works through a multi-step task with tools on its own, it's acting as an agent. The label depends on the mode, not the product name.

What can an AI agent reach? (files, keys, terminals, deploys)

An AI agent can reach whatever the account and machine it runs on can reach. A coding agent in your terminal can usually read every file in your project, including .env files with API keys, run any command you could, use your Git and cloud logins, and push code that your host deploys. That's why access, not intelligence, is the real security question.

Anthropic's guide is direct about the trade-off: "The autonomous nature of agents means higher costs, and the potential for compounding errors. We recommend extensive testing in sandboxed environments, along with the appropriate guardrails."

Can an AI agent leak my API keys?

Yes, if it can read them. An agent that opens your .env can repeat a key in its output, write it into a file it creates, or paste it into a log. Prompt injection makes it worse. Anthropic's Claude Code MCP docs (external) warn: "Servers that fetch external content can expose you to prompt injection risk." A web page or README the agent reads can contain instructions written for the model, not for you. Keep keys where the agent can't read them, and give it dev keys with low limits.

This week's reminder: the tools around agents are software too

On Oct 30, 2026, Microsoft's security team published an analysis of a tampered copy of the Claude Code extension that was on Cursor's extension marketplace on Oct 29. Per Microsoft's write-up (external), versions 2.1.312 and 2.1.313 were "available and served in the Cursor extension marketplace for a few hours," and Cursor reported it live from about 2:27 AM to 1:35 PM Pacific time.

Microsoft says the injected code "attempts to add an attacker-controlled Secure Shell (SSH) key, enable the local SSH service, establish reverse SSH forwarding, configure persistence, and report host details." It also looked for environment-variable names containing words like KEY, TOKEN and SECRET; Microsoft notes the callback sends "matching environment-variable names, not values."

Two facts worth keeping straight. Microsoft confirmed the malicious packages "were never published nor distributed from Microsoft Visual Studio Marketplace and from npm @anthropic-ai/claude-code, which were not affected by this incident," and "Anthropic confirmed to Microsoft that their systems were not compromised." This was a fake extension on one marketplace, not a flaw in the agent itself. The lesson for builders: an agent's extensions and plug-ins run with your privileges, so where you install them from matters. If you use Cursor, follow Microsoft's and Cursor's notices for that version.

AI agent security: 7 ways to keep an agent on a leash

Keep an AI agent safe by limiting what it can touch before it starts. Deny reads of secret files, require approval for risky commands, run it in a sandbox or container, give it scoped keys with spend limits, keep pushes and deploys behind a human, cap how long it can run, and read what it did before you ship.

1. Deny reads of secret files. In Claude Code, permission rules live in .claude/settings.json, and the docs' own examples include Read(./.env) and Read(./secrets/**) as deny rules. A minimal project file:

{
  "permissions": {
    "allow": ["Bash(npm run *)"],
    "deny": ["Read(./.env)", "Read(./secrets/**)", "Bash(git push *)"]
  }
}

Rules are checked "in order: deny, then ask, then allow," and the docs add: "Permission rules are enforced by Claude Code, not by the model." One limit they spell out: Read rules don't cover "arbitrary subprocesses that read or write files indirectly, like a Python or Node script that opens files itself." For that, they point to the sandbox.

2. Ask before risky commands. Leave shell commands on ask-first, and allowlist only routine ones like your test and build scripts. When a prompt offers "Yes, and don't ask again," read exactly what it's saving.

3. Run it in a sandbox or container. Anthropic recommends "extensive testing in sandboxed environments." Claude Code's most permissive mode, bypassPermissions, carries the warning: "Only use this mode in isolated environments like containers or VMs." Our Claude Code permissions and sandbox guide shows the setup.

4. Give it scoped keys with spend limits. Use a dev key, not your production one, with the smallest scope and a monthly cap. If it leaks, the damage is capped too. If one does leak, follow what to do when an AI API key is stolen.

