An AI agent is a language model that has been given tools and permission to use them without asking each time. That is the whole definition. Everything else follows from it, including the part nobody puts in the introduction.
The moment a model can act rather than only answer, the text it reads becomes capable of causing things to happen. That single consequence is the most important thing to understand before setting one up.
The Three Ingredients
| Component | What it means |
|---|---|
| A goal | An outcome rather than an instruction. “Sort my inbox” instead of “read this email” |
| Tools | Things it can call: files, a browser, an API, a shell |
| A loop | Act, observe the result, decide the next step, repeat until done |
Remove the loop and you have a chatbot with plugins. Remove the tools and you have a chatbot. The loop is what makes it an agent, and it is also what makes the behaviour hard to predict, since each step is chosen based on the result of the last one.
The Consequence That Follows Automatically
An agent reads things: web pages, files, emails, the output of commands it ran. All of that arrives as text, and to the model there is no reliable distinction between text that is data and text that is instruction.
The UK’s National Cyber Security Centre describes this directly in its guidance on security in AI systems: prompt injection is input crafted to make a model behave in an unintended way, and the risk grows as models are used to pass data into other applications and services. Their assessment is blunt, noting there are currently no failsafe measures against it.
Photo by Zan Lazarevic on Unsplash
The moment a model can act rather than only answer, the text it reads becomes capable of causing things to happen.
Why “Just Tell It Not To” Does Not Work
The instinct is to add a rule: ignore instructions found in content. Useful, and not a solution, because it relies on the model reliably distinguishing categories that arrive in the same channel, which is the thing it cannot do.
NCSC’s recommendation is architectural rather than linguistic: build a rules-based system around the model that prevents damaging actions even when the model is prompted to take them. The protection sits outside, in what the tools will permit, not inside the prompt.
| Weak control | Strong control |
|---|---|
| “Never send email without asking” | No send capability granted at all |
| “Do not delete anything” | Read-only credentials |
| “Only visit trusted sites” | Network allow-list enforced outside the model |
| “Ask before spending money” | No payment credentials in the environment |
The right column survives a compromised prompt. The left column is a request.
Photo by dlxmedia.hu on Unsplash
Where Agents Genuinely Help Today
- Repetitive work with a checkable result. Renaming and sorting files, extracting fields from a stack of documents. You can see whether it worked.
- Multi-step research inside a bounded set. Read these twenty pages, pull out every mention of a term.
- Code changes with a test suite. The tests are the rules-based system, and they run whatever the model believed it was doing.
- Drafting from scattered inputs. Pulling a summary together from several places you specified.
The common thread is that a human can verify the output quickly, and a wrong result is visible rather than silent. Tasks failing that test are the ones where agents disappoint expensively.
Starting Sensibly
Give it one tool. Watch what it does with that before adding a second. Run it somewhere a mistake is recoverable, on data you could afford to lose, with credentials scoped to the single job.
Then ask the question that decides everything else: what is the worst thing this could do if it were fully persuaded to do it? If the answer is unacceptable, the fix is removing capability, not adding instructions. Agentic features inside coding tools raise the same question, which is covered in Free AI Coding Assistants.
FAQ: Frequently Asked Questions
What is an AI agent, simply?
A language model given tools and permission to use them in a loop toward a goal, deciding each next step from the result of the last, rather than answering one question at a time.
Are AI agents safe to use?
They are as safe as the permissions you grant. The main risk is prompt injection, where content the agent reads acts as instruction, and NCSC notes there are currently no failsafe defences against it.
Can I stop prompt injection with a good system prompt?
Not reliably. Instructions help but depend on the model distinguishing data from commands, which is the exact weakness. Controls enforced outside the model are what hold.
What should a first agent do?
Something repetitive with an obviously checkable result, one tool, scoped credentials, in an environment where a mistake costs nothing to undo.
Security guidance referenced here is general and evolving; agent tooling changes quickly. Follow your organisation’s policy and current vendor documentation before granting an agent access to real systems or data.