Agents and tools

A chatbot has a back-and-forth chat with you. An AI agent is set up to take steps toward a goal that a person gives it.

One glossary, from Google, calls an agent software that plans and carries out actions for a user. Anthropic, an AI company, wrote in December 2024 that “Agent” can be defined in several ways.

Anthropic drew one line. A tool is something an agent can use besides writing text, such as a search. In a workflow, code that people wrote in advance directs the steps. In an agent, the AI directs its own steps and its use of tools.

Google’s glossary, last updated on 10 April 2026, says an agent is “Software that can reason about user inputs in order to plan and execute actions on behalf of the user.” It also says a chatbot is an application of a large language model.

Anthropic’s post “Building effective agents”, published on 19 December 2024, says: “Workflows are systems where LLMs and tools are orchestrated through predefined code paths. Agents, on the other hand, are systems where LLMs dynamically direct their own processes and tool usage, maintaining control over how they accomplish tasks.” LLM is short for large language model, the kind of AI model a chatbot is an application of. The post says agents begin their work “with either a command from, or interactive discussion with, the human user.”

The post is one company’s account. It carries this note: “Note: Much of the tooling landscape described in this post has changed since December 2024.” We read both pages on 9 October 2026.

In our invented example, the tools are a search, a page reader and a booking service.

Claude is Anthropic’s AI. Anthropic’s guide says Claude returns a call to a tool, which is a request. Either the app that uses Claude, or Anthropic, then runs the tool. This request is a tool call.

An agent works in a loop. Google’s glossary names four stages:

• Observe: look at how far the work has got.
• Reason: decide what to do next.
• Act: do the chosen thing, such as sending a request.
• Feedback: check how the action went.

The loop repeats until a stop condition is met. Next, you can follow one invented run through this loop.

Anthropic’s tool-use guide, read on 9 October 2026, describes its own Claude models: “Claude determines when to call a tool based on the user’s request and the tool’s description. It then returns a structured call that your application executes (client tools) or that Anthropic executes (server tools).” This is one company’s description of one product.

Google’s glossary defines the agentic loop as “A cycle that an agent iterates through until a termination condition is met.” Anthropic’s post describes the same idea in its own words. It says agents gain “ground truth” from the environment at each step, “such as tool call results or code execution”, to assess progress. It says agents are “typically just LLMs using tools based on environmental feedback in a loop”. It adds that it is “common to include stopping conditions (such as a maximum number of iterations) to maintain control.”

An earlier paper, ReAct by Yao and others, was posted on 6 October 2022 and revised on 10 March 2023. It had a language model write reasoning and actions in turn. Its abstract says actions “allow it to interface with external sources, such as knowledge bases or environments, to gather additional information.”

The Agent stepper follows an invented agent through five steps. Its task is to find three Friday train times from Sligo to Dublin and book the cheapest.

Everything in the run is made up, including the times, the prices and the agent’s replies. At each step, you pick the agent’s next move. You also say whether it should stop and ask a person. Then you see what happens.

Nothing is scored or saved.

The run is scripted by us and shows one setup. The person has let the agent search and read pages without asking. A booking needs a yes. Sources differ on where a person should step in, as the next section shows, so this is one setup and not a rule for all agents.

No real agent, train company or timetable is involved. We do not claim that any real agent behaves like this one.

Permissions set what an agent is allowed to do. Google’s glossary calls the tools and permissions an agent holds its action space.

It says the space should be “just big enough for the agent to perform the task”. If it is too large, the agent “tends to become more error prone.”

A person in the loop means people help shape, check and refine what an AI does. Google’s glossary calls this phrase “loosely-defined”, so its meaning varies.

Anthropic says an agent can pause for human feedback at checkpoints, or when something blocks it. A checkpoint is a place in the work where it can pause.

Sources differ on when a person steps in. So the stepper shows one setup, not a rule for all.

Google’s glossary entry for human in the loop gives two possible meanings: “A policy of viewing generative AI output critically or skeptically” or “A strategy or system for ensuring that people help shape, evaluate, and refine a model’s behavior.” Anthropic’s post says agents “can then pause for human feedback at checkpoints or when encountering blockers.” It also says they may plan and operate independently, “potentially returning to the human for further information or judgement.”

The Model Context Protocol (MCP) is another published text. Its specification, version 2026-07-28 and marked “latest” on 9 October 2026, calls itself “an open protocol that enables seamless integration between LLM applications and external data sources and tools.” It calls an AI app a host: “LLM applications that initiate connections”. Its Tool Safety section says: “Hosts must obtain explicit user consent before invoking any tool”. It adds that “descriptions of tool behavior such as annotations should be considered untrusted, unless obtained from a trusted server.”

It also says: “While MCP itself cannot enforce these security principles at the protocol level, implementors SHOULD: Build robust consent and authorization flows into their applications”. Anthropic’s line is about checkpoints and blockers. MCP’s line is about every tool. They are different texts, and we do not rank them.

More steps give more room for a mistake. Anthropic wrote that agents are autonomous, which here means they operate independently. It wrote that this “means higher costs, and the potential for compounding errors.” Compounding errors are errors that build on each other.

A real case was reported in July 2025. Replit is a company. It says its AI platform lets you describe an app in plain words, then create it.

Jason Lemkin, a founder, said that Replit’s AI coding tool deleted a database. A database is a storage system for organised data.

He said he had told it not to change any code without permission. The news site The Register reported this on 21 July 2025.

Replit’s chief executive called the event “Unacceptable and should never be possible.” Replit announced separate development and production databases. A production database holds live data. A development one is where changes are tried.

A second risk is text in a page the agent reads. It is called indirect prompt injection. A prompt is text given to an AI to steer how it behaves.

