An AI agent is a software system that uses one or more language models to reason about a goal, plan a sequence of actions, call external tools or services to execute them, and adjust based on results. Agents differ from chatbots by their capacity to act rather than only respond, and by persistent context across steps.
- Reasons about a goal, plans actions, calls tools, and adapts to results
- Differs from a chatbot by acting rather than only responding
- Holds identity, permissions, a reasoning loop, a tool catalog, and memory
- Each of those five is an attack surface the existing stack was not built for
Why is an AI agent important?
The agent is the unit of risk in modern AI security, which is why it is the object worth defining precisely. An agent has five properties that matter, and each one is an attack surface. It holds an identity, so it can be impersonated or over-permissioned. It holds a permission set, so it can exceed the scope its task required. It runs a reasoning loop, so it can be steered by instructions hidden in the content it reads. It carries a tool catalog, so it can reach systems its owner never considered. And it retains memory, so a compromise can persist across sessions.
The existing security stack was not built for any of the five. Identity systems assume a human principal, and detection assumes deterministic software. That gap is what CrowdStrike observed being exploited when it documented malicious prompts injected into legitimate AI tools at more than 90 organizations in 2025.
What is an AI agent?
An AI agent is a system that pursues a goal by reasoning, acting, and adapting. Given an objective, it decides what steps are required, invokes tools or services to carry them out, evaluates what came back, and revises its approach until the goal is met or it stops.
Four components make that possible. A model provides the reasoning. A tool interface gives it the ability to act – calling APIs, querying data, running code, sending messages. Memory maintains state across steps, so the agent knows what it has already tried. And an orchestration loop governs the cycle of decide, act, observe, revise.
The distinction from a chatbot is not sophistication but capability. A chatbot receives input and returns output, and a human decides what to do next. An agent takes the action itself. That single difference is what moves the security question from data exposure to consequence, because an agent's mistakes and an attacker's instructions both arrive as real changes to real systems.
Types of AI agents
Agents are usefully grouped by how much autonomy they hold and by what they are built to do.
By autonomy, assistive agents propose actions and wait for approval. Semi-autonomous agents act within a bounded scope and escalate anything outside it. Fully autonomous agents complete multi-step tasks without checkpoints, which is where the governance question becomes acute.
By function, coding agents read and write code and hold developer-level access. Workflow agents execute business processes across SaaS systems. Research agents retrieve and synthesize information, and are exposed primarily through what they read. Customer-facing agents interact with people outside the organization, which adds a reputational and regulatory dimension. Supervisory agents oversee other agents rather than performing a task.
A cross-cutting distinction matters more than either taxonomy: whether an agent was deliberately deployed or created inside a low-code builder by someone who did not treat it as software.
AI agent & Onyx
The agent is the primary object Onyx governs. Each one is discovered across the environment, scored for posture, governed by policy, inspected at runtime, and measured for adoption and business value – one object, followed through every function of the Secure AI Control Plane.
That matters because the five agent attack surfaces are not separable in practice. An over-permissioned agent with a large tool catalog and a steerable reasoning loop is one problem, not three, and addressing it requires identity, permission, and runtime controls that share a data model. Agent identity and access governance handles the identity and permission side, while runtime inspection covers the reasoning loop and tool calls.
