FoundationsBeginnerLesson 35 min read

From chatbot to agent

A chatbot talks. An agent acts. That one difference is where the entire security field in this guide comes from.

🧪 Lab · 20 min📝 Lesson test
Lesson in motion

In 60 seconds

From chatbot to agent

A chatbot talks. An agent acts. That one difference is where the entire security field in this guide comes from.

1/7
In simple words
A chatbot is a friend who gives advice on the phone. An agent is a friend you gave your house keys, your wallet and your email password to, and then said "sort out my week."
An AI agent is a language model with four extra things bolted on:
  1. 1

    A goal

    Something to achieve, not just a question to answer. "Get this bug fixed." "Book the cheapest flight."
  2. 2

    Tools

    Real actions in the real world. Send email, run code, query the database, pay an invoice, click a button.
  3. 3

    Memory

    Notes it keeps across steps and sometimes across days, so it can work on long jobs.
  4. 4

    A loop

    It repeats: think, act, look at what happened, think again — until the goal is done or it gives up.

Watch the difference

Chatbot
  • You ask, it answers, done.
  • Worst realistic outcome: it tells you something wrong and you believe it.
  • Every step passes in front of your eyes.
  • It cannot touch anything outside the chat box.
Agent
  • You give a goal, it takes many steps on its own.
  • Worst realistic outcome: it deletes a database, wires money, or emails your files to a stranger.
  • Most steps happen while you are not looking.
  • It touches real systems: files, money, email, code, other people.
Danger
The core security shift: with a chatbot, a bad output is a bad sentence. With an agent, a bad output is a bad action — and actions do not always undo.

The agent loop, step by step

  1. 1

    Observe

    Read the goal and whatever information is available right now.
  2. 2

    Think

    Decide the next single step. "I should search the customer database."
  3. 3

    Act

    Call a tool with some arguments. search_customers(name="Mehta")
  4. 4

    Observe again

    Read the tool's result. This result is new text, and it goes straight into the model's context.
  5. 5

    Repeat

    Loop back to Think, now knowing more. Stop when the goal is met, the budget runs out, or a human says stop.
Watch out
Step 4 is the whole ballgame. Tool results are attacker-controlled text that lands inside the model's brain. If a web page, an email or a file can influence what the agent reads, it can influence what the agent does next.

Watch and read more

What are AI agents, explained simplyYouTube searchBuilding effective agentsAnthropic engineering · reading

Lab

A working agent loop in under 40 lines, and the step where it becomes dangerous.

~20 min

The problem

Build the smallest possible agent: a loop that takes a goal, calls a model, parses a tool call, executes it, feeds the result back, and repeats. Give it exactly two tools: calculator(expr) and get_time(). Then add a third tool that writes a file and write down, before you run it, everything that could now go wrong.
Starter codepython
TOOLS = {
    "calculator