What is agentic AI?

Key facts

• Anthropic's engineering guide Building effective agents (December 2024) separates workflows, where language models and tools follow predefined code paths, from agents, where the model directs its own process and tool use. (Source: Anthropic: Building effective agents)
• Innovate UK's Agentic AI Pioneers Prize describes agentic AI as "systems that can take initiative, make decisions, and act autonomously toward a goal". (Source: Innovate UK Business Connect: The Agentic AI Pioneers Prize)
• The ReAct paper by Yao et al., first posted to arXiv in October 2022, showed language models interleaving reasoning steps with actions such as search queries, and using the results to revise their plans. (Source: Yao et al., ReAct (arXiv 2210.03629))
• When τ-bench was published in June 2024, even state-of-the-art function-calling agents such as gpt-4o succeeded on fewer than 50% of its tasks, and in its retail domain their chance of succeeding on all eight attempts at the same task was below 25%. (Source: Yao et al., τ-bench (arXiv 2406.12045))
• A 2025 study of multi-agent LLM systems by Cemri et al. identified 14 failure modes in 3 categories (system design, inter-agent misalignment and task verification) and applied them to more than 1,600 annotated traces from 7 frameworks. (Source: Cemri et al., Why Do Multi-Agent LLM Systems Fail? (arXiv 2503.13657))
• The OWASP Top 10 for LLM Applications (2025) lists Excessive Agency as LLM06 and traces it to three root causes: excessive functionality, excessive permissions and excessive autonomy. (Source: OWASP: LLM06:2025 Excessive Agency)
• Tellme AI, where Dr. Dulan Dias is co-founder and Chief Technology Officer, won the Innovate UK Agentic AI Pioneers Prize 2025 (Creative Industries). (Source: Dr. Dulan Dias: Journey)

Definitions

AI agent

A system in which a language model chooses the next action, calls a tool to take it, observes the result and repeats until it reaches a goal or a stopping condition. The model, not the developer's code, decides the sequence.

Agentic workflow

A multi-step system built from language model calls whose order is fixed in code, such as a chain of prompts or a router that sends each request down one of several paths. The model does the work at each step but does not choose the path.

Tool calling

Also called function calling: the model returns a structured request to run a named function with arguments, the application runs it, and the result goes back to the model as input for its next step.

Model Context Protocol (MCP)

An open-source standard for connecting AI applications to external systems. A tool or data source exposed once as an MCP server can be used by any client that supports the protocol.

What makes an AI system agentic?

A system is agentic when the model, rather than the developer, decides what happens next. Give it a goal and a set of tools and it runs a loop: choose an action, call a tool, read the result, choose again, and stop when the goal is met or a limit is reached.

The loop is not new. The ReAct paper, first posted in October 2022, had language models alternate between reasoning and actions such as searches, using what came back to revise the plan.

Autonomy is a spectrum, not a switch. A model that picks one of three tools once is barely agentic; one that writes code, runs the tests, reads the failures and edits again for an hour is very agentic. Most production systems sit near the low end, and that is usually good judgement. A fixed pipeline with a model in each stage is not an agent, whatever the marketing says.

Agent vs workflow vs chatbot

The difference is who controls the sequence of steps, and that one choice sets cost, predictability and how hard the system is to test. Anthropic's guide Building effective agents draws the same line, and notes that an agent's autonomy brings higher costs and the potential for compounding errors.

The parts of an agent

Every agent combines a model with tools, memory, a control loop and permissions, and most of the engineering effort goes into the parts that are not the model.

• The model: reads the goal, the steps so far and the tool results, and chooses the next action.
• Tools: the functions, APIs and searches the agent can call, each with a name, a description and an argument schema. A few clear, narrow tools beat a large catalogue of overlapping ones, and every description costs context on every call. The Model Context Protocol standardises how tools are exposed.
• Memory: the context window holds the goal, steps and results; a long-term store holds notes or past decisions for later. Both need pruning, because stale tool output makes later steps worse.
• Planning and control: the loop and its limits, meaning a maximum number of steps, a time and spend budget, a definition of done and a rule for when the agent is stuck.
• Guardrails and permissions: what the agent may touch, enforced in code outside the model. Teams skip this in a demo and regret it in production.

