what is an agent?

← back to the course page

Ten minutes on what an agent is, what it does while you are not watching, and the words you will hear all term. Read it if you have never used one, or have used one without being sure what made it an agent. No computer science needed.

Written by Claude, edited by JB.

The short version

A large language model predicts text. That is the whole of what it does. Give it some words and it produces the words that plausibly follow, one piece at a time, based on patterns in an enormous amount of training text.

An agent is that same model placed in a loop, handed a set of tools it can actually operate — a shell, a web browser, a Python interpreter, your file system — and given a goal rather than a question. It decides what to do, does it, looks at the result, and decides what to do next, repeating until it thinks it is finished or you stop it.

That one change is where both the usefulness and the risk come from: the model is no longer describing the world, it is acting in it.

Four rungs

The word “AI” now covers systems that differ enormously in what they can do to your data. Think of them as four rungs on a ladder. The same task runs through all four.

These are rungs of capability, not brands. One product can sit on several of them depending on what is switched on, and the box you type into looks identical either way. The useful habit is asking which rung you are on right now, not which company made the tool.

• A language model

  Text in, text out. No memory between uses, no access to anything, no way to check what it said. It is not looking anything up. It is producing what sounds right.

  Our taskWe asked one for herbarium records of Clarkia xantiana subsp. parviflora collected before 1980. It said it had no live access to any database, then listed specimens anyway — Abrams 5361, Howell 5021, Munz 13345, Lewis 412 — with dates, localities and herbaria. Every collector is real. Not one of those collection numbers appears among the 452 herbarium specimens of this species in GBIF, and the real dates for those collectors miss the claimed ones by decades. Asked again, it named a different botanist as the original collector. Nothing in the output looks wrong; only checking the database shows that it is.

• A chatbot

  The same model wrapped in a conversation, so it remembers what you said earlier in the session and has been trained to be helpful and to follow instructions. With no tools switched on it still has no access to anything outside itself: it cannot look anything up, and it cannot check its own claims.

  Our taskYou can now refine across turns — "only Californian records," "only after 1980." The answers get more responsive to you. They are not any more likely to be true.

• A model with tools

  Now it can call things: search the web, run a snippet of code, query a database. Crucially, it can bring real results back into its own context and use them. This is the rung where output can start being checkable, because there is now something outside the model that produced it.

  Our taskIt queries GBIF and returns records that do exist, because it fetched them, and you can click through and check. What it says about them is still its own summary. And you are still driving: one request, one answer.

• An agent

  You give it a goal instead of an instruction, and it plans its own route. It chooses which tools to use and in what order, runs them, reads what came back, notices problems, and tries again. It may take fifty actions before it says anything to you. That stretch of unsupervised action is what makes it an agent.

  Our task"Get the occurrence records for this species, clean them, and fit a species distribution model." It pulls the records, drops the ones at (0, 0) and in the ocean, throws out everything georeferenced only to a county centroid without telling you, picks a climate dataset you have not heard of, fits it on defaults, and hands you a map. You are not consulted at any point. Two of those choices were routine. Two it made on your behalf. Which two, and how would you know?

List herbarium specimens of Clarkia xantiana subsp. parviflora
collected before 1980. For each, give the collector, collection
number, collection date, locality, and the herbarium where it is
deposited.

https://api.gbif.org/v1/occurrence/search?scientificName=Clarkia%20xantiana&basisOfRecord=PRESERVED_SPECIMEN&limit=300

Query the GBIF API for preserved herbarium specimens of Clarkia
xantiana collected before 1980. Show me collector, collection
number, year, and the GBIF occurrence key for the first ten.

Get the occurrence records for this species, clean them, and fit
a species distribution model.

Same task, but: draw background points only from within 300 km of the
occurrence records, not from the whole map. Screen all 19 bioclim
variables for collinearity and drop until every |r| < 0.7, instead of
picking three. Include quadratic terms so a species can have a climatic
optimum. Evaluate with spatial block cross-validation, not on the
training data. Then tell me where the single highest-predicted cell is,
and how far it is from the nearest real record.