5. Keep a human on pushes and deploys. Deny git push (as in the example above) and deploy commands. Review the diff yourself, then push. The docs note a deny rule matches the command as written, so a push phrased another way isn't matched; that's one more reason to review.

Worked example: the same task, two setups. Ask an agent to "fix the failing checkout test." In a loose setup, it can read .env, sees STRIPE_SECRET_KEY, runs the test against your live account and pushes the fix straight to main, which your host deploys. In a tight setup, it works in a container with a test key (sk_test_XXXX) that has no live access, its .env read is denied, and git push is blocked. It still fixes the test. You read the diff and push. Same result, a fraction of the risk.

6. Cap the loop. Set a step or time limit where your tool supports it, and stop runs that wander. Anthropic's guide recommends "stopping conditions (such as a maximum number of iterations) to maintain control."

7. Read what it did, then scan. Check the agent's transcript, the files it changed and any new dependencies. Then check the live result: a key that slipped into frontend code is public the moment you deploy.

What happened when we gave a demo agent rules?

To show the loop and the rules without risking anything, we wrote a 50-line Python agent with a mock model: a scripted stand-in for an LLM, so no API key and no network. Its goal was "Add a README with today's date." The demo folder held an app.py and a .env with a fake key (API_KEY=XXXX). Before each tool call, the loop checked a rules file, deny first:

{
  "permissions": {
    "allow": ["list_files", "write_file(README.md)"],
    "ask":   ["write_file(*)"],
    "deny":  ["read_file(.env)", "read_file(.env.*)", "run_command(curl *)", "run_command(wget *)"]
  }
}

Here's what each step did:

The task still got done. The two risky steps, reading the key and sending data out, simply never ran. That's the point of rules checked outside the model: they don't depend on the model behaving.

The same idea in Claude Code's own rule format, from Anthropic's settings docs. This is the project file our team wrote; we didn't sign in to a paid Claude account for this post, so we haven't shown Claude Code enforcing it:

{
  "permissions": {
    "deny": ["Read(./.env)", "Read(./.env.*)", "Bash(curl *)", "WebFetch"],
    "ask": ["Bash(git push *)"]
  }
}

Should you let an agent touch your app?

Yes, with limits. Coding agents are good at routine work like tests, refactors and boilerplate, and they're fast. Let one work on a branch in a container, with no production keys and no push rights, then review and ship it yourself. Don't give an agent your production database, admin keys or deploy access just to save a few clicks.

A simple rule of thumb by task:

• Fine to delegate: writing tests, fixing lint errors, small UI changes, docs, refactors on a branch.
• Delegate with review: new features, dependency upgrades, database migrations (on a copy).
• Keep for yourself: production deploys, key rotation, anything touching payments or user data directly.

For the editor side, our Cursor security checklist covers the same ideas inside Cursor.

FAQ

What are the functions of an AI agent? To pursue a goal on its own: plan steps, use tools like files, terminals and APIs, check results, and repeat until done or stopped.

What are the top AI agents? For builders, coding agents like Claude Code, OpenAI's Codex, Cursor's agent mode and open-source OpenCode. Pick by access controls, not hype.

Is ChatGPT an AI agent? In plain chat it's an assistant. When it browses, runs code or works through multi-step tasks with tools on its own, it's acting as an agent.

Are AI agents safe? They're as safe as their access. Limit files, keys, commands and deploys, run them in a sandbox, and review their work before it ships.

What is agentic AI? The umbrella term for AI systems that act with some autonomy, from fixed multi-step workflows to agents that choose their own steps and tools.

Can an AI agent leak my API keys? Yes, if it can read them. Deny access to .env and secret files, use scoped dev keys with spend limits, and check its output.

What does the word agent mean? Someone or something that acts on another's behalf. An AI agent acts for you, using tools, toward a goal you set.

What is the difference between an AI agent and a chatbot? A chatbot replies with text. An agent takes actions, like editing files or calling APIs, and decides its own next step.

Let an agent ship code? Run a free scan with Greenlight My App to check your live site's public code for exposed API keys and missing security headers.