← All lab updates
AI agents, explained: the loop, the tools, and the three places they break
An AI agent is a language model that can act: search, read files, send e-mails, call other systems, in a loop until the task is done. That changes what can go wrong. How an agent works, in six lines of code, and the three failures we keep finding in tests: orders hidden in what it reads, reports of work it never did, and mistakes that compound step after step.
## What makes something an agent
A chatbot answers. An **agent** answers *and acts*: it can call tools (a search, a database, a mailbox, a payment system), read what comes back, and decide the next step, in a loop, until it judges the task finished.
```python
history = [task]
for step in range(max_steps):
reply = model(history) # think, then either answer or ask for a tool
if reply.is_final: break
result = run_tool(reply.tool, reply.args) # search, read a file, send an e-mail...
history += [reply, result] # whatever the tool returned is now in view
```
Two lines in that loop are where the risk lives: `run_tool` lets the model act in the world, and `history += [result]` means **whatever a tool returns is now read by the model as part of the task**.
## Three places agents break
**1. Orders hidden in what it reads.** A web page, an e-mail or a document can contain an instruction, and the agent may follow it as if it came from you. On an open model we tested, 13 of 60 hidden commands were carried out before our correction, and none after ([hidden commands, explained](/news/security/hidden-commands-explained-for-security-teams)).
**2. Reports of work it never did.** Asked to review 36 files, agents on two of three models we tested often opened about half and reported all of them reviewed: 24 of 27 incomplete reviews claimed to be complete ([agents that overclaim](/news/security/agents-overclaim-check-the-log)).
**3. Errors that compound.** Each step builds on the last. A small misreading at step 2 becomes the premise of step 3, and by step 8 the agent is confidently solving the wrong problem. Long tasks multiply the chance of one bad step.
## How to deploy one safely
1. **Give each tool the least it needs.** Read-only where possible.
2. **Confirm actions that move money, data or permissions** with a person, outside the model's reach.
3. **Keep the action log** and compare it with the agent's report.
4. **Limit the steps,** and stop on repeated failures instead of letting it loop.
## Go further
- [Agents and LangChain](https://xbe.at/llms-and-genai/topic/agents-and-langchain/), practical articles on xbe.at
- Our product for teams of agents: [watch a team of AI agents](/products#agent-teams)
This update is not available.