What Agentic AI Actually Is

"Agentic AI" is the phrase that replaced "chatbot" the moment models stopped just answering and started doing. It is also badly overused — half the products wearing the label are a language model with a single API call bolted on. It is worth being precise about what actually makes a system agentic, because the difference is the difference between a demo and something you would let touch production.

The distinction that matters#

A chatbot receives a message and returns a message. Whatever happens next is up to you. An agent is given a goal and then decides, on its own, what steps to take to reach it — calling tools, reading the results, and deciding what to do next, in a loop, until it judges the goal met or gives up.

The model is the same in both cases. What changes is the scaffolding around it: the ability to act, observe the outcome, and act again without a human in the middle of every step.

Chatbot:   prompt -> model -> answer.  Done.

Agent:     goal -> model -> action -> observe result -> model -> action -> ...
                     ^__________________________________________|
                     until the goal is met, a budget is spent, or it fails

That loop is the whole idea. Everything else — planning, memory, multi-agent choreography — is elaboration on it.

The four capabilities under the label#

An agentic system is a language model plus some combination of four things. How many it has, and how well, is a better measure of "how agentic" than any marketing tier.

1. Tool use#

The model can call functions — search the web, run a query, edit a file, hit an API — and read what comes back. This is the load-bearing capability; without it an "agent" cannot affect anything.

Modern models are trained to emit a structured tool call, the runtime executes it, and the result is fed back into the context as if the model had observed the world:

model: call search_flights(origin="LHR", dest="JFK", date="2026-09-01")
runtime: [executes, returns 40 results]
model: (reads results) call book_flight(id="BA178")

The quality of an agent is often set less by the model than by the tools it is given and how clearly they are described.

2. Planning and decomposition#

For anything beyond a single step, the model breaks a goal into sub-tasks and orders them — sometimes explicitly ("first I will read the schema, then write the query, then verify it"), sometimes implicitly across loop iterations. Weak planning is where agents visibly flail: repeating a failed action, or declaring victory three steps early.

3. Memory#

The context window is working memory and it is finite. Real agents add persistence — a store of what they have learned, done, or been told — that survives beyond a single conversation. Without it, an agent re-solves the same problem every session and cannot work on anything that spans more than one context window.

4. Reflection#

The ability to look at its own output — a failing test, a compiler error, a result that does not match the goal — and correct course rather than plough on. This is what separates an agent that recovers from a wrong turn from one that confidently drives into a wall.

None of these are new ideas. What changed is that the models got good enough at following instructions and calling tools reliably that stringing the loop together stopped being a research project and became a weekend one. The capability was latent; the reliability is what arrived.

The patterns you will actually meet#

Most production agentic systems are one of a few shapes:

• Single agent, tool loop. One model, a set of tools, the loop above. The right default — most problems that look like they need a swarm need a better prompt and better tools.
• Planner / executor. One model decomposes the goal into a plan; another (or the same one, in a different role) executes each step. Useful when planning and doing benefit from different framing.
• Multi-agent. Several specialised agents — a researcher, a critic, a writer — passing work between them. Powerful for genuinely parallel or adversarial work (one agent proposes, another tries to refute), and expensive. The coordination overhead is real, and it is easy to build a committee that is slower and worse than one focused agent.
• Human-in-the-loop. The agent proposes an action that changes the world — sends the email, runs the migration — and waits for approval. The correct design for anything irreversible, and the one most demos skip.

When you are deciding whether to reach for multiple agents, ask whether the sub-tasks are genuinely independent or adversarial. If they are sequential steps of one job, a single agent with a good loop will beat a pipeline of agents handing context back and forth — and it will be far easier to debug.

Where it breaks#

The failure modes are as characteristic as the capabilities, and they are the reason "agentic" is not a synonym for "finished":

• Errors compound. A 95%-reliable step is 60% reliable after ten of them. Long autonomous chains are fragile precisely because each link multiplies. The engineering is mostly about keeping chains short and catching failures early.
• Cost and latency scale with the loop. Every iteration is another model call. An agent that takes twenty steps costs twenty times a single answer, and the user waits for all of them.
• It is non-deterministic. The same input can produce a different path twice. That breaks the mental model — and the test suite — of everyone used to deterministic software. Evaluating agents means judging distributions of behaviour, not asserting on one output.
• Autonomy is a liability as much as a feature. An agent that can run shell commands or spend money is one confused loop away from doing real damage. The capability you are selling is the capability you have to contain.

Prompt injection is agentic AI's defining security problem. The moment an agent reads untrusted content — a web page, an email, a document — that content can contain instructions, and the model has no reliable way to tell data from commands. An agent that can both read the web and send email can be told, by a web page, to exfiltrate your inbox. Treat every input an agent ingests as potentially adversarial, and gate every consequential action behind a control the agent cannot talk its way past.

How to think about adopting it#

The useful question is not "is this agentic" but "how much autonomy does this task actually warrant". The spectrum runs from a model that drafts and a human that sends, through an agent that acts and reports, to an agent that acts unattended. Each step out gives up oversight for leverage, and the right point is task-specific: unattended is fine for triaging logs and reckless for moving money.

The systems that work in production are almost never the most autonomous ones on paper. They are the ones that took a genuinely useful loop, kept the chain short, put a human in front of anything irreversible, and treated their own inputs as hostile. The rest of the articles in this section — OpenClaw, Claude Code, and the worked examples — are that principle in specific tools.