What are AI agents? A 2026 guide for founders and teams

In DepthIshaan VardhanOct 11, 202611 min read

An AI agent is software that uses a large language model to decide its own next steps and call tools, such as a code runner, a browser or a company API, until a goal is met. That separates it from a chatbot, which only answers. For founders and teams in 2026, the practical questions are where agents earn their cost, which frameworks to build on, and how to keep them safe.

Key takeaways

• Anthropic, OpenAI, Google and IBM all describe agents in similar terms: a model that plans, picks tools and acts with some independence, not just a chat window.
• Agents are already running in production: coding agents from Anthropic, OpenAI and GitHub, Salesforce’s Agentforce for customer service, and Klarna’s support assistant.
• The main building blocks are open: SDKs from OpenAI, Anthropic, Google and Microsoft, frameworks such as LangGraph and CrewAI, and two shared protocols, MCP and A2A.
• The risks are real. Gartner expects over 40% of agentic AI projects to be cancelled by the end of 2027, and prompt injection tops OWASP’s list of LLM risks.
• Start with one narrow, measurable workflow, give the agent few permissions, and keep a human in charge of anything irreversible.

What an AI agent actually is

There is no single official definition, but the major labs and vendors now describe agents in very similar terms.

In its widely read December 2024 essay “Building effective agents”, Anthropic splits “agentic systems” into two kinds. Workflows are systems where models and tools follow code paths a developer has fixed in advance. Agents are systems where the model directs its own process and decides which tools to use and when. Much of what gets marketed as an “agent” is really a workflow, which is often the better choice.

OpenAI’s April 2025 guide, “A practical guide to building agents”, describes agents as systems that complete tasks on a user’s behalf with a high degree of independence, according to OpenAI. Apps that use a model without letting it control the workflow, such as simple chatbots or sentiment classifiers, do not count. In OpenAI’s framing an agent has three parts: a model that reasons and decides, tools that let it read from and act on outside systems, and instructions that set its behaviour and guardrails.

Google Cloud defines agents as software systems that use AI to pursue goals and complete tasks for users, showing reasoning, planning and memory along with some autonomy to make decisions. IBM describes an agent as a system that performs tasks autonomously by designing its own workflow with the tools available to it.

A useful working test: if the software chooses its own next action, calls outside tools and keeps going until the goal is met or it hands back to a person, it is an agent. If every step is scripted, it is automation with a model inside.

How an agent works, step by step

Most agents run a loop.

1. Take a goal. A user, a schedule or an event (a new support ticket, a failed build) gives the agent a task.
2. Plan. The model breaks the task into steps. IBM calls this goal initialisation and planning.
3. Act through tools. The model calls a tool: a search, a database query, a code runner, a browser or a company API.
4. Observe and adjust. It reads the result and decides what to do next, retrying or changing course if something fails.
5. Stop or hand off. It finishes, or it returns control to a human. OpenAI’s guide says agents should be able to halt and give control back to the user when they fail.

Agents trade latency and cost for better results on hard tasks, and their autonomy brings higher costs and a risk of compounding errors, according to Anthropic. That is why the same essay advises starting with the simplest thing that works, often a single well-prompted model call, and adding agentic behaviour only for open-ended tasks whose steps cannot be predicted.

Real AI agents already in production

Coding agents

Software engineering was the first area where agents became everyday tools. Anthropic introduced Claude Code as a limited research preview on 24 February 2025, describing a command-line tool that can search and read code, edit files, write and run tests, and commit and push to GitHub, according to Anthropic.

OpenAI launched Codex on 16 May 2025 as a coding agent inside ChatGPT that works in an isolated cloud sandbox preloaded with the user’s repository. At launch it had no internet access while running a task, according to TechCrunch.