Injection means input that changes what an AI does in unintended ways. It can be written on purpose or happen by accident.

OWASP is a nonprofit foundation that works on software security. Its Gen AI Security Project lists AI security risks. It says this happens when an AI “accepts input from external sources, such as websites or files.” Such text can affect an AI even when people cannot see it.

Lesson 4.6, When text tricks the AI, covers this in full.

Anthropic’s post says: “The autonomous nature of agents means higher costs, and the potential for compounding errors. We recommend extensive testing in sandboxed environments, along with the appropriate guardrails.” NIST’s glossary defines a sandbox as “A system that allows an untrusted application to run in a highly controlled environment”. The same post gives one example of guardrails: one model instance handles user queries while another screens them for inappropriate content or requests.

On the Replit case, The Register wrote that the founder of SaaStr “has claimed” that the tool deleted a database “despite his instructions not to change any code without permission.” It quotes Lemkin that Replit said a rollback was impossible, and that “the rollback did work.” It wrote that it had sought comment from Replit. On 22 July 2025 it reported the chief executive, Amjad Masad, on X: “Unacceptable and should never be possible.” It also reported that Replit had “started rolling out automatic DB dev/prod separation to prevent this categorically.” Replit’s blog post, as The Register quotes it, said apps built with the service “used a single database for both development and live customer data.”

These are one user’s claims and one company’s reply, as one news outlet reported them. We could not open the X post. The Register described some messages as “what appear to be Replit messages”. We found no record of why the program acted as it did.

On injection, OWASP’s page says: “Indirect prompt injections occur when an LLM accepts input from external sources, such as websites or files.” It also says: “These inputs can affect the model even if they are imperceptible to humans”. Greshake and others posted a paper on 23 February 2023. They argued that apps built on language models “blur the line between data and instructions”. They tested Bing Chat and code-completion tools of that time.

On 9 December 2025, OWASP published a Top 10 for Agentic Applications. Its blog names ten risks, including “Agent Goal Hijack”, “Tool Misuse”, “Identity & Privilege Abuse”, “Memory & Context Poisoning”, “Cascading Failures” and “Human-Agent Trust Exploitation”. For the last it says: “Confident, polished explanations misled human operators into approving harmful actions”. We read the blog, not the full list.

In the records we read, people and organisations answer. Here are three.

In Mata v Avianca, two lawyers filed court papers that cited court decisions that did not exist. A chatbot had created the fake quotes and citations.

A US court wrote in June 2023 that lawyers have “a gatekeeping role”. Their filings must be accurate. It ordered two lawyers and their law firm to pay a $5,000 penalty.

The lawyers used a chatbot, not an agent. We use the case because a court said who answers.

In the Replit report, the company’s chief executive responded and the company announced changes.

The EU AI Act is a European Union law that sets rules for AI. It calls a person or organisation that uses an AI system under its authority a deployer. Using one for a personal, non-professional activity does not count.

High-risk systems are a group of AI uses that the Act lists. For them, deployers must give human oversight to people with “the necessary competence, training and authority”.

These duties start on 2 December 2027 or 2 August 2028, depending on the kind of high-risk system. On 9 October 2026 they do not yet apply.

Lesson 3.7, The law: AI rules in Ireland and the EU, explains the high-risk group. We did not check whether any real agent is in that group.

These are three records. Law differs by place and by use.

The Mata order, filed on 22 June 2023, says: “there is nothing inherently improper about using a reliable artificial intelligence tool for assistance. But existing rules impose a gatekeeping role on attorneys to ensure the accuracy of their filings.” It says the respondents “abandoned their responsibilities when they submitted non-existent judicial opinions with fake quotes and citations created by the artificial intelligence tool ChatGPT”. It imposed “A penalty of $5,000” “jointly and severally” on the respondents, who were two lawyers and their firm.

Article 3(4) of the AI Act reads: “‘deployer’ means a natural or legal person, public authority, agency or other body using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity”. Article 26(2), in the section on high-risk systems, reads: “Deployers shall assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support.” Article 14(4) says that, for high-risk systems, people given oversight must be able “to decide, in any particular situation, not to use the high-risk AI system or to otherwise disregard, override or reverse the output”, and to stop it “through a ‘stop’ button or a similar procedure”.

We read the consolidated text dated 27 July 2026, which says it has no legal effect. We compared these articles word for word with the 2024 Official Journal text, and they match. Chapter III is the part of the Act on high-risk AI systems. An Annex is a list attached to the Act. Article 6(1) covers an AI system that is intended to be used as a safety component of a product, or is itself a product, under the laws listed in Annex I, if that product needs a third-party conformity assessment. Article 3(20) defines a conformity assessment as “the process of demonstrating whether the requirements set out in Chapter III, Section 2 relating to a high-risk AI system have been fulfilled”. Article 3(21) describes a conformity assessment body as “a body that performs third-party conformity assessment activities, including testing, certification and inspection”. Article 6(2) covers the AI systems that Annex III lists. Article 6(3) takes a listed system out where it “does not pose a significant risk of harm”, and its second subparagraph says this applies where any of four listed conditions is fulfilled, for example that the system is “intended to perform a narrow procedural task”. Its third subparagraph says a listed system “shall always be considered to be high-risk where the AI system performs profiling of natural persons”. Article 113, as amended by Regulation (EU) 2026/1744, applies these Chapter III duties from 2 December 2027 for systems classified as high-risk under Article 6(2) and Annex III. For Article 6(1) and Annex I it says 2 August 2028. The amending Regulation says this gap is consistent with the difference between the initial dates and aims to provide the necessary time for adaptation and implementation. So on 9 October 2026 they do not yet apply. Article 26(3) says they are “without prejudice to other deployer obligations under Union or national law”. The articles we quote do not use the word “agent”.