What Are AI Agents? The Loop, the Limits, and the Hype

An AI agent is a system where a model plans and takes actions through tools in a loop, rather than producing a single response. The loop is the distinguishing feature: a chatbot answers, an agent works.

The basic loop

Almost all agents implement some version of ReAct — Reason plus Act:

1. Reason — what do I need to do next?
2. Act — call a tool.
3. Observe — read the result.
4. Repeat until the goal is met or a limit is hit.

Concretely, asked "what's the weather in Tokyo and should I pack a coat":

• *Thought:* I need current Tokyo weather. → *Action:* search("Tokyo weather") → *Observation:* 8°C, rain.
• *Thought:* 8°C and raining warrants a coat. → *Answer.*

The model never executes anything itself. It emits a structured request; your code validates and runs it, then returns the result. That separation is where your security boundary lives.

Why agents are genuinely useful

The loop enables work a single prompt cannot do: research requiring several sources, tasks where you cannot predict the steps in advance, and anything needing current data or exact computation.

It also lets the model recover. If a search returns nothing useful, it can try a different query — something a single-shot prompt cannot do.

Why agents fail

Agents introduce failure modes that single prompts do not have, and being clear-eyed about these is the difference between a demo and a product.

Compounding errors. A wrong step early corrupts everything after it. A 90%-reliable step is 59% reliable across five steps.

Runaway loops. Without a hard step limit, an agent can loop indefinitely. This is the classic cause of unexpected API bills.

Wrong tool selection. Models choose tools from their descriptions. Vague descriptions cause wrong choices, and the agent proceeds confidently down the wrong path.

Context exhaustion. Every step adds to context. Long-running agents fill their window with accumulated observations and start losing the original goal.

Confident failure. An agent that cannot complete a task often reports success anyway, because "I finished" is a more probable completion than "I failed."

What actually works

Narrow scope. The reliable agents in production today do one thing. "Research this topic and produce a sourced summary" works. "Manage my business" does not.

Hard limits. Maximum steps, maximum spend, maximum time. Non-negotiable.

Explicit stopping conditions. Tell the agent exactly what done looks like. "Stop once you have three sources that agree" beats "research thoroughly."

Few, well-described tools. Three tools with precise descriptions outperform fifteen with vague ones. Tool descriptions are prompts — write them with the same care.

Memory compression. Summarise prior steps into a running summary every few steps rather than replaying the full history. Keeps context small and the agent on-task.

Human gates on consequential actions. Anything irreversible — sending external email, moving money, deleting data — should require approval. The efficient version is confidence-based routing: automate the clear cases, escalate the ambiguous ones.

The security problem nobody has solved

Agents with tool access and the ability to read untrusted content are vulnerable to prompt injection, and this is not a solved problem.

If your agent reads a web page, and that page contains instructions, the model may follow them. It cannot reliably distinguish your instructions from text it encountered, because both arrive as tokens.

The dangerous variant is indirect: an attacker plants instructions in a document your agent will later read. They never interact with your system directly.

There is no complete fix. Defence in depth is the practical answer — treat all retrieved content as untrusted, enforce permissions in code rather than in prompts, require approval for consequential actions, and give agents the minimum capability they need.

Ask this question of any autonomous system: what is the worst action it can take unsupervised, and is that acceptable?

Where to start

You do not need a framework. A loop, a model call with tool definitions, and a switch statement dispatching tool calls is a working agent in a hundred lines. Building it once teaches more than any tutorial.

For visual workflows, n8n's AI Agent node implements ReAct with a built-in tool ecosystem — a fast path to something useful without writing the loop yourself.

Our Loop & Agentic Engineering course covers the patterns, and AI Automation with n8n covers the practical build.