The loop

Every agent, whatever it is called and whoever built it, is running the same cycle. The pattern was named by Yao et al. (2022), who showed that making a model reason and act in turn, rather than only reason, beat both on its own.

Plan — decide the next step toward the goal. Act — call a tool: run code, query an API, edit a file. Observe — read what came back, including errors. Judge — decide whether that worked and whether the goal is met. If not, loop. The number of times round this loop before it reports back to you is the amount of autonomy you have granted it.

Most failures happen at judge. Deciding whether a result is scientifically acceptable requires knowing what a right answer would look like, and it is the step agents are worst at. Given a clear pass/fail criterion — the tests pass, the file parses — agents iterate well. Given “does this look reasonable,” they will usually decide that it does.

Reading and writing

The loop tells you how an agent works. It does not tell you what it can do to you. For that, ask a second question: what is this thing allowed to change?

Some agents only read. They search, fetch pages, query databases, run an analysis on a copy. An assistant looping over web searches is doing real agentic work and cannot alter anything you own. That does not make it harmless: anything an agent reads, and any page it fetches, is a route by which your own data can leave. Others write. They edit your files, run shell commands, modify databases, send mail, commit to your repository.

That distinction cuts across products rather than along them, and it is what governs risk. Two agents can run the identical loop the identical number of times: the read-only one wastes your afternoon and may mislead you, the read-write one leaves your data in a state you did not choose.

So the loop is not the dangerous part. The loop combined with write access is. Before letting any agent near real work, know which of the two you have — and if it can write, know exactly what it is allowed to write to.

What they are good and bad at

Capability is uneven, and the unevenness does not follow difficulty as a person would judge it. An agent will refactor a thousand-line script and then be unable to tell you that the figure it produced is nonsense. The lists below come partly from Horstmann and colleagues, who scored coding agents stage by stage on a real neuroscience pipeline against the standards of the scientists who built it — that is the Week 2 reading — and partly from the evidence cited underneath.

Writing deserves its own paragraph, because it is what most people try first and what most people end up ambivalent about. The good part is real. Models fix grammar, tighten a tangled paragraph, and translate into idiomatic English — which matters enormously if English is not your first language, and is arguably the most equity-improving thing they do. The problem is not that the prose comes out wrong. It is that it comes out as nobody's.

The scale of this is now measurable. Kobak and colleagues tracked vocabulary across 15 million PubMed abstracts and found an abrupt post-2023 jump in a set of style words, enough to put a floor of 13.5% of 2024 abstracts having been through an LLM, and 40% in some subfields — a larger shift in scientific writing than the Covid pandemic produced. A parallel study of 37,000 ACL papers found LLM-edited text carries longer words, heavier syntax, and lower lexical diversity.

And here is the uncomfortable finding. In that same study, domain experts rated the LLM-improved passages as more understandable and more exciting — while saying, in the same breath, that they disliked LLM writing. Both things are true at once. It reads better and it sounds like everyone. In a field where your discussion section is an argument you are making rather than a report you are filing, that is a trade worth making deliberately instead of by default.

Two patterns from the Horstmann study are worth carrying into every session. First, doing each step right is not the same as doing the job right. Handed a single stage, the agents often nailed it. Handed the whole pipeline to run end to end, the same stages failed — because a small error early on is not caught, it is passed to the next step as if it were correct, and by the end the output is confidently wrong. Second, they do not catch it by looking. The authors classified every occasion on which an agent inspected a plot of its own output: on every task where that happened, the times it misread or explained away a real problem outnumbered the times it spotted one.

Why “it acts” changes everything

A chatbot that is wrong produces a wrong sentence, and you are the last line of defence before it becomes a wrong claim. That is a familiar risk and we already have habits for it.

An agent with write access that is wrong has already run the code, already rewritten the file, already sent the query. The error is not in a draft you are reviewing; it is in your data directory. Three consequences follow, and the seminar returns to them all term:

Errors become silent. A hallucinated citation is visible if you look. A dropped subset of rows during a merge is not, and neither is a reprojected coordinate system. The agent will report success either way, because from inside the loop it succeeded.

