What is an AI agent? How agents work, and which jobs to hand one

An AI agent is software you give a goal instead of a single instruction. It works in a loop: it decides the next step, uses tools such as a browser, a CRM or an inbox to act, reads what came back, and repeats until the job is done or it needs a person.

A chatbot answers; an agent acts. That makes an agent in a sales or marketing team only as reliable as the CRM data and marketing automation it acts on, because it treats whatever a field says as true.

How an AI agent works, step by step

Every agent runs the same loop, whatever it was built for. Give it a goal, such as finding every open deal with no next meeting booked, and it works through these steps on its own:

• Plan. It breaks the goal into steps, and changes the order as it learns more.
• Act. It takes one step with a tool: a CRM search, a web page, a draft email.
• Check. It reads what came back and compares it with the goal.
• Repeat or stop. It takes the next step, or stops when the goal is met, a limit is hit, or a person needs to decide.

Four parts make the loop possible. A large language model decides each next step. Tools let it act on other systems. Memory holds the goal and the results so far, and sometimes notes kept between sessions. Instructions and permissions say what it is for and what it may do alone.

The US National Institute of Standards and Technology, asking for input on agent security in January 2026, described agents as able to plan and take autonomous actions that affect real-world systems. That is the difference. A chatbot’s mistake is a wrong answer; an agent’s mistake is a wrong action.

What an agent harness is, and why it matters

An agent is a model plus a harness. The harness is the software around the model that runs the loop: it hands the model the goal and the context, carries out the tool calls the model asks for, returns the results and enforces the limits.

Anthropic, describing its managed agents in April 2026, calls it “the loop that calls Claude and routes Claude’s tool calls to the relevant infrastructure”. So the same model can behave differently in two products: the harness decides what it sees and what it can touch.

Harnesses age, too. Anthropic added context resets to one harness because a model tended to wrap up early as it neared the limit of what it could hold in view. When the same harness ran a more capable model, the habit had gone, and the resets only got in the way.

Two open formats plug into most harnesses. A skill is a folder holding a SKILL.md file of instructions for one task, which the agent loads only when that task comes up.

The Model Context Protocol, or MCP, connects an agent to other systems, such as a CRM or an analytics account. Of the 30 agents in the 2025 AI Agent Index, 20 support it. The Agentic AI Foundation, which governs it, reached 305 member organizations in October 2026.

The rulebook is the part a business writes itself. The agent that edits this site reads a plain text file of rules at the start of every session, called CLAUDE.md in Claude Code. Two of its rules, trimmed:

- Check every figure word for word
  on the primary source, opened in
  a browser.
- Never name or cite a competitor.

Neither rule makes the agent infallible, so a person still reads its work. Both stop the commonest mistakes before they reach a page.

AI agent vs chatbot, assistant and agentic AI

Most confusion about agents is vocabulary, because AI at work still mostly means a chat window. In Pew Research Center’s survey of 5,119 US adults in February 2026, 38% of employed adults said they use chatbots for tasks at work. These are the terms that get mixed up most:

The UK’s Competition and Markets Authority draws the same line in its 2026 paper on agentic AI: agents sense, decide and act, which sets them apart from traditional automation that follows predefined rules and from chatbots that mainly generate responses.

So “agentic AI vs AI agents” is a question of grammar. An AI agent is the thing; agentic describes how it behaves. A product can be more or less agentic depending on how much it decides without asking.

Types of AI agents, and the ones you will meet

Textbooks sort agents by how they decide. Simple reflex agents react to what they see, model-based agents track what they cannot see, goal-based agents plan toward a target, utility-based agents weigh trade-offs, and learning agents improve from feedback.

Agents built on language models do a little of all five, so the more useful sorting is by what an agent acts on:

• Coding agents, such as Claude Code and OpenAI’s Codex, read files, run commands and change a project’s source. Marketing teams use them to run sites and data jobs, not only code.
• Browser agents open web pages and click, type and fill in forms on someone’s behalf.
• Research agents search and read many sources, then write one report, such as a brief on an account before a call.
• Agents inside business apps are built into a CRM, a help desk or an ad platform, and act only on that app’s data.
• Customer-facing agents answer and act for customers in chat or email, such as changing a booking or issuing a refund.
• Multi-agent systems split one job between several agents, with one coordinating and handing parts to the others.

