Key insight

A chatbot talks; an AI agent acts. An agent is a language model wired to tools and driven by a loop: it decides on a step, takes it, sees the result, and decides again — repeating until a goal is met. That single ability — to take real actions in the world, with some autonomy — is what makes agents extraordinarily useful, and it is also the root of every security concern in this series. Understand the agent, and every later risk becomes a variation on one theme: the model can now do things.

The phrase “AI agent” is used everywhere and defined almost nowhere, so let us build it up from nothing. By the end of this page you will be able to say, precisely, what an agent is, how it differs from the chatbots you have already used, and why that difference is the reason a whole series on security exists. We will assume you know nothing beyond having once typed a question into an AI and read the answer.

1 · Start with the model: a text predictor

At the centre of every agent sits a language model — the same kind of system behind the familiar chat assistants. Strip away the mystique and a model does one thing: given some text, it predicts what text should come next, one piece at a time, based on patterns it learned from enormous amounts of writing. It has no hands, no memory of yesterday, and no way to touch anything outside the words in front of it. It is, in the most literal sense, a very sophisticated text-completion engine. Hold that plain picture — a thing that reads text and writes text — because everything else is built on top of it.

A language model reads text and writes text, with nothing else attached Text goes into a box labelled Language model, and text comes out. A caption notes it has no hands and touches nothing in the world. text in Language model text out No hands. It touches nothing in the world — yet.
Figure 1. The raw model is pure text-in, text-out. Every capability beyond that is something we bolt on around it.

2 · A chatbot: the model behind glass

A chatbot is the simplest possible use of that model: you type a message, the model writes a reply, and you read it. That is the whole arrangement. The model sits behind glass — it can produce words for you to look at, but it cannot reach through the glass to do anything. If you ask a chatbot to book a flight, the very best it can do is write out instructions for booking a flight; it cannot actually book one, because writing text is the only thing it can do. This limit is not a flaw — it is a form of safety. The worst a pure chatbot can do is say something wrong. Keep that ceiling in mind, because an agent raises it dramatically.

3 · Tools: giving the model hands

An agent begins the moment we give the model tools. A tool is simply a connection to something outside the text — the ability to run a web search, send an email, read a database, call another program, move a file. We give the model a menu of these tools and teach it that, instead of only writing an answer, it can write a request to use a tool, and the system around it will carry that request out and hand back the result. Tools are the hands the model never had. With them, “book a flight” stops being a paragraph of advice and becomes an action the agent can actually perform. This is the single upgrade that turns a talker into a doer.

Adding tools gives the model the ability to act on the world A model box connects out to four tools: search, email, database, and files. A caption states tools are the hands the model never had. the model search the web send email read a database \u2026move money, files\u2026 Tools are the hands the model never had
Figure 2. Each tool is a doorway to the real world. The set of tools you grant is exactly the set of things the agent can do — for good or ill.

4 · The loop: what makes it an agent

Tools alone are not quite an agent; the final ingredient is the loop. A real task takes many steps, and the agent works through them by cycling: it looks at the goal and decides on the next step, it uses a tool to take that step, it reads the result, and then it decides again — over and over — until the goal is met. Ask it to plan a trip and it might search for flights, read the results, pick one, check a calendar, then draft a confirmation, each step informed by the last. This think–act–observe cycle is the beating heart of an agent. It is what lets a text predictor accomplish a multi-step goal in the world rather than answer a single question. Model plus tools plus loop — that is an agent.

5 · Autonomy: acting without asking

The loop introduces the quality that makes agents both powerful and unsettling: autonomy. Between the moment you give the goal and the moment it finishes, the agent is making its own decisions about which steps to take, often without checking back with you. You said “sort out my inbox”; it is now deciding, on its own, which emails to archive, which to reply to, which to flag. Autonomy is the whole point — it is why an agent saves you effort rather than needing a click at every step. But it also means the agent can take actions you did not specifically approve, based on its own reading of a situation that may have been influenced by things you never saw. The more autonomy, the more useful — and the more that can happen without a human in the moment.

6 · Why acting changes everything

Now we can state the idea that the rest of this series depends on. A chatbot that is fooled, confused, or manipulated can only produce bad words — unpleasant, but contained. An agent that is fooled, confused, or manipulated can take bad actions — send the email, move the money, delete the records — using its real tools and real access. The exact same mistake that would be harmless in a chatbot becomes consequential in an agent, because the agent can reach through the glass. This is why we care so much more about the security of agents than of chatbots: not because the model is different, but because we handed it hands. Every later topic is, at bottom, an exploration of what can go wrong once a model can act.

The one sentence to remember

A chatbot talks; an agent acts. Everything difficult about agent security flows from that single upgrade — the ability to take real actions in the world.

7 · What it means for security

Two practical instincts fall straight out of this picture, and they will recur in every topic ahead. First, the tools you grant define the danger: an agent can only ever do what its tools allow, so the smallest set of tools that gets the job done is also the safest. Second, autonomy should be earned, not assumed: the bigger and more irreversible an action, the more a human should stay in the loop before it happens. You do not need any of the later topics to start applying these — they follow from simply understanding what an agent is. An agent is a model you gave hands and a measure of freedom; security is the discipline of making sure those hands can only reach what they should, and that the freedom stops short of the actions you would regret.

8 · A simple test you can run this week

Name the agent

1. Pick one AI feature you use or build — is it a chatbot (only talks) or an agent (can act)?
2. If it can act, list every tool it can reach — that list is its power.
3. Ask which of those actions you would not want taken without your say-so.
4. Any action on that list with no human check is where the rest of this series will matter most.

The lesson: knowing whether a system talks or acts, and exactly what it can act upon, is the first and most important security judgment you will make.

9 · Glossary — every term, spelled out

Language model
A system that reads text and predicts what text comes next, based on patterns learned from vast writing. It only reads and writes text.
Chatbot
The simplest use of a model: you type, it replies. It can produce words but cannot take actions in the world.
Tool
A connection that lets a model act outside of text — search, email, a database, another program. Tools are the agent’s hands.
Agent
A model given tools and driven by a loop, so it can take multiple steps to accomplish a goal in the world.
The loop
The think–act–observe cycle: decide a step, take it, read the result, decide again, until the goal is met.
Autonomy
The agent making its own step-by-step decisions without checking with a human at each one. The source of both its usefulness and its risk.
Blast radius
How much harm a single mistake or successful trick can cause — for an agent, roughly the sum of everything its tools can reach.
Key takeaways

A model reads text and writes text; a chatbot is that model behind glass, able only to talk.
Tools give the model hands, and a loop lets it take many steps — model plus tools plus loop is an agent.
Autonomy is the point and the peril: the agent acts without asking, so a trick becomes an action, not just words.
The tools you grant define the danger — grant the fewest needed, and keep a human before the actions you would regret.

References

  1. OWASP, Top 10 for Large Language Model Applications — the risk landscape that agents introduce. owasp.org
  2. NIST, Artificial Intelligence Risk Management Framework (AI RMF 1.0), National Institute of Standards and Technology. nist.gov
  3. This guide’s Tokens, Context & How Models Read, Explained From Zero — how the model actually takes in text.
  4. This guide’s Excessive Agency, Explained From Zero — what happens when an agent is granted too much power.