what is an ai agent?

an ai agent is a language model that can call tools and decide what to do next, running in a loop until it reaches a goal or gives up.

three parts, and all three are required. the model does the reasoning. the tools let it act on something outside the conversation. the loop lets it look at what happened and choose again. take away the loop and you have a chatbot with buttons.

that definition sounds narrow and it is doing a lot of work, because most things marketed as agentic ai in 2026 are missing at least one of the three. autonomous agents in the full sense, running for hours without supervision, remain rarer than the word suggests.

ai agent vs chatbot

the test is whether anything outside the conversation is different afterwards.

a chatbot produces text. you read it, and you do something. an agent does the something, then looks at the result and adjusts. that is a category change rather than an improvement, and it is why the security and reliability questions are different in kind.

the middle row is the interesting one. an agent can tell that a test failed, a page did not load, or a file was not where it expected, and try something else. that feedback loop is most of what makes agents useful and all of what makes them risky.

the loop, concretely

retrieve, decide, act, observe, repeat. that is the whole architecture.

1. retrieve. gather context: files, search results, database rows, a page.
2. decide. the model picks a tool and arguments.
3. act. the tool runs. something happens outside the model.
4. observe. the result comes back into the context window.
5. repeat or stop. goal met, budget spent, or stuck.

everything else in the agent literature is an elaboration on this. planning is deciding several steps at once. multi agent systems are loops that call other loops. memory is carrying state between runs.

the underexamined step is 1, because an agent can only reason over what it can reach. that is the subject of how to give an ai agent context and, more broadly, of context engineering.

tool calling, which is the part that ships

tool calling is the mechanism, and a standard for it arrived in 2024.

the model does not run code. it emits a structured request saying which tool it wants and with what arguments, your system runs it, and the result goes back into the context. that indirection is the whole safety boundary, and it is where your controls live.

anthropic published the model context protocol in late 2024 to standardise this, and by 2026 it had become the default integration layer across labs and editors. one server, any host that speaks the protocol. before it, every tool integration was bespoke.

why do agents fail?

reliability compounds badly, and this is the thing demos hide.

an agent step that works 95% of the time is excellent. run ten of them in sequence and the chain succeeds about 60% of the time. run twenty and it is roughly 36%.

that arithmetic, not model quality, is why most production agents in 2026 run a few steps and then check in with a human. it is also why the vendors shipped memory this year rather than longer autonomy: openai on june 4, 2026, anthropic on july 10, 2026, google in january 2026 and apple on june 8, 2026.

the failures cluster into four shapes, and they need different fixes:

• wrong context. the fact it needed was never retrievable. no model fixes this.
• wrong tool. it had 40 tools and picked the wrong one. fewer tools, better descriptions.
• wrong loop. it retried the same failing action, or stopped early. budgets and stop conditions.
• hijacked. something it read told it to do something else.

that last one deserves its own section.

the security problem that defines the category

an agent cannot tell your instructions from instructions hidden in what it reads.

this is indirect prompt injection, and it is unsolved rather than merely difficult. there is no structural boundary between instructions and data inside a single text stream, so a webpage, document, code comment or calendar invite can carry text addressed to the model.

the cloud security alliance's 2026 research note reports that across roughly 2 to 3 billion crawled pages a month, the share carrying malicious injection grew 32% in relative terms between november 2025 and february 2026. benchmark work has measured strong models in tool calling loops vulnerable in the 24 to 47% range. a university of washington study published july 3, 2026 found 4 of 7 agentic browsers allowed attackers to bypass the same origin policy.

the mitigations are architectural: least privilege on tools, read only where possible, human confirmation before consequential actions, and separating the component that reads untrusted content from the one holding credentials. the full version is in what is prompt injection.

what are some real ai agent examples?

the useful ai agent examples are all narrow, and the same pattern is visible across them.

coding agents. claude code and codex read a repo, edit files, run tests and iterate. the tightest feedback loop available, which is why coding was the first category to work.

computer use agents. claude got mouse and keyboard control of the mac on march 23, 2026 and codex in april, covered in computer use agents on a mac.

agentic browsers. perplexity's comet, gemini in chrome, claude for chrome. they read pages and act. openai's atlas launched in october 2025 and was retired on august 9, 2026, which we covered in ai browsers and what they do with your history.

research agents. search, read, compile. the failure mode is confident synthesis of sources that did not say that.

support agents. read a ticket, look up an account, take an action. the clearest commercial case and the one with the strictest permission requirements.

why agents keep asking you to repeat yourself

they have your repo and the public internet, and nothing in between.

per the anthropic economic index for may 2026, the number one work task in sampled ai conversations is searching electronic sources for information at 4.95%, with reference searching second at 3.74%. retrieval dominates. but look at what stays small.

searching your own knowledge is 3.61%. anything about a meeting is 0.26%. an agent can read your code and cannot read the call where the decision was made, so it asks, and you explain it again.

remynd closes that specific gap on a mac. it captures the focused window, runs ocr locally so what you looked at becomes searchable text, and since august 2026 exposes that archive to claude code and codex over a local connector. capture, ocr, call transcription and storage stay on your mac by default, and you can exclude apps or sites entirely. asking a question does send retrieved slices to a cloud model, and your history is read only everywhere in the app, which we set out in private ai on your mac.

the honest summary

an agent is a loop with hands, and both halves are the point.

the loop is why it can recover from a failure, and the hands are why a failure matters. treat the capability list as a risk list, keep the tool count small, and put a human in front of anything that spends money or sends a message. then give it something real to reason over, because most agent failures are missing context wearing a costume.

download remynd for mac and stop explaining last month to your agent.