Provenance thins out. The agent made forty decisions to produce that file, and the file records none of them. Agent tools do keep a transcript of every action and its output, and reading that transcript is what this seminar means by an audit. But nothing attaches it to the result, and nobody reads it unless they decide to.

Speed removes the pause. The friction of doing analysis by hand is also when you notice things. Remove the work and you remove the noticing, unless you put it back deliberately.

Who makes these

Vocabulary

Everything below will come up. You do not need to memorise it; skim it now and come back.

Large language model (LLM)

A model trained on very large amounts of text to predict what comes next. Everything else here is built on top of one.

Token

The unit a model reads and writes — roughly a short word or word-fragment. Everything is counted, priced, and limited in tokens.

Context window

How much the model can hold in mind at once, in tokens. Anything outside it may as well not exist. Long agent sessions can fill it, which is when behaviour gets strange.

Prompt

What you send it. System prompt is the standing instruction set the tool's builders wrote, which you usually cannot see.

Open weights / open source

Open weights means the parameters are published, so you can download the model and run it yourself. It usually does not mean the training data or the training code are public, which is what "open source" implies elsewhere in software. The distinction matters when you need to know where your data goes, and when you need to reproduce a result.

Hallucination

Fluent, confident, false. Not a bug that will be patched — a direct consequence of a system that generates plausible continuations rather than retrieving facts.

Nondeterminism

The same prompt gives different answers on different runs. Two consequences. A second run that comes out clean does not tell you the first was a fluke, so re-running is not a check. And nobody else can reproduce your output exactly, including you next week — which is why an agent's result needs its transcript attached to mean anything.

Reasoning model / extended thinking

A model that generates a long internal working-out before answering. Better on hard problems, slower, more expensive. The visible "thinking" is not a reliable account of what actually determined the answer.

Tool / tool call / function calling

Something outside the model it can invoke — run a shell command, execute Python, fetch a URL, query a database. The bridge between generating text and doing things.

Agent

A model given tools and permission to loop: plan, act, observe, judge, repeat, until it decides it is done. The autonomy is what makes it an agent.

Workflow (as opposed to an agent)

A fixed sequence of steps you wrote, that calls a model at points. Far more predictable. Most tasks people build agents for are better served by a workflow, and knowing which one you need is a skill.

Autonomy / permission gating

How many actions it may take before checking with you, and which actions require your say-so. The single most important setting in any agent tool.

Read-only / read-write

Whether an agent's tools can change anything. Searching and fetching are read-only; editing files, running shell commands and sending mail are read-write. The best single predictor of how much damage one mistake can do.

Memory

What persists after the context window or the session ends — usually notes the agent writes to a file and reads back later.

MCP (Model Context Protocol)

A common standard for plugging tools and data sources into an agent, so the same connector works across different assistants.

Prompt injection

An agent cannot fully separate the text it reads from the instructions it follows. A web page, a README or a data file can carry wording aimed at the agent, and it may act on it. Demonstrated across real deployed systems by Greshake et al. (2023). This is why an agent that only reads still needs watching.

Subagent / multi-agent

An agent that spawns other agents to work in parallel and reports back. More throughput, and correspondingly more places for an error to hide.

Retrieval-augmented generation (RAG)

Fetch relevant real documents first, then have the model answer using them. Reduces fabrication because the answer is anchored to retrieved text — it does not eliminate it.

Fine-tuning

Further training of an existing model on your own specialised data. Expensive, and usually not the answer; a better prompt or retrieval normally is.

Human in the loop

A person deliberately placed at a checkpoint to review or approve before the process continues. Only meaningful if the person has enough information to actually judge.

Benchmark / eval

A standard task set used to score models. Treat published scores the way you would treat a p-value from an analysis you did not see: informative, and not the same as the thing you care about.

Out-of-distribution

Input unlike anything in training. Model performance falls off, often without any corresponding drop in confidence. Your specific study system is more likely to be here than you think.

← back to the course page