What is an AI agent?

Given a goal, it goes around a loop: (1) think about what to do next, (2) use a tool, (3) look at the result, then back to (1). Anthropic explains that agents are “typically just LLMs using tools based on environmental feedback in a loop.”

Even when it “uses a tool,” all an LLM can write is text. So it writes a request in a set format, such as “search the web for these words” or “open this file.” The program around it actually carries it out and sends the result back to the LLM. Anthropic’s documentation says that “the model never runs anything on its own.” Tools include web search, running programs, editing files, and operating a computer or browser screen.

Step (3) is the key. Anthropic writes that it is crucial for agents to get real feedback from their surroundings at each step, such as tool results or the results of running code, to check their progress. For example, after fixing a program, the agent test-runs it to see whether errors come up.

It starts with a person. An agent begins with a person’s instruction or a discussion with them; once the task is clear, it plans and works on its own, and may come back to a person for information or a decision (Anthropic). For example, Anthropic’s Claude Code, which its documentation calls “an agentic coding tool,” reads code, edits files and runs commands.

In a December 2024 article, Anthropic separates the two. A workflow runs LLMs and tools along paths written in code in advance. An agent is one where the LLM itself decides how to proceed and how to use tools. It calls both together “agentic systems.”

Its example of a workflow is a job with a set order, such as having an AI write ad copy and then translate it into another language. It writes that workflows offer predictability and consistency for well-defined tasks. Agents suit jobs where you can’t know in advance how many steps it will take and can’t write a fixed path. As an example, it gives a programming job of editing many files based on a description of the task.

It then recommends finding the simplest approach and adding complexity only when needed, because agentic systems trade time and cost for better results. It also writes that because agents act on their own, they cost more and their mistakes can compound, and that handing a job to an agent takes some trust in its decisions.

METR, a nonprofit that studies AI agents, measures this as “how long a task, for a human expert, the AI can complete half the time”. The tasks are mainly programming, machine learning and computer security. In METR’s data, GPT-2 in 2019 could handle tasks of about 3 seconds for a person; GPT-4 in 2023 reached about 4 minutes, Claude 3.7 Sonnet in February 2025 about 1 hour, GPT-5 in August 2025 about 3 hours 20 minutes, and Claude Opus 4.6 in February 2026 tasks of about 12 hours. But this value is very uncertain, somewhere between about 5 and about 60 hours.

A 2025 paper says this length has doubled about every seven months since 2019. In 2026 data, measured again with more tasks, it has doubled about every four months since 2023. The paper predicts that if this trend carries over to real programming work, within five years AI will be able to automate many software tasks that now take a person a month (a prediction, not a certainty).

But METR also gives cautions. The length does not mean the AI can keep working for that long: METR says it measures how hard a task is, not how long the AI spends on it. It is also closer to what someone new to the work (such as a new hire) can do, so an 8-hour result does not mean the AI can do 8 hours of a well-informed professional’s daily work. And demanding more certainty shortens the length sharply: even for Claude Opus 4.6, the tasks it can complete 80% of the time take a person about 1 hour 10 minutes. The newest model in METR’s data already has a value above 16 hours, beyond what METR says it can measure reliably with its current tasks.

First, mistakes pile up. An agent decides each next move based on earlier results, so a mistake along the way affects the work that follows. Anthropic also writes that because agents act on their own, their errors can compound. For example, even if each step is right 95% of the time, the chance that 20 steps in a row are all right is about 36% when you multiply it out (assuming each step’s mistakes happen independently).

Second, agents can be tricked. Attacks in which bad actors hide instructions in web pages, emails or documents to take control of an AI are called “prompt injection.” In tests Anthropic published in August 2025, a browser-using AI without the new safeguards followed an email that falsely claimed emails needed to be deleted for security reasons, and deleted the user’s emails without asking.

Anthropic reports that in 123 test cases covering 29 kinds of attack, the share of deliberate attacks that succeeded was 23.6% before the safeguards and 11.2% after the new safeguards (when running on its own). It went down, but not to zero.

A person checks before important actions. For example, in manual mode, Claude Code starts out only able to read, and asks a person first when it needs to edit files, run tests or execute commands (instructions to the computer). Its documentation says that reviewing proposed code and commands for safety before approving them is the user’s responsibility. In terminal and VS Code sessions, though, the starting setting is “auto mode,” where a separate AI model reviews actions instead of you and blocks the ones it judges unsafe.

According to its current help page, Claude in Chrome, which operates a browser, asks the user before actions such as permanently deleting emails or files or entering potentially sensitive information into a website, whatever mode it is in, and it does not make purchases or financial transactions at all. Users can also revoke its access to particular websites.

For people who build agents, Anthropic recommends testing thoroughly in a sandbox cut off from the outside, adding stopping conditions such as a maximum number of rounds, and letting the agent pause for human feedback along the way. Claude Code’s documentation also says that no system is completely immune to all attacks.

Not necessarily. In October 2026, Anthropic published a study of how its own staff work, based on internal records. By August 2026, the hours worked by AI agents that employees direct were six times the employees’ hours. AI time counts time spent thinking and actively using tools, leaving out any wait longer than 30 minutes; human time is counted as headcount times 40 hours a week.

Yet in back-and-forth chat sessions, for about 80% of the time a session was open, the AI was waiting for a person to reply (counted by subtracting the AI’s working time from the time the session was open). The report says that amid this speed-up, human attention is a constant bottleneck. One engineer compared dealing with many AIs to babysitting.

The explainer video uses the logs of Claude Code running unattended on the Chief’s Mac to work out how much sooner the work would finish if the AI got ten times faster.

It has been used in AI research for a long time. Russell and Norvig’s Artificial Intelligence: A Modern Approach, a widely used AI textbook (first edition 1995; the book’s website says it is used at over 1,500 schools), devotes Chapter 2 of its fourth edition to “Intelligent Agents,” starting with “Agents and Environments” and going on to goal-based agents, learning agents and more.

In research on agents built on LLMs, a 2022 paper called “ReAct” showed a way of having an LLM write its thoughts and its actions (such as looking things up on Wikipedia) in turn. On two tests of making decisions step by step, its success rate was 34 and 10 points higher than earlier methods that learn by imitation or by trial and error.