Agentic AI

How it works

Agentic AI describes systems where a language model does not just answer but plans and acts: it breaks a goal into steps, calls tools, observes results, and loops until the task is done. An agent typically has a model at its core, a set of tools (search, code execution, APIs, an MCP server), a memory, and a control loop that decides the next action. The defining shift from a chatbot is autonomy: the system takes actions in the world with limited human intervention.

When it matters

Agentic AI matters because autonomy multiplies both value and risk. An agent that can act is an agent that can be steered by prompt injection into acting badly, so the blast radius equals the union of its tools' permissions. Least-privilege tool design, human approval on destructive actions, and full audit logging move from nice-to-have to mandatory. See Secure an MCP Server and Red-Team an LLM.

Common misconceptions

• "An agent is just a chatbot with a fancy prompt." The difference is it takes actions, which is a security boundary, not a UX flourish.
• "More autonomy is always better." Autonomy without scoping is how a single injected instruction becomes a real incident.
• "Agents reason, so they will refuse bad instructions." They can be manipulated through tool use output; enforce limits structurally.