Don't Panic — AI Agents

The word now attaches to roughly anything with a text box in front of it, which makes it useless until you find the line underneath. The line is about who holds the steering wheel.

Write the order of operations in advance and leave the model a blank to fill in, and the result is ordinary software however clever the blank. Let the model choose what happens next, call something, read what came back and judge whether it has finished — that is what the word names. A chatbot is not one. A classifier is not one. One excellent answer to one prompt is not one.

Both sides of that line count as agentic systems, and neither is the better one. A workflow runs a model and its tools along paths written in advance; an agent picks its route while running. Where the steps are predictable, the written route is cheaper, more testable, and unexciting in the ways production software ought to be.

The building block is smaller than the vocabulary suggests. Take a model and hand it three capabilities it can reach for by itself: tools, meaning functions or APIs it calls to act on the world outside; retrieval, which fetches information it does not already hold; and memory, which carries state from one step to the next.

That augmented model is the atom, and everything larger is an arrangement of atoms. What gets configured is three things — the model that reasons, the tools that act, the instructions that set behaviour and limits. Then it loops: decide, act, read the result, decide again, until a final answer, a silence where a tool call would be, an error, or a preset limit on turns.

Two facts about that loop are structural, and neither yields to better prompting.

The first is arithmetic. A step that works ninety-five times in a hundred works thirty-six times in a hundred over twenty steps, and six times in a thousand over a hundred. That exponent, not model quality, decides what an agent can finish, because each added tool call multiplies in another number below one. Designs that survive production keep chains short and make every step verifiable alone, so a failure costs one step rather than the whole run.

The second is that the security problem is architectural. Private data, exposure to untrusted content, and some way of sending things outward: an agent holding all three can be told by whatever it reads to hand over whatever it holds. Instructions and injected text arrive in the same context window — the one block of text the model actually sees — with nothing marking which is which, so a filter lowers an attack's success rate without closing anything. Remove one of the three legs instead.

One last expectation to set. Evaluation is where these projects stall, not orchestration: a correct run legitimately varies in path, wording and tool order, so there is nothing fixed to compare against, and exact-match tests fail perfectly good runs.

Go to the Intro for the argument in full; the vocabulary lives on the Cheatsheet. Field Notes carries the numbers, including what a multi-agent design costs per run.

Don't Panic — AI Agents

Relevant careers