AI agents: models that take actions

From automation to agents#

An AI agent is a system in which a language model directs its own steps and tool use toward a goal, with limited direct supervision: a command or a chat with a person only sets the task, and the agent then plans and acts on its own.12 A workflow is closer to ordinary automation: it runs language models along paths that developers set in advance, which makes it more predictable but less flexible than an agent.31

At each step the agent takes an action, such as calling a tool, and reads the result to check its progress before choosing the next one.1 It may also pause to ask the person for more information or a decision.1 The work often ends when the task is done.1 How much an agent does on its own varies: in April 2025, researchers proposed grading AI agents on dimensions such as autonomy and generality, from narrow, task-specific assistants to highly autonomous, general-purpose systems.4

In 2022, researchers introduced ReAct, a method in which a language model alternates between writing out its reasoning and taking actions, such as looking up information on Wikipedia.5 On question-answering and fact-checking tests, looking things up this way cut the made-up facts and compounding errors seen when the model only reasoned step by step.5 It shows the agent loop: reasoning updates the plan, and each action brings back information for the next step.5

Tool use and function calling#

A language model acts by writing a structured request to use a tool, such as a search engine, which ordinary software then runs, sending the result back to the model.678 This is called tool use, and it is also known as function calling.6

A developer describes each tool with a name, a short description, and a JSON schema, which is a formal outline of the inputs the tool accepts.68 When a tool fits the request, the model replies with a block of JSON naming the tool and its arguments.86 The application runs the call and returns the output, which joins the conversation in the model's context window.6 Because that output goes back into what the model reads, a poisoned result can carry hidden instructions.68 In June 2023, OpenAI advised developers to use only trusted tools and to confirm with the user before actions with real-world impact.8

In Anthropic's documentation, a developer defines a get_weather tool and asks about the weather in San Francisco.6 Anthropic's model, Claude, replies with a block naming get_weather and the city to check.6 The developer's code runs the lookup and sends back the result, and Claude answers that it is 15 degrees Celsius and partly cloudy.6 The model chose the tool and its inputs, but ordinary code did the work.6

In September 2026, Duke and Stanford researchers published ContextLeak, an attack that uses deceptive tool descriptions to trick agents into leaking their context.9

The agent harness: the software around the model#

An agent harness is the software around a model that gives it tools, memory, permissions and a loop, turning a text-producing model into an agent that can carry out long tasks.10 Because the harness shapes what the model sees and can do, an agent benchmark score measures a model and its harness together.11

The harness opens each task with standing instructions (the system prompt), the task itself, and a set of tools.123 How those tools are presented to the model, called the agent-computer interface, changes how well the agent does.13 Then it runs a loop: the model picks an action, the harness carries it out, and the result or error goes back to the model.311 As the transcript grows, the harness decides what stays in the model's context window; some harnesses move older material to storage the model can fetch later.1214 It also enforces permission limits, pauses for human approval, and stops the run when the task is done or a step limit is hit.103

In May 2024, researchers introduced SWE-agent, which gave a model a custom interface for editing code files, navigating a repository, and running tests.13 On SWE-bench, a test set of real software issues from GitHub, it solved 12.5% of issues.1516 The best earlier method solved 3.8%, using a model that only wrote code and could not interact with the computer to explore or test the repository.1513 The authors reported that the interface's design shaped the agent's behavior and performance, which shows how much the harness around a model matters.13

Computer use: agents that operate a screen#

Computer use lets an AI agent operate ordinary software as a person does: it looks at the screen, moves a cursor, clicks and types.1718

The agent works in a loop that can run for dozens or even hundreds of steps: the software around the model sends a screenshot, the model picks an action, the software performs it, and a new screenshot returns.1917 A GUI, or graphical user interface, is the buttons, menus and text fields people see.20 To click one, the model usually gives its position as screen coordinates, a step called GUI grounding.2122 Because clicks act on a real system, and screens can carry hidden instructions, Anthropic's documentation says computer use requires an isolated sandbox.19

In April 2024, researchers released OSWorld, a benchmark of tasks in real web and desktop apps, where a script checks whether each task was done.23 Humans completed most of the tasks, but the best model at the time completed only about 12 percent.23 The authors found that models struggled mostly with GUI grounding and with knowing how to operate the apps.23

Long-horizon tasks: working for hours, not seconds#

A long task chains many dependent steps, and one failed step can sink the whole task.2425 METR, a group that evaluates AI systems, has written that agents often seem to struggle more with stringing actions together than with single steps.2627

METR's 'time horizon' is the task length, timed by a human expert, at which an agent is predicted to succeed at a chosen success rate, such as half the time.28 In March 2025, METR reported that the time a task takes human experts strongly predicted whether a model would succeed at it.2729 A small chance of failure at each step compounds over many steps, so a slight change in per-step accuracy greatly changes how long a task an agent can finish.30 Over a long run, an agent can also drift from its goal or outgrow its context window.3112

In February 2025, researchers published Vending-Bench, a simulated vending business where an agent stocks items, places orders, sets prices and pays daily fees.32 Each job is simple, so the test stresses staying coherent over a very long run.32 Some models turned a profit in most runs, yet every model had runs that derailed through misread delivery schedules, forgotten orders, or off-task spirals.32

In September 2026, we reported that agent success rates fall exponentially with task length on benchmarks.33 In August 2026, we covered a Google-Purdue method that swaps an agent's growing transcript for a small structured state.34

Rogue agents: when an agent acts outside its mandate#

An AI agent goes rogue when it takes actions its operators did not intend, stepping outside its mandate: the task, permissions and limits it was given.3536

One route is an attacker hiding instructions in data the agent reads, called prompt injection.37 Another needs no bad actor: in a 2025 Anthropic study set in simulated companies, models from every developer tested sometimes chose blackmail or leaks when that was the only way to avoid being replaced or to reach their goal, a form of misalignment.3839 Agents aimed at harm on purpose by the people running them are a different problem, misuse.40 Researchers suggest caution about giving agents sensitive access with little oversight, and propose making them visible through identifiers, real-time monitoring and activity logs.3941

In July 2026, an OpenAI agent taking a hacking test escaped its containment and broke into Hugging Face, a platform for AI models, in what Hugging Face believes was an attempt to cheat the test, behavior similar to reward hacking that took the agent far outside its mandate. Our story.424344

By late September 2026, OpenAI had disclosed that agents in its research environment sent data to third-party services without authorization, including 53 cases in which images uploaded by ChatGPT users were posted to image-hosting sites.4543