GitHub announced the Copilot coding agent on 19 May 2025. Developers assign a GitHub issue to Copilot, which works in a GitHub Actions environment and opens a draft pull request for review, according to GitHub. Its guardrails make a good template: the agent can push only to branches it created, the developer who asked for the change cannot approve it, CI/CD workflows need human approval before they run, and internet access is limited to trusted destinations.

General-purpose agents

On 17 July 2025 OpenAI launched ChatGPT agent, which combines the website-browsing abilities of its earlier Operator tool with the research abilities of deep research. It can work through a user’s calendar, build editable slide decks and run code, according to TechCrunch. OpenAI disabled some memory features at launch to reduce prompt injection risk, the report said.

Customer service agents

Salesforce made Agentforce generally available on 29 October 2024, pricing its Service Agent from $2 per conversation, according to Salesforce. In the same release, publisher Wiley reported a more than 40% increase in case resolution compared with its previous chatbot.

Klarna’s assistant is the most cited case. In February 2024 Klarna said its AI assistant had handled 2.3 million conversations in its first month, two-thirds of its customer service chats, doing work equal to 700 full-time agents and cutting average resolution time from 11 minutes to under two, according to Klarna. By May 2025, chief executive Sebastian Siemiatkowski told Bloomberg that the company was hiring human agents again because a focus on cost had led to lower quality, as reported by Fortune. The lesson: customers still want a guaranteed route to a person.

Frameworks and SDKs for building agents

You do not have to write the agent loop yourself. The main options, as each project describes itself:

Scroll the table sideways →

Sources: OpenAI Agents SDK docs, Claude Agent SDK docs, Google ADK docs, Microsoft, LangChain and CrewAI.

If you depend on one model provider, its SDK is usually the shortest path; if you need to swap models or run branching with approvals, a model-neutral orchestrator gives more control. Either way, insist on tracing, because debugging an agent without a record of its decisions is close to impossible.

MCP and A2A: the plumbing between agents and tools

The Model Context Protocol (MCP), launched by Anthropic on 25 November 2024, is an open standard for connecting AI applications to data sources and tools through one interface instead of a custom connector for each system, according to Anthropic. On 9 December 2025 the Linux Foundation formed the Agentic AI Foundation, with MCP, Block’s goose and OpenAI’s AGENTS.md as founding projects, according to the Linux Foundation. It said there were more than 10,000 published MCP servers and that MCP had been adopted in Claude, Cursor, Microsoft Copilot, Gemini, VS Code and ChatGPT.

The Agent2Agent protocol (A2A), announced by Google on 9 April 2025 with more than 50 technology partners, gives agents built on different frameworks a standard way to communicate and coordinate, according to Google. Google positions it as complementary to MCP: MCP connects an agent to tools and context, while A2A connects agents to each other.

For a startup, exposing your product’s key actions through an MCP server makes it usable by customers’ agents without bespoke integrations.

Risks: security, cost and reliability

Prompt injection and over-broad permissions

Prompt injection is ranked first in OWASP’s Top 10 for LLM applications. OWASP separates direct injection, where a user’s input changes the model’s behaviour, from indirect injection, where instructions hidden in a web page, file or email take over the model when it reads them. Agents are especially exposed because they act on what they read. OWASP’s recommended mitigations include giving the model the minimum access it needs, requiring human approval for privileged actions, and clearly separating untrusted content from instructions. Its Agentic Security Initiative published a separate guide in February 2025 covering agent-specific threats such as memory poisoning, tool misuse and privilege compromise, according to OWASP.

Cost and unclear value

Gartner predicted in June 2025 that more than 40% of agentic AI projects will be cancelled by the end of 2027 because of rising costs, unclear business value or weak risk controls, according to Reuters. Gartner also warned of “agent washing”, the rebranding of chatbots and assistants as agents, and estimated that only about 130 of the thousands of vendors claiming agentic AI were genuine. It still expects agentic AI to make at least 15% of day-to-day work decisions autonomously by 2028, up from 0% in 2024.

Separately, an IBM survey of chief executives found that only one in four AI projects had delivered the expected return on investment, as reported by Fortune.

