cloudparts

AI agents

A language model in a loop with tools: it picks a function to call, your code runs it, the result goes back to the model, and the loop repeats until the task is done or a limit stops it.

2 technologies on this page ↓

How it works

An agent is three things: a model, a set of tools and a prompt. Your application sends the model the conversation plus a list of tools, each with a name, a plain-language description and a JSON Schema for its arguments. The model can’t run anything itself. When it decides a tool would help, it replies with a structured tool call instead of text, such as get_order with {"order_id": "A-1001"}; Claude’s API marks such a reply with stop_reason: "tool_use". Your code, often called the harness, runs the function, appends the result to the conversation and calls the model again. The loop ends when the model answers in plain text, or when a stopping condition such as a maximum number of steps cuts it off. Planning happens inside the loop: the model may write a plan before acting, or a lead agent may split the work among subagents, each with its own context window, and merge what they find. The model is stateless, so everything it knows about the task has to be in its context window, which is limited and degrades as it fills. Long-running agents therefore keep state outside it: a checkpoint of the conversation so a crash resumes instead of restarting, notes or a memory store the agent reads back later, and compaction, which summarizes old turns into a fresh context. Because tool calls have real effects, the harness decides which calls run on their own and which wait for a person to approve them; the Model Context Protocol spec says there should always be a human able to deny a tool call. Coding agents are one application of this loop, with files, a shell and tests as the tools.

Think of it as

A dispatcher at a desk with a phone and a binder of forms. They never leave the desk: every action is a form they fill in (the tool call), which a clerk carries out and brings back with the result stamped on it. The dispatcher reads the result and fills in the next form until the job is done. The clerk refuses forms the house rules forbid and checks with the manager before anything that can’t be undone, like a refund. The desk only holds so much paper, so on long jobs the dispatcher keeps a notebook in the drawer and starts a clean stack now and then.

Reach for it when

  • Open-ended tasks where you can’t predict the number of steps or hardcode the path, such as researching a question across many sources
  • Each step can be checked against something real: a tool result, a test run, a query that returns rows
  • The task is worth the tokens: Anthropic measured agents using about 4 times the tokens of a chat, and multi-agent systems about 15 times
  • The work splits into independent parts that subagents can explore in parallel

Think twice when

  • A fixed sequence of steps does the job: a workflow with predefined code paths is cheaper, faster and easier to test, and often one model call with retrieval is enough
  • The agent would combine private data, untrusted content and a way to send data out (the “lethal trifecta”): a prompt injection can then leak the data, and no filter reliably stops it
  • Actions are irreversible and no person can approve them: small mistakes compound over many steps
  • You need the same output for the same input every time; models are non-deterministic

A real example

In June 2025 Anthropic described the multi-agent system behind Claude’s Research feature. A lead agent reads the question, plans, and saves the plan to memory, because past 200,000 tokens its context is truncated. It then starts 3 to 5 subagents in parallel, each with a clear task, its own context window and search tools; they search, judge what they find and report back, and the lead decides whether more research is needed. A separate citation agent ties each claim to a source. With Claude Opus 4 as lead and Claude Sonnet 4 subagents, the system beat a single Opus 4 agent by 90.2% on Anthropic’s internal research eval, for example finding the board members of every information technology company in the S&P 500 where the single agent’s slow, sequential searches failed. Running subagents and tool calls in parallel cut research time by up to 90% for complex queries. The cost was tokens, about 15 times a chat. Early versions also spawned 50 subagents for simple questions, so the prompts now carry scaling rules: 1 agent with 3 to 10 tool calls for a fact, more than 10 subagents only for complex research. Because errors compound, the team built agents that resume from where they failed and deploys new versions gradually so running agents aren’t broken.

More on ai agents

Narrower ideas that build on this one.

Technologies

Specific products, and what each does differently.

Also used for ai agents

Products of other kinds that are often used this way, grouped by what they are.

What each provider calls it

AWS
Amazon Bedrock AgentCore: Runtime hosts agents built with any framework in isolated sessions, Harness is a managed agent loop, plus Memory, Gateway, Identity, Policy and Observability
Google Cloud
Gemini Enterprise Agent Platform, the evolution of Vertex AI: Agent Runtime to deploy and scale agents, Sessions and Memory Bank for state, Agent Development Kit (ADK) to build them
Azure
Microsoft Foundry Agent Service: prompt agents that Foundry runs for you, or hosted agents, your own code and framework in a container with a managed endpoint
Open source & others
Frameworks: LangGraph and LangChain, Strands Agents, OpenAI Agents SDK, Google ADK, Microsoft Agent Framework, Claude Agent SDK; tools through the Model Context Protocol

Workflows or agents#

Anthropic draws the line this way: in a workflow, models and tools are orchestrated through predefined code paths, such as “summarize, then translate, then check the length”. In an agent, the model directs its own process and decides which tool to use next. Both are useful. Workflows are predictable and cheap to test; agents handle problems where you can’t know the steps in advance, at the price of latency, tokens and less predictable behavior. Microsoft’s Agent Framework docs put it bluntly: if you can write a function to handle the task, do that instead of using an agent.

Most production systems mix the two. A support bot may follow a fixed workflow to identify the customer and only hand the open-ended part to an agent; graph-based frameworks such as LangGraph exist to combine deterministic steps with model-driven ones in one program.

