Agentic AI

How agentic AI works

An agentic system has three parts:

• The model reads the goal and the results until now. It selects the next step.
• The control software, or agent harness, does that step with a tool. It gives the result back to the model.
• The tools connect to real systems: files, email, a browser, a database, a shell.

The control software repeats this until the task is done, or a limit or a person stops it.

Who selects the next step

Anthropic puts two designs in the class “agentic systems”:

Design	Who selects the next step
AI workflow	The developer, in code written before the task starts
AI agent	The model, while the task continues

Why agentic AI matters

With a chatbot, the risk is what the model says. With agentic AI, the risk is what the model does.

The NIST Center for AI Standards and Innovation (CAISI) names three groups of risk (January 2026):

• Adversarial data. Text that the system reads gives it instructions, as in indirect prompt injection and agent hijacking.
• Insecure models. The model has a backdoor that a person put in it.
• Dangerous steps with no attacker. The model pursues an incorrect objective.

Errors also add up. Anthropic warns of “the potential for compounding errors” and recommends tests in a sandbox.

In practice

What the market numbers say

All figures are from Gartner, reported by W.Media on 27 June 2025. They are predictions and a poll, not measured results.

Figure	What it measures
More than 40%	Agentic AI projects that Gartner says could be canceled by the end of 2027
About 130	Agentic AI vendors that Gartner thinks are real, out of “thousands”
19% and 42%	Large and careful investment in agentic AI, in a poll of 3,412 webinar attendees (January 2025)
15% or more	Day to day work decisions made autonomously through agentic AI by 2028 (prediction)
33%	Enterprise software that will include agentic AI by 2028 (prediction)

In the same poll, 8% had no investment and 31% chose to wait and see, or were unsure. Gartner gives three causes for these possible cancellations: costs, unclear business value and weak risk controls.

Gartner also names “agent washing”. Vendors give current AI assistants, robotic process automation (RPA) and chatbots a new name: agentic AI. Analyst Anushree Verma says that many use cases presented as agentic do not need an agentic design.

4 rules that the guidance agrees on

1. Use the minimum agency that does the task. Anthropic recommends “the simplest solution possible”. The principle of least agency says the same for security.
2. Limit the tools and their permissions. Too much power for the task is excessive agency.
3. Keep a person accountable. The Singapore framework (22 January 2026, updated 20 May 2026) says “Make Humans Meaningfully Accountable”. Human approval is one control for this.
4. Test against the known risks. The OWASP agentic Top 10 (9 December 2025) gives the primary security risks of agentic applications.

The guide how to secure agentic applications gives the steps in full.

Where definitions disagree

The sources do not agree on what counts as agentic AI.

Source	Position
Anthropic (December 2024)	Fixed workflows and agents are the two “agentic systems”
NIST CAISI (January 2026)	Chatbots and retrieval systems “not orchestrated to act autonomously” are out of scope
Singapore framework (January 2026)	Agents “plan across multiple steps” for an objective
Chan and colleagues (2023)	Agency is a degree, not a class
Gartner (June 2025)	Many products sold as agentic are not agentic

Chan and colleagues (FAccT 2023) name four properties that increase agency, “particularly in combination”:

1. Underspecification. The system gets a goal, not the method.
2. Directness of impact. No human is between the system and the result.
3. Goal-directedness. The system works to get a goal.
4. Long-term planning. The system plans many steps forward.

Two questions divide the sources. The first is if a fixed workflow is agentic. The second is if “agentic” is a class of product or a degree. For security work, the degree is more useful. Find what the system can do with no person between the model and the result.

Questions and answers

What is the difference between agentic AI and an AI agent?

Agentic AI is the class of systems that do tasks with no person to approve each step. An AI agent is one such system. Anthropic uses "agentic systems" for fixed workflows and for agents. In agents, "LLMs dynamically direct their own processes and tool usage".

Is a chatbot agentic AI?

Not usually. A chatbot gives text to a person, and the person acts. NIST kept "AI chatbots or retrieval-augmented generation systems that are not orchestrated to act autonomously" out of its January 2026 request on agent security. A chatbot becomes agentic when control software lets it use tools that change real systems.

Why is agentic AI a security risk?

An agentic system turns model output into real changes. NIST names three groups of risk. The first is adversarial data, such as indirect prompt injection. The second is insecure models, such as models with backdoors. The third is dangerous steps with no attacker. The tools set the limit of the damage.