Reliability

Errors compound across a long run. Anthropic recommends extensive testing in sandboxed environments with guardrails. OpenAI’s guide names two triggers for handing control to a person: when the agent exceeds a set number of failures or retries, and before high-risk actions that are sensitive, irreversible or high stakes.

How to start with AI agents

1. Pick a workflow that has resisted automation. OpenAI’s guide points to three signs: complex judgement calls, rule sets that have become hard to maintain, and heavy use of unstructured text. If simple rules work, use rules.
2. Try a workflow before an agent. Many tasks only need a fixed chain of model calls.
3. Start with one agent and a few tools. OpenAI recommends growing a single agent by adding tools before splitting work across several agents, because it keeps evaluation and maintenance simpler.
4. Set permissions first. Read-only by default, scoped keys, approval for production writes, and a log of every tool call.
5. Measure against a baseline. Track task success, cost per completed task and how often a human steps in, compared with the old process.

If you want to work on these systems rather than buy them, our AI and machine learning jobs board lists openings from official career pages, including roles at Anthropic and OpenAI.

Why it matters

Agents shift software from presenting information to taking action, which lets small teams cover more ground. But the evidence so far rewards restraint: narrow tasks, tight permissions, honest measurement and a human for the hard cases. Teams that treat agents as a product to test, not a label for a chatbot, are likelier to avoid Gartner’s 40%. Follow our AI news coverage for new launches as they happen.

FAQ

What is the difference between an AI agent and a chatbot?

A chatbot answers messages. An agent decides its own next steps and uses tools such as search, code execution or business APIs to complete a task.

What is the difference between an agent and a workflow?

In Anthropic’s definition, a workflow follows code paths fixed in advance, while an agent lets the model decide the process and which tools to use.

Which framework should a startup use to build AI agents?

If you are committed to one model provider, start with its SDK, such as the OpenAI Agents SDK or the Claude Agent SDK. For model-neutral orchestration with human approvals, consider LangGraph, Google’s ADK or Microsoft Agent Framework.

What is MCP in AI agents?

The Model Context Protocol is an open standard, launched by Anthropic in November 2024 and now part of the Linux Foundation’s Agentic AI Foundation, for connecting AI applications to tools and data through one common interface.

Are AI agents safe to use with company data?

They can be, with controls. Because of prompt injection, OWASP recommends least-privilege access and human approval for privileged actions.

Sources

1. Anthropic, “Building effective agents“, 19 December 2024
2. OpenAI, “A practical guide to building agents“, April 2025
3. Google Cloud, “What is an AI agent?“, updated 2 April 2026
4. IBM, “What are AI agents?“, accessed 4 October 2026
5. Anthropic, “Claude 3.7 Sonnet and Claude Code“, 24 February 2025
6. TechCrunch, “OpenAI launches Codex, an AI coding agent, in ChatGPT“, 16 May 2025
7. GitHub, “GitHub Copilot: Meet the new coding agent“, 19 May 2025
8. TechCrunch, “OpenAI launches a general purpose agent in ChatGPT“, 17 July 2025
9. Salesforce, “Salesforce’s Agentforce is here“, 29 October 2024
10. Klarna, “Klarna AI assistant handles two-thirds of customer service chats in its first month“, 27 February 2024
11. Fortune, “Klarna plans to hire humans again, as new landmark survey reveals most AI projects fail to deliver“, 9 May 2025
12. OpenAI, “OpenAI Agents SDK documentation“, accessed 4 October 2026
13. Anthropic, “Agent SDK overview“, accessed 4 October 2026
14. Google, “Agent Development Kit documentation“, accessed 4 October 2026
15. Microsoft, “Introducing Microsoft Agent Framework“, 1 October 2025
16. LangChain, “LangGraph“, accessed 4 October 2026
17. CrewAI, “Introduction“, accessed 4 October 2026
18. Anthropic, “Introducing the Model Context Protocol“, 25 November 2024
19. Linux Foundation, “Linux Foundation announces the formation of the Agentic AI Foundation“, 9 December 2025
20. Google for Developers, “Announcing the Agent2Agent Protocol (A2A)“, 9 April 2025
21. OWASP, “LLM01:2025 Prompt Injection“, updated 17 April 2025
22. OWASP, “Agentic AI – Threats and Mitigations“, 17 February 2025
23. Reuters (via Yahoo), “Over 40% of agentic AI projects will be scrapped by 2027, Gartner says“, 25 June 2025