Where agents fail#

Prompt injection is the hardest problem. A model follows instructions it finds anywhere in its context, including in a web page, an email or a tool result, because everything ends up as one sequence of tokens. Simon Willison named the attack in September 2022, after Riley Goodside showed GPT-3 obeying instructions hidden in the text it was asked to translate. In mid-2025 researchers at Invariant Labs showed it against GitHub’s official MCP server: a malicious issue in a public repository steered an agent into copying data from the user’s private repositories into a public pull request. Willison’s rule of thumb is to never combine private data, untrusted content and a way to communicate externally in one agent, because guardrail products that catch “95% of attacks” are a failing grade in security.

Agents also fail in plainer ways. A loop has no natural end, so set a step limit and a token or cost budget. Errors compound: one wrong tool result early on can send every later step in the wrong direction, so agents need checkpoints to resume from and evaluations that check the end state rather than every step. And quality drops as the context fills, which Anthropic calls context rot: as the number of tokens grows, the model’s ability to recall what is in its context declines. Compaction, notes outside the context and subagents with clean contexts are the usual answers.

In code · python

import json

import anthropic

client = anthropic.Anthropic()
order_arg = {"type": "object", "properties": {"order_id": {"type": "string"}}, "required": ["order_id"]}
tools = [
    {"name": "get_order", "description": "Look up an order: status, items, total.", "input_schema": order_arg},
    {"name": "refund_order", "description": "Refund an order in full. Cannot be undone.", "input_schema": order_arg},
]


def get_order(order_id):
    return {"id": order_id, "status": "delivered", "total": 42.0}


def refund_order(order_id):
    return {"id": order_id, "refunded": True}


HANDLERS = {"get_order": get_order, "refund_order": refund_order}
NEEDS_APPROVAL = {"refund_order"}  # a person signs off on anything irreversible

messages = [{"role": "user", "content": "Order A-1001 arrived broken. Please refund it."}]
for step in range(10):  # stopping condition: never loop forever
    response = client.messages.create(
        model="claude-opus-5-5", max_tokens=1024, tools=tools, messages=messages
    )
    messages.append({"role": "assistant", "content": response.content})
    if response.stop_reason != "tool_use":  # plain text: the agent is done
        print("".join(b.text for b in response.content if b.type == "text"))
        break
    results = []
    for call in (b for b in response.content if b.type == "tool_use"):
        if call.name in NEEDS_APPROVAL and input(f"Allow {call.name}({call.input})? [y/N] ") != "y":
            output, failed = "A person denied this action.", True
        else:
            output, failed = json.dumps(HANDLERS[call.name](**call.input)), False
        results.append({"type": "tool_result", "tool_use_id": call.id, "content": output, "is_error": failed})
    messages.append({"role": "user", "content": results})  # the model sees every result
else:
    print("Stopped after 10 steps without an answer")

Often confused with

AI coding agentsAgent frameworksAgent tools and integrationsRetrieval-augmented generation (RAG)Workflow orchestrationLarge language models
Where it came from2022–2025

Language models first learned to act through prompting. The ReAct paper (October 2022) had a model interleave reasoning traces with actions, such as queries to a simple Wikipedia API, and read back the results, which reduced the made-up facts that pure chain-of-thought produced. Toolformer (February 2023) trained a model to decide by itself which APIs to call, including a calculator, search engines and a calendar. In practice, early agents needed long instructions on how to use tools, parsers for the model’s output and orchestration code; Clare Liguori of AWS recalls that simply getting models to produce valid JSON was a challenge in early 2023. Meanwhile, Simon Willison named the risk that came with reading untrusted text: prompt injection, in September 2022.

Model providers then trained models to emit tool calls natively, as structured JSON against a schema, and the loop became simple to write. In November 2024 Anthropic open-sourced the Model Context Protocol so tools could be shared across applications, and in December it published “Building effective agents”, which separated workflows from agents and described agents as “typically just LLMs using tools based on environmental feedback in a loop”. AWS released Strands Agents in May 2025 on the same model-driven idea: give the model a prompt and tools and let it plan, instead of encoding the plan in a framework.

The open problems moved from making agents act to keeping them on track and safe: context engineering and memory for long tasks, multi-agent systems that spend more tokens in parallel, and the “lethal trifecta” of private data, untrusted content and external communication. In December 2025 MCP moved to the Linux Foundation’s new Agentic AI Foundation, and by 2026 AWS, Google and Microsoft each sold a managed platform for running agents, with sessions, memory, identity and tracing built in.

Why it’s built this way

The model proposes, the application executes
A tool call is only structured output; your code runs it. That keeps credentials, permissions and side effects in code you control, so the harness can refuse a call, ask a person or run it in a sandbox, which matters because anything the model reads can try to steer it.
Describe tools with a JSON Schema
Before native tool use, teams wrote prompts and parsers to coax actions out of free text. A schema per tool lets the provider train for it and validate arguments; OpenAI’s strict mode makes calls follow the schema instead of best effort.
Let the model choose the path, inside limits
Agents exist for problems where you can’t hardcode the steps. Anthropic recommends stopping conditions such as a maximum number of iterations, and pauses for human feedback at checkpoints, to keep that freedom under control.
Keep long-term state outside the context window
The context is limited and recall degrades as it fills. Anthropic’s Research agent saves its plan to memory because its context is truncated past 200,000 tokens, and agents use compaction and note files to carry work across resets.

Timeline

  1. 2022

    The ReAct paper interleaves reasoning with actions; Simon Willison names prompt injection (September)

  2. 2023

    Toolformer trains a model to decide which APIs to call

  3. 2024

    Anthropic open-sources MCP (November) and publishes “Building effective agents” (December)

  4. 2025

    AWS releases Strands Agents (May); Anthropic describes its multi-agent Research system (June)

  5. 2025

    MCP moves to the Linux Foundation’s Agentic AI Foundation (December)

Sources17

Improve this page on GitHub