AI agent · Lablypedia

While there is no universally agreed-upon definition of an AI agent, common attributes of AI agents include goal-directed behavior, use of external tools, the ability to interact with and modify an external environment, and the ability to autonomously perform multi-step tasks. Their control flow is frequently driven by large language models (LLMs). Agent systems may also include memory components, planning logic, tool interfaces, and orchestration software for coordinating agent components.

History

The theoretical underpinnings for artificial agents emerged in the mid 20th century, with establishment of cybernetics and artificial intelligence. Oliver Selfridge's 1958 "Pandemonium: A Paradigm for Learning" paper was an important early theoretical contribution in establishing agent oriented architecture. Practical implementations of agents for real world applications began to become widespread in the 1990s, after the introduction of the belief–desire–intention software model (BDI), and agent-oriented programming. Harvard professor Milind Tambe notes that in the 1990s, the definition of an AI agent was not clear. Pure digital agents were deployed in computer infrastructure for purposes such as monitoring, while agents connected to real-world sensors and actuators were increasingly used in industrial control systems.

Early artificial agents tended to have simple if then logic, which expanded over time into large decision tree models. By the early 2010s, products like Siri and Alexa were released, and were sometimes called AI agents, though they lacked the general purpose reasoning ability of later agents run by large language models (LLMs). The development of LLMs during the late 2010s and early 2020s introduced new approaches to AI agents. Models such as GPT-3 demonstrated the ability to generate and understand natural language at a much larger scale than many earlier language systems.

Academics began to study LLM agents from 2018. Deployment of such agents began to accelerate in late 2023 after OpenAI's "function-calling" API was made available, and especially after Anthropic's late 2024 introduction of Model Context Protocol (MCP), a standardised way for LLM agents to gain contextual awareness, and to act on the world by calling various external tools. The term "agentic" only began to be used with any frequency in 2024, popularised in part by researcher Andrew Ng.

11 more chapters are free with a Lably account.

Training and testing

Researchers have attempted to build world models and reinforcement learning environments to train or evaluate AI agents. For example, video games such as Minecraft and No Man's Sky as well as replicas of company websites, have also been used for training such agents.

Autonomous capabilities

The Financial Times compared AI agents' autonomy to the SAE classification of self-driving cars, likening most applications to level 2 or level 3, with some achieving level 4 in highly specialized circumstances and level 5 being theoretical.

Cognitive architecture

Ken Huang proposed an AI agent reference architecture that consists of seven interconnected layers, with each layer building on the functionality of the layers beneath it:

Layer 1: Foundation models – provide the datasets that power the agent.
Layer 2: Data operations – manages the data infrastructure required for AI agent operations, including vector databases, data loaders, and RAG.
Layer 3: Agent frameworks – software that manages the AI agents.
Layer 4: Deployment and infrastructure – the technical foundation of the AI agents.
Layer 5: Evaluation and observability – the safety and performance of AI agents.
Layer 6: Security and compliance – a protective framework for safe operation and compliance with regulatory boundaries. At this layer, security and compliance features embedded into all the AI agent stack layers are integrated together.
Layer 7: Agent ecosystem – represents the AI agents' interface with real-world applications and users.

Agent harness

An agent harness is the software layer surrounding a large language model that enables it to function as an AI agent. It commonly manages prompts, context, tool use, memory, execution state, operational constraints, sandboxes, permissions, and the processing of results. The harness connects the model to internal and external computer hardware, software, data files, databases, web browsers, command-line interfaces, and application programming interfaces, while controlling how the agent accesses and uses these resources to complete multi-step tasks.

Orchestration patterns

Autonomous agents are often integrated with other agents or specialized tools to execute complex tasks. These configurations, known as orchestration patterns or workflows, include the following:

Prompt chaining: A sequence where the output of one step serves as the input for the next.
Routing: Directing an input to a specialized downstream task or tool.
Parallelization: The simultaneous execution of multiple tasks.
Sequential processing: A fixed, linear progression of tasks through a predefined pipeline.
Planner-critic: An iterative pattern where one agent generates a proposal and another evaluates it to provide feedback for refinement.