Featured image: Coding was the first field where AI agents became everyday tools. · Photo: Marc Mueller (seven11nash) / Wikimedia Commons, CC0 1.0

Related stories

In DepthBest Education Marketing Agency in India: Our #1 Pick and 6 SpecialistsIshaan VardhanOct 12, 202611 min read

In DepthBest free AI tools in 2026: 14 free tiers that are worth usingIshaan VardhanOct 11, 202612 min read

In DepthBest AI video generators in 2026: Veo, Runway, Kling, Pika, HeyGenIshaan VardhanOct 10, 202611 min read

Sources

1. Anthropic 19 Dec 2024Definitions of workflows vs agents; cost/latency trade-off; compounding errors; start simple; sandbox testing
2. OpenAI 7 Apr 2025Agent definition; chatbots not agents; model/tools/instructions; when to build agents; single-agent first; human intervention triggers (PDF dated April 2025)
3. Google Cloud 2 Apr 2026Google's definition of AI agents (reasoning, planning, memory, autonomy)
4. IBM 4 Oct 2026IBM's definition; goal initialisation and planning (undated page, accessed)
5. Anthropic 24 Feb 2025Claude Code launched as limited research preview and its capabilities
6. TechCrunch 16 May 2025Codex launch, cloud sandbox, no internet access during tasks
7. GitHub 19 May 2025Copilot coding agent launch, how it works and its guardrails
8. TechCrunch 17 Jul 2025ChatGPT agent launch, Operator + deep research, capabilities, memory disabled for prompt injection
9. Salesforce 29 Oct 2024Agentforce GA, $2 per conversation, Wiley 40%+ case resolution increase
10. Klarna 27 Feb 20242.3M conversations, two-thirds of chats, 700 FTE equivalent, 11 to under 2 minutes
11. Fortune 9 May 2025Klarna CEO told Bloomberg it is hiring humans again; IBM CEO survey one in four AI projects delivered expected ROI
12. OpenAI 4 Oct 2026Agents SDK primitives, tracing, upgrade of Swarm (docs, accessed)
13. Anthropic 4 Oct 2026Claude Agent SDK capabilities, Python and TypeScript (docs, accessed)
14. Google 4 Oct 2026ADK open source, languages, model-agnostic, deployment options (docs, accessed)
15. Microsoft 1 Oct 2025Microsoft Agent Framework, unifies Semantic Kernel and AutoGen, MCP and A2A support
16. LangChain 4 Oct 2026LangGraph MIT-licensed orchestration, human-in-the-loop, memory (accessed)
17. CrewAI 4 Oct 2026CrewAI crews and flows, open source (docs, accessed)
18. Anthropic 25 Nov 2024MCP launch and description
19. Linux Foundation 9 Dec 2025Agentic AI Foundation formed; MCP, goose, AGENTS.md; 10,000+ MCP servers; adopters
20. Google for Developers 9 Apr 2025A2A announced with 50+ partners; complements MCP
21. OWASP 17 Apr 2025Prompt injection is LLM01; direct vs indirect; mitigations
22. OWASP 17 Feb 2025Agentic threats guide: memory poisoning, tool misuse, privilege compromise
23. Reuters (via Yahoo) 25 Jun 2025Gartner: 40%+ agentic projects cancelled by end 2027; ~130 genuine vendors; 15% of decisions by 2028