What is an AI agent, and what can it really do today?

From chatbot to agent

Most people know AI as a chatbot. You ask a question, and the program replies with text. An AI agent goes one step further. Instead of only describing how to do something, it is meant to do it.

Germany's Federal Office for Information Security (BSI) explains the difference with an example. Asked to book the cheapest flight to Berlin and add it to the calendar, a chatbot would explain how to do that. An agent would search for flights itself, compare prices, make the booking and update the calendar.

To do this, an agent needs access: to the internet, to software and often to personal data such as email, files or accounts. That is where both its usefulness and its risk come from.

How an agent works

At its core is a large language model, the same kind of AI that powers ChatGPT or Claude. Experts call it an LLM. The model is given tools. Tools can be a web search, a browser the AI can operate itself, access to email, or the ability to run program code.

According to the BSI, an agent works in a loop. It looks at the situation, plans the next step, carries it out and checks the result. It repeats this until the task is done or it gets stuck.

The AI company Anthropic describes agents in a similar way: the model decides by itself which tool to use next, guided by feedback from its environment. Anthropic distinguishes this from fixed workflows, where people define the steps in advance. In everyday language, both are often simply called agents.

What is actually available today

As of October 2026, OpenAI offers a section called Work in ChatGPT alongside the regular chat. OpenAI describes Work as an agent for longer, multi-step tasks, such as research, analysis, or creating a document, spreadsheet or presentation. According to OpenAI, Work is only available on paid plans.

Work includes a so-called cloud browser. This is a web browser running on an OpenAI computer. It can read pages, click buttons and fill in forms. OpenAI's examples include checking reservations, comparing flights and tracking a package. The agent pauses when it needs a sign-in or a decision, and it asks before steps with real consequences, such as a booking or a payment.

OpenAI says the earlier agent mode in ChatGPT is no longer available and has been replaced by Work. For businesses there are also shared agents, which OpenAI still labels as a preview. Other providers such as Anthropic also describe agents that operate a computer or write code. According to Anthropic, programming is a particularly good fit, because results there can be checked with automated tests.

OpenAI's documentation does not state clearly whether every feature is available in every EU country. It refers to supported regions and a gradual rollout. What appears in your own account is the most reliable indicator.

Where the limits are

Agents cannot complete every task. OpenAI itself states that the cloud browser cannot finish every task or transaction. Some websites block automated visitors. Sometimes you have to do the final step yourself.

Anthropic points out that agents cost more than simple requests and that errors can add up over many steps. A small mistake early on can lead to a wrong result at the end. The BSI stresses that the technology is still at an early stage and that security standards are only now being developed.

Our assessment: today, agents are most useful when the result is easy to check. A list with sources or a draft can be reviewed. An unsupervised order is harder to undo.

The main risks

The BSI names several dangers. The first is loss of control: the more independently an agent acts, the harder it is to follow what it is doing. It might, for example, send emails in your name.

The second is prompt injection. Attackers hide instructions in websites, documents or emails, for instance as invisible text. When the agent reads this content, it may treat those hidden instructions as real ones. The BSI describes a manipulated email that tricks an agent into forwarding all future messages to an outside address. OpenAI gives a similar example and states that its safeguards reduce such risks but do not eliminate them.

According to the BSI, the situation becomes especially risky when three things come together: access to confidential data, processing untrusted content from the web, and the ability to send data to outside systems.

Using agents sensibly

A few simple rules follow from the advice of the BSI and OpenAI. Give an agent only the access it needs for the specific task. No agent should be able to reach your email, bank account and private files at the same time.

Give clear, limited instructions. OpenAI explicitly advises against open-ended requests like asking it to handle everything in your inbox. Use settings that make the agent ask before important actions, and read those requests carefully.

Never type passwords, security codes or payment details into the chat. If a sign-in is needed, use the dedicated sign-in form or take over yourself. Stop the task if the agent does something unexpected or ends up on the wrong site, and review its history afterwards.