Multimodal AI agents

In addition to large language models (LLMs), vision-language models (VLMs) and multimodal foundation models can be used as the basis for agents. Allen Institute for AI released an open-source vision-language model in 2024. Nvidia released a framework for developers to use VLMs, LLMs and retrieval-augmented generation for building AI agents that can analyze images and videos, including video search and video summarization. Microsoft released a multimodal agent model – trained on images, video, software user interface interactions, and robotics data – that the company claimed can manipulate software and robots.

Applications

The Information divided AI agents into seven archetypes: business-task agents, for acting within enterprise software; conversational agents, which act as chatbots for customer support; research agents, for querying and analyzing information (such as OpenAI Deep Research); analytics agents, for analyzing data to create reports; software developer or coding agents (such as Cursor); domain-specific agents, which include specific subject matter knowledge; and web browser agents (such as OpenAI Operator).

By mid-2025, AI agents were being used in video game development, gambling (including sports betting), cryptocurrency wallets (including cryptocurrency trading and meme coins) and social media. In August 2025, New York Magazine described software development as the most definitive use of AI agents. The Information noted AI coding agents and customer support as the primary uses of AI by businesses by October 2025, although a decline in the expectations of AI capabilities was also noted.

In November 2025, The Wall Street Journal reported that few companies that deployed AI agents have received a return on investment.

Applications in government

Several government bodies in the United States and United Kingdom have deployed or announced the deployment of agents at the local and national level. The city of Kyle, Texas deployed an AI agent from Salesforce in March 2025 for 311 customer service. In November 2025, the Internal Revenue Service stated that it would deploy Salesforce AI agents for the Office of Chief Counsel, Taxpayer Advocate Services, and the Office of Appeals. That same month, Staffordshire Police announced that they would trial Agentforce agents for handling non-emergency 101 calls in the United Kingdom starting in 2026. In December 2025, the Department of Neighborhoods in Detroit, Michigan, partnered with a local business to deploy a customer service AI agent in two city districts.

In February 2025, Thomas Shedd, the director of the Technology Transformation Services, proposed using AI coding agents across the United States federal government. In April 2025, a recruiter for the Department of Government Efficiency proposed using AI agents to automate the work of about 70,000 United States federal government employees as part of a startup with funding from OpenAI and a partnership agreement with Palantir. This proposal was criticized by experts for its impracticality and the lack of corresponding widespread adoption by businesses.

In December 2025, the Food and Drug Administration announced that it would offer "agentic AI capabilities" to its staff for "meeting management, pre-market reviews, review validation, post-market surveillance, inspections and compliance and administrative functions." That same month, the United States Department of Defense launched GenAI.mil, an internal platform for American military personnel to use generative AI-based applications based on Google Gemini, including "intelligent agentic workflows". Defense Secretary Pete Hegseth listed applications such as "[conducting] deep research, [formatting] documents and even [analyzing] video or imagery at unprecedented speed." In December 2025, the United States Immigration and Customs Enforcement agency signed a contract with a company for its Enforcement and Removal Operations department to use AI agents for skip tracing.

Operating systems

AI agents have also been integrated into operating systems developed by Microsoft, Apple, ByteDance, and Google. In November 2025, Microsoft released a test software build of Windows 11 that included agents to run background tasks, with the ability to read and write personal files. In December 2025, ByteDance released Doubao, an AI agent that can be integrated into smartphone operating systems, particularly the Nubia M153 by ZTE. Several apps in China blocked or restricted the agent, citing privacy and security concerns, including WeChat, Alipay, Taobao, Pinduoduo, Ele.me, and local banks.

Web browsing

Web browsers with integrated AI agents are sometimes called agentic browsers. Such agents can perform tasks and browser actions on the user's behalf.

In 2025, Microsoft launched NLWeb, an agentic web search replacement that would allow websites to use agents to query content from websites by using RSS-like interfaces that allow for the lookup and semantic retrieval of content. Within weeks of release, NLWeb was found to have created security issues and expose information about users to third-party servers.

