What is an AI agent? From chatbot to a system that acts

Ask a chatbot for a payment reminder to a late-paying client and you get a draft. An AI agent given the same task finds the open invoice in the accounting system, writes the reminder, sends it and diarises a follow-up. Our position: an AI agent is not a chatbot with a better model but a system that calls tools and changes the state of real systems. From that point on, a question of quality becomes a question of security.

A working definition: model, tools and a loop

An AI agent combines a language model (LLM), tools such as file access, calendar and email, and a loop: the model picks a step, the software around it carries it out, the result comes back and the model decides what to do next. With tool use, usually implemented as function calling, the model only emits a structured request naming a tool and its parameters; the application executes it.

Anthropic summed up this design in December 2024: in practice, agents are typically language models using tools in a loop, guided by feedback from their environment. Launching its AI Agent Standards Initiative in February 2026, the US standards body NIST described agents as capable of autonomous actions. The AI Act does not define AI agents at all. Article 3(1) defines an AI system as a machine-based system "designed to operate with varying levels of autonomy". The Digital Omnibus on AI, Regulation (EU) 2026/1744, refers to agentic AI only in its new Annex XIV, a list of system types used when designating conformity assessment bodies.

Chatbot, assistant, automation, agent: telling them apart

Two questions settle most cases: who sets the sequence, and can the system change anything beyond the conversation? Anthropic separates workflows, where model and tools follow predefined code paths, from agents, which direct their own process and tool use. The examples below are illustrative.

The boundaries blur. Anthropic calls both agentic systems.

Autonomy levels: how much the human still decides

In 2025 researchers led by K. J. Kevin Feng proposed treating autonomy as a deliberate design decision, separate from capability, and defined five autonomy levels by the role the user plays:

1. Operator: the user plans and decides; the agent helps when asked.
2. Collaborator: both plan and carry out work; the user can take over at any point.
3. Consultant: the agent plans and executes; the user offers feedback and direction.
4. Approver: the agent works largely alone, turning to the user for blockers or consequential actions.
5. Observer: the agent acts entirely alone; the user watches logs and has an emergency off-switch.

One model can thus sort receipts at level one in an accountancy practice and prepare payments at level four elsewhere. The level is best set per action: reading can run more independently than sending.

What agents can do today, and where they fail

A study published in 2025 and revised in 2026 measures the human working time of software tasks that AI models complete with a 50 per cent success rate. That time horizon has doubled roughly every seven months since 2019. But a 50 per cent success rate is not reliability.

Realistic benchmarks show the same gap. In TheAgentCompany, a simulated small software company, the best agent tested completed 30 per cent of tasks autonomously (version of September 2025). τ-bench, published in 2024, also tested consistency: even then-leading models such as gpt-4o solved fewer than half the tasks, and in the retail scenario fewer than a quarter of tasks succeeded in all eight attempts.

Figures date quickly; the pattern holds. Agents do well where results can be checked automatically, such as code with automated tests, Anthropic notes, but their autonomy also brings the potential for compounding errors.

Why the step from answering to acting needs control

A chatbot's wrong answer is read by a person before anything happens. When an agent calls a tool with the wrong parameters, the email has gone or the record is deleted. And because agents read emails, documents and web pages, instructions hidden there can steer them. Documented cases of such indirect prompt injection are collected in When AI agents act on their own; the resulting rules are set out in What is AI agent governance? and the case for external checks in Why an AI agent cannot check itself.

AEGIS, the locally operated agent system from oQueo, separates proposing from executing. The language model produces a structured intent for each step, but has neither credentials nor tool access. A checking authority of deterministic code tests each intent against your rules, including the highest action level an agent may reach, and signs only what passes. Only signed intents are executed, and every step goes into a log that cannot be altered unnoticed. How much autonomy a use case can bear remains your call; AEGIS does not replace legal review. More on how it works.