Where agents work in production today

Agents earn their cost on tasks with three traits: the steps cannot be listed in advance, the outcome can be checked, and a wrong action is cheap to undo or is reviewed before it lands. Coding is the clearest case, because a test suite tells both the agent and the reviewer whether the work is done.

Other good fits share that shape: analysis over read-only data, where a person reads the answer; investigation across logs and records, where the agent proposes and a person approves; and drafting, where the output is a document someone edits.

From practice: Tellme AI, where Dr. Dulan Dias is co-founder and CTO, won the Innovate UK Agentic AI Pioneers Prize 2025 (Creative Industries). Dulan's write-up of giving an AI agent the run of a production platform over MCP begins where safe agent design should begin, by removing every delete operation from the tools the agent can see.

Poor fits are the mirror image: tasks a workflow already handles, unreviewed actions that move money or change records, and results nobody can check.

Why agents fail

Agents fail in ways single model calls do not, because errors compound across steps and the agent acts on its own mistakes. The failure modes are well documented.

• Compounding errors. If each step succeeds 95% of the time independently, a ten-step task succeeds only about 60% of the time (0.95 to the power of 10). That is illustrative arithmetic, not a measurement, but it explains why long autonomous runs disappoint.
• Inconsistency. In τ-bench, the strongest function-calling agents tested in 2024 succeeded on fewer than half of the tasks, and far less often on all eight repeats of the same task. One success in a demo says little about the hundredth run.
• Coordination failures. A 2025 study of multi-agent systems found 14 failure modes across seven frameworks, from system design to misalignment between agents and weak verification.
• Prompt injection through tools. An agent that reads web pages, emails or files can be steered by instructions hidden in them; OWASP notes that indirect prompt injection is not fully prevented by retrieval or fine-tuning.
• Excessive agency. OWASP's LLM06:2025 traces damaging actions to too many tools, too broad permissions and too much autonomy.
• Runaway cost. A loop that never meets its stopping condition keeps calling the model, and without a spend cap the invoice is the first alert.

How to start with agents safely

Build the smallest amount of autonomy that does the job, and widen it only as evidence builds. In order:

1. Write the workflow first. If you can list the steps, code them and use the model inside each one. Promote a step to an agent only when the fixed path keeps failing on real cases.
2. Start read-only, then add write tools one at a time.
3. Enforce permissions in code, not in the prompt: least-privilege credentials for each tool, and systems that check authorisation themselves rather than trust the model.
4. Require a person to approve anything irreversible: payments, deletions, messages sent on someone's behalf, changes to production.
5. Set a step limit, a time limit and a spend cap per task, with a defined fallback. Each model call still needs the timeouts and failover in LLM APIs in production.
6. Treat every tool result as untrusted input that can never change the agent's instructions, and validate arguments before a tool runs.
7. Log every step as a trace: the model's choice, the tool, its arguments and the result.
8. Evaluate on repeated runs, judging the end state rather than the transcript; how to evaluate an LLM application covers the method.

Do you need more than one agent?

Usually not at first. A single agent with well-designed tools is easier to build, test and debug than several agents passing work between them, and every hand-off is another place to lose context.

Split the work when one context cannot hold the tools a task needs, or when sub-tasks are independent and can run in parallel. Dulan's summary of why multi-agent systems keep failing walks through the research on where those hand-offs go wrong.

Frequently asked questions

Sources

1. Anthropic: Building effective agents (December 2024)
2. Yao et al., ReAct: Synergizing Reasoning and Acting in Language Models (arXiv 2210.03629)
3. Yao et al., τ-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domains (arXiv 2406.12045)
4. Cemri et al., Why Do Multi-Agent LLM Systems Fail? (arXiv 2503.13657)
5. OWASP Top 10 for LLM Applications: LLM06:2025 Excessive Agency
6. OWASP Top 10 for LLM Applications: LLM01:2025 Prompt Injection
7. Model Context Protocol: What is MCP?
8. Innovate UK Business Connect: The Agentic AI Pioneers Prize