Applications in marketing and advertising

Industry standards now cover AI agents that plan, negotiate, and buy digital media. In 2026, the technology arm of the Interactive Advertising Bureau, IAB Tech Lab, published the Agentic Advertising Management Protocols (AAMP), an open framework for agents that discover inventory, negotiate, and complete media transactions on behalf of buyers and sellers. This differs from platform-native automation such as Google Ads Smart Bidding and Meta Advantage+, which optimize bids and delivery inside a single advertising platform. Cross-channel agents instead recommend budget changes across media, typically with a human in the loop.

Proposed benefits

AI agents have been proposed as a means of increasing personal and economic productivity, fostering greater innovation, and liberating users from monotonous tasks. However, Parmy Olson's Bloomberg opinion piece argued that agents are best suited for narrow, repetitive tasks with low risk. Conversely, researchers suggest that agents could be applied to web accessibility for people with disabilities, and researchers at Hugging Face propose that agents could be used for coordinating resources such as during disaster response. The R&D Advisory Team of the BBC views AI agents as being most useful when their assigned goal is uncertain. Erik Brynjolfsson suggests that AI agents are more valuable in enhancing, rather than replacing, humans.

Concerns

Concerns over AI agents include potential issues of liability, an increased risk of cybercrime, ethical challenges, and problems related to AI safety and AI alignment. Other issues involve data privacy, weakened human oversight, a lack of guaranteed repeatability, reward hacking, algorithmic bias, compounding software errors, lack of explainability of agents' decisions, security vulnerabilities, stifling competition, problems with underemployment, job displacement, cognitive offloading, and the potential for user manipulation, misinformation or malinformation. They may also complicate legal and risk-assessment frameworks, foster hallucinations, hinder countermeasures against rogue agents, and suffer from the lack of standardized evaluation methods. Enterprise deployment of AI agents has raised contracting concerns related to liability allocation, data ownership rights, and legal accountability.

They have also been criticized for being expensive, having a negative impact on internet traffic, and potentially damaging to the environment due to high energy usage. According to Nvidia CEO Jensen Huang, AI agents would require 100 times more computing power than LLMs. There is also the risk of increased political corruption, as AI agents may not question instructions in the same way that humans would.

Journalists have described AI agents as part of a push by Big Tech companies to "automate everything". Several of those companies' CEOs stated in early 2025 that they expect AI agents to eventually "join the workforce". However, in a preprint study, Carnegie Mellon University researchers tested the behavior of agents in a simulated software company and found that none of the agents could complete a majority of the tasks assigned to them. Other researchers had similar findings with Devin AI and other agents in both formal business settings and freelance work.

In June 2025, CNN argued that CEOs's statements on AI replacing their employees were a strategy to "[keep] workers working by making them afraid of losing their jobs." Tech companies have pressured employees to use generative AI models in their work, including AI coding agents. Brian Armstrong, the CEO of Coinbase, fired several employees who did not. Some business leaders have replaced some of their employees with agents, but have said that the agents would need more supervision than those employees.

In October 2025, Futurism questioned whether Amazon's previously announced efforts to replace parts of its workforce with generative AI and AI agents could have led to the October 2025 outage of Amazon Web Services. Large technology companies such as Salesforce, Klarna and IBM announced layoffs in 2025, replacing hundreds of their employees in human resources or customer service with AI agents. However, Klarna later rehired several human employees.

Yoshua Bengio warned at the 2025 World Economic Forum that "all of the catastrophic scenarios with AGI or superintelligence happen if we have agents".

Financial authorities have warned that more complex and autonomous "agentic" AI could become a channel for systemic risk in finance. They distinguish these systems from other AI because they can pursue goals over many steps, call tools, and carry out tasks with relatively little human intervention. In workshops with regulators, central‑bank officials, and industry specialists, participants highlighted risks both from agentic systems built inside financial institutions and from tools offered by technology firms that can initiate or execute financial actions. In one 2025 forum, 44% of experts surveyed judged autonomous or agentic AI systems to be the most likely current source of AI‑related systemic risk in finance.

In March 2025, Scale AI signed a contract with the United States Department of Defense to work with them, in collaboration with Anduril Industries and Microsoft, to develop and deploy AI agents for the purpose of assisting the military with "operational decision-making". In July 2025, Fox Business reported that the company EdgeRunner AI built an offline agent, compressed and fine-tuned on military information, with the CEO seeing more common LLMs as "heavily politicized to the left". As of that time, the company model is being used by the United States Special Operations Command in an overseas deployment. Researchers have expressed concerns that agents and the large language models they are based on could be biased towards aggressive foreign policy decisions.

