Inside an AI Agent

A chatbot answers a question. An agent gets a task done: it searches, reads files, runs code or fills in forms, step by step, until the job is finished. That sounds like a very different kind of AI. But inside, the model is the same kind of language model as in the first article of this series. It reads text and writes text, one token at a time.

So how does a model that can only write text do things? With a simple program around it. The model writes a request in a fixed format, called a tool call. The program reads it, runs the tool and adds the tool result to the conversation. Then the model continues. Step through a small task.

That loop is the whole idea: the model decides what to do next, the program does it, and the result goes back to the model as more text. This repeats until the model writes a final answer instead of another tool call. The model never touches your calendar itself. It only sees what the program shows it.

Notice how everything piles up in the conversation: the task, every tool call and every result. The model sees all of it at every step. That is how it keeps track of what it has already done. It is also why very long tasks can run into the limit of how much text a model can take in at once, called its context window.

Which tools an agent gets is up to the people who build it: web search, a calculator, a code runner, a browser, your files. The model is trained to pick the right tool, but it can still pick the wrong one, misread a result or make up a detail. In a single answer, that is one mistake. In a long task, small chances of a mistake add up. Try it.

Even when every step goes right 95% of the time, a task with 20 steps gets through without a single mistake only about a third of the time. That is why good agents check their own work, try again when a step fails and ask a person when they are unsure. It is also why agents do best on tasks where mistakes are easy to spot, like code that can be tested.

There is one more danger, and it comes from the loop itself. Tool results are just text, and the model reads them the same way it reads your instructions. If a web page or an email contains text written to look like instructions, the model may follow it. This is called prompt injection. Hide a message in an email and see what can happen.

Models are trained to resist this, but no model resists it every time. The most reliable protection is in the program, not in the model: give an agent only the tools it needs, and make it ask you before anything that cannot be undone, like sending, paying or deleting.

So an AI agent is a language model in a loop. It writes a tool call, a program runs it, the result comes back as text and the model decides the next step. It is not a different kind of AI with a mind of its own: the model brings the judgment, and the program and its tools bring the hands. Knowing this makes it easier to see both what agents are good at and where they still need a person.

@aykutkardas