AI that takes actions

Ask a chatbot to “book a table for Thursday and tell Sam”, and it can write you a polite message to send. Ask an AI agent, and it can try to do the booking and send the message itself. That difference sounds small. It changes who is responsible for each step, and it changes what can go wrong.

Talking versus doing

In the lesson on how a chatbot writes, you saw that a language model does one thing: it continues text, one piece at a time. A chat assistant shows you that text. You read it and decide what to do.

An agentAgentA system that runs a language model in a loop with tools, letting it take several steps, observe results, and decide what to do next toward a goal. Definitions vary in how much autonomy they imply.Taught in Models that use toolsOpen in glossary uses the same kind of model, but some of the text it writes is a request for an action: “look at the calendar”, “book this table”, “send this email”. A program around the model reads each request, carries it out if it is allowed, and gives the model the result. Then the model writes its next request. Round and round, until the job is done.

What agents can do today

Products change fast, so treat this as a snapshot from October 2026, from each company’s own documentation:

• Search and read the web. Many chat assistants can now search, open pages, and quote what they find before they answer.
• Work on software. Coding agents such as Claude Code, OpenAI Codex, and Gemini CLI read and edit the files in a project and run commands, such as the project’s tests, on your computer or a cloud machine.
• Operate a computer. Some agents work a screen the way you do. Anthropic’s computer use, released as a beta in October 2024, lets a model look at screenshots, move the pointer, click, and type. OpenAI announced ChatGPT agent in July 2025, describing it as working on its own virtual computer and asking permission before actions of consequence.

None of these is perfect. Anthropic called computer use “experimental” and “at times cumbersome and error-prone” when it launched it.

Who actually does it

Here is the part people most often get wrong. The model never acts. It writes a proposal. Software runs it, or does not. You are going to be that software.

In the demo, a scripted assistant (no real model runs) works through a dinner booking for you. Each time it proposes an action, the program either runs it or asks you first, depending on the setting. The pretend world on the right changes only when an action actually runs.

# The assistant's proposals, written out by hand. In a real agent,
# a language model would write each one after reading the results so far.
PROPOSALS = [
    ("look_at_calendar", "next week"),
    ("book_table", "Luigi's, Thursday 7 pm"),
    ("pay", 180),                              # asked for by text hidden on a web page
    ("send_email", "[email protected]"),   # the wrong Sam
]
LOOKS_ONLY = {"look_at_calendar"}

def run_errand(ask_person):
    world = {"money": 600, "booking": None, "emails_sent": []}
    for action, value in PROPOSALS:
        # The program, not the model, decides whether an action runs.
        if action not in LOOKS_ONLY and not ask_person(action, value):
            print(f"  skipped {action}: {value}")
            continue
        if action == "book_table":
            world["booking"] = value
        elif action == "pay":
            world["money"] -= value
        elif action == "send_email":
            world["emails_sent"].append(value)
        print(f"  ran {action}: {value}")
    print(f"  afterwards: {world}")

print("Never asking:")
run_errand(lambda action, value: True)

print("Asking, and saying no to payments and to the wrong Sam:")
run_errand(lambda action, value: action != "pay" and value != "[email protected]")

Never asking:
  ran look_at_calendar: next week
  ran book_table: Luigi's, Thursday 7 pm
  ran pay: 180
  ran send_email: [email protected]
  afterwards: {'money': 420, 'booking': "Luigi's, Thursday 7 pm", 'emails_sent': ['[email protected]']}
Asking, and saying no to payments and to the wrong Sam:
  ran look_at_calendar: next week
  ran book_table: Luigi's, Thursday 7 pm
  skipped pay: 180
  skipped send_email: [email protected]
  afterwards: {'money': 600, 'booking': "Luigi's, Thursday 7 pm", 'emails_sent': []}

You just played the role of an agent’s program, which people who build agents call the harness. The assistant could propose anything it liked. Nothing happened in the world unless the program ran it, and the program ran it only if its rules, or you, said yes.

Why good agents ask first

Not every action needs a question. Two things decide how risky an action is:

• Does it only look, or does it change something? Reading a calendar or a web page leaves the world as it was. Booking, paying, and sending change it.
• Can the change be taken back? A booking that is free to cancel can be undone. A payment or a sent email cannot.

A sensible program lets looking happen freely and asks before changes, especially ones that cannot be undone. That is what Only changes did: four questions instead of seven, and nothing slipped through. Ask too often and the questions become noise you approve without reading. Ask too rarely and mistakes reach the world.

What can go wrong

Honest mistakes. The assistant picked the most recent email from someone called Sam, which was the wrong Sam. Models make mistakes for the reasons you saw in the last lesson. In a chat, a mistake is a wrong sentence you can ignore. In an agent, a mistake can become an action.

Instructions hidden in what it reads. The restaurant’s page had text hidden in it, addressed to AI assistants, telling them to pay a deposit. The assistant reads everything as text, and it has no reliable way to tell your instructions from instructions planted in a web page, an email, or a document. This attack is called prompt injectionPrompt injectionAn attack in which text a model reads changes what it does against its developer's intent. Direct injection comes from the person typing; indirect injection hides in what the model reads, such as a web page, email, picture, or memory.Taught in Prompt injectionOpen in glossary, and no current model is reliably immune to it.

Reports that do not match what happened. With no questions asked, the assistant ended by saying it had let Sam know. It had emailed a different Sam and spent $180. What an agent says it did and what it did can differ. The record of actions is what counts.

There is much more to how agents are built. The frontiers track covers the loop between the model and its tools in detail (models that use tools), and everything else a real agent’s program handles, from permissions to memory (inside an agent harness).