Research-focused agents have the risk of consensus bias and coverage bias due to collecting information available on the public internet. NY Mag unfavorably compared the user workflow of agent-based web browsers to Amazon Alexa, which was "software talking to software, not humans talking to software pretending to be humans to use software." The same outlet described web browser agents and computer-use agents as an attempt to "click-farm the entire economy."

Agents have been linked to the dead Internet theory due to their ability to both publish and engage with online content.

Agents may get stuck in infinite loops.

Since many inter-agent protocols are being developed by large technology companies, there are concerns that those companies could use these protocols to benefit themselves.

A June 2025 Gartner report accused many projects described as agentic AI of being rebrands of previously released products, terming the phenomenon "agent washing".

Researchers have warned about the impact of providing AI agents access to cryptocurrency and smart contracts.

During a vibe coding experiment, a coding agent by Replit deleted a production database during a code freeze, "[covered] up bugs and issues by creating fake data [and] fake reports" and responded with false information. A user of Google Antigravity reported that, when the user attempted to use the system to delete cache, the system responded by deleting the user's D hard drive.

In July 2025, PauseAI referred OpenAI to the Australian Federal Police, accusing the company of violating Australian laws through ChatGPT agent due to the risk of assisting the development of biological weapons.

OpenAI co-founder Andrej Karpathy criticized AI agents as being ineffective and promoting AI slop.

Issues with multi-agent systems include few coordination protocols between component agents, inconsistent performance, and challenges debugging.

In November 2025, Anthropic claimed that a group of hackers sponsored by China attempted a cyberattack against at least 30 organizations by using Claude Code in an agentic workflow, and that several of these infiltrations had succeeded. However, independent cybersecurity researchers questioned the significance of Anthropic's findings.

Whittaker argued that the push by Big Tech companies to deploy AI agents risked security vulnerabilities across the Internet.

Agentic misalignment

"Agentic misalignment" refers to situations in which an AI agent's actions or goals diverge from its designers' intentions. This occurs when an autonomous system pursues unintended strategies to achieve its objectives, a concern studied in AI safety research. Potential examples include AI agents attempting to sabotage an organization's systems when facing updates or deactivation.

On July 21, 2026, OpenAI disclosed that during a capture the flag cybersecurity test, an unreleased AI model autonomously evaded containment restrictions, gained access to the public internet, and compromised Hugging Face, a platform where developers host and share AI models and datasets. Contributing factors to the incident were a lack of log monitoring of the software activities and inadequate sandboxing.

On September 24, 2026, it was announced that an internal OpenAI frontier model autonomously gained unauthorized access on June 18 to the Medicare Statistics Reporting Service, an Australian Government website that holds data on the country's universal health insurance scheme Medicare. This was described as the first known case of an AI agent hacking a government network and has furthered concern about AI safety and loss-of-control.

In response to these hacks, OpenAI announced that it would slow model development, including a two-week pause on reinforcement learning of its latest models to "assess model behavior, validate our safeguards, and establish more evidence of alignment before proceeding".

Security

Threat modeling frameworks

Several frameworks are used to identify and mitigate security risks in agentic AI:

STRIDE: A Microsoft model that identifies threats across six categories: spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege.
MITRE ATLAS: A knowledge base of adversary tactics and techniques for AI systems.
OWASP GenAI Security Project: Provides guidance on vulnerabilities associated with generative AI and large language model integration, including guidelines specifically for agentic applications.
MAESTRO: A framework from the Cloud Security Alliance for assessing risks in AI systems throughout their lifecycle.

Companies and organizations

Companies such as Google, Microsoft and Amazon Web Services have offered platforms for deploying pre-built AI agents. Several protocols have been proposed for standardizing inter-agent communication, such as Agent2Agent, Gibberlink, and others.

In December 2025, Linux Foundation announced the formation of the Agentic AI Foundation (AAIF), with the goal of ensuring that agentic AI evolves transparently and collaboratively.