From Model to Agent

The problem with the word "agent"

In 2023, "agent" mostly meant a model that could call a function. Since then it has been attached to autocomplete, customer support widgets, research pipelines, and processes that hold private keys and move money without a human in the loop.

These are not variations on a theme. They are different machines, with risk profiles that differ by orders of magnitude.

Any serious analysis has to define agency along a continuum, not as a binary.

Single-turn inference

Start with a model answering a question.

You send text. It returns text. Nothing else happens. No memory of previous calls, no ability to reach outside the request. A human reads the output and decides what to do.

Call this single-turn inference.

It has privacy questions — your input passed through someone else's server, it may be logged. But it has almost no agency concerns for one reason:

It cannot do anything. The worst outcome is a wrong answer. A human still stands between the model and the world.

Adding a tool

Now we change one thing. We tell the model: if you need current information, you may call this search function.

`` input → model → tool call → tool result → model → output ``

Something important just happened.

The model's output is no longer only read by a human. Part of its output is now read by a machine that will act on it.

When the model emits a tool call, code parses it and executes it. If the tool is a search, a search happens. If it were a payment API, money would move.

We have crossed from a system that produces text to a system that produces effects.

This is a tool-using agent.

The loop

Real tool use is rarely one call. The model calls a tool, sees the result, and decides what to do next. Eventually it decides it is done.

That pattern — reason, act, observe, repeat — is the core loop of nearly every agent framework in production.

The point where tool results re-enter the model is the most security-relevant part of this diagram. That re-entry point is untrusted input — and Stage 2 of this course is entirely about it.

What changes when there is a loop

A single tool call is inspectable. You could imagine reading it before it runs.

A loop is not.

• The number of steps is unknown in advance
• The sequence depends on what tools return
• The same task run twice may take different paths
• The model is stochastic — you cannot fully predict the path even knowing all inputs

The system has acquired a property ordinary software does not have:

You cannot enumerate its possible behaviours before it runs.

That is not a flaw — it is the point of the design. It is also why reviewing agent behaviour after the fact is such a weak security strategy.

Key takeaways

• "Agent" describes a range, not a category. Same word, wildly different risk.
• Single-turn inference cannot act. A human stands between the model and the world.
• The threshold is crossed when a machine reads the model's output and acts on it.
• The loop makes behaviour unenumerable in advance — which is why prevention beats review.