What AI agents can do today, by the evidence

Agents are improving fast and still miss often. Stanford’s 2026 AI Index found they moved from answering questions to completing tasks in 2025. On OSWorld, a test of real computer tasks, accuracy rose from about 12% to 66.3%, within six points of people.

The same report says agents still fail roughly one in three attempts on structured benchmarks. That miss rate is fine for a draft a person reads, and not for an email that goes straight to a customer.

The length of task they can finish keeps growing. METR, a nonprofit that measures AI agents, times how long software tasks take skilled people and finds the length an agent completes half the time. In January 2026 it put the doubling time for that length at 131 days.

Finishing a task once is not finishing it every time. A Princeton study of 15 models, accepted at ICML 2026, found 24 months of capability gains had brought only small improvements in reliability: more accurate models stayed inconsistent across runs and brittle when a prompt was reworded.

Disclosure lags behind. The 2025 AI Agent Index, led by Cambridge researchers, documented 30 deployed agents: 25 publish no internal safety results, and 21 have no documented default for telling people they are dealing with AI.

Read together, the numbers favor narrow jobs with a quick check at the end. The agent does the legwork, and a person reads the result before anything leaves the building.

AI agents in B2B sales and marketing

Agents earn their keep on work that is frequent, tedious and quick to check. They cost most where a mistake reaches a buyer.

Jobs worth handing an agent

• Account research before a call. The company’s recent news, hiring and leadership changes, and the people on the invite, on one page.
• CRM cleanup. Duplicate records, missing fields, deals with no next step, and stages that have not moved in weeks.
• Routing checks. Every new lead traced to an owner, with any that sat unassigned flagged the same day.
• Weekly reports. Pipeline by source and stage, written up with what changed since last week.
• First drafts. Briefs, ad variations and follow-up emails that a person edits before anything goes out.

Jobs to keep with a person

Sending at volume comes first. LinkedIn’s User Agreement forbids bots or other unauthorized automated methods to add contacts or send messages, so an agent working a LinkedIn account puts that account at risk.

Email has a ceiling of its own. Google’s sender guidelines for Gmail ask senders to keep reported spam below 0.1% and never reach 0.3%. An agent can write faster than a market wants to read, and the complaints land on your domain.

Pricing, discounts and anything that commits the company stay with a person too. So does telling people they are dealing with AI: the 2025 AI Agent Index found that enterprise agent platforms generally leave that duty to the business deploying the agent.

In the EU, the AI Act’s transparency rules have applied since 2 August 2026. A system that talks directly with people must be built so they know it is AI, so check what yours does before it writes to anyone.

Agents on the buyer’s side

Buyers are getting agents of their own. Forrester’s 2027 predictions for business buyers, published on 28 October 2026, expect agentic buying to play a role in 75% of B2B purchases, with agents finding suppliers, gathering information and drafting RFPs.

Forrester also expects buyers to double their human interactions to check what AI recommends. Both are forecasts, and the work they point to costs little either way: pricing, integrations and proof on plain pages that an agent can read and a person can verify.

Risks, and who answers for an agent

The risk that belongs to agents alone is prompt injection: instructions hidden in something the agent reads, such as an inbound email or a web page, which it then follows. An agent that can read your inbox and send mail can be steered by a stranger’s email.

NIST’s January 2026 request for information on agent security lists indirect prompt injection among the risks from adversarial data. The defense is the one you would use for a new hire: limit what any single message can make the agent do.

Mistakes and costs compound. Each step builds on the last, so a wrong assumption early shapes everything after it, and every step is another paid call to the model.

Responsibility does not move to the software. The CMA’s guidance for businesses using agents, updated in October 2026, says “you are responsible for what an AI agent does in the same way you are responsible for what an employee does”.

So the control that matters is how much an agent may do without asking, set by how easily each action can be undone: reports first, drafts next, and actions only where a mistake can be reversed.

Where to start with an AI agent

• One job. Pick a weekly task a person can check in minutes, such as the CRM cleanup above.
• Read-only first. Let it report for a few weeks, then draft, and act only where a mistake can be undone.
• Rules before the first run. Write down what the job is, what done looks like and what it must never do.
• A log. Record every action with the date and the reason, so a change in the numbers can be traced.
• An honest count. Compare the time spent checking its work with the time it saves. If checking takes longer, the job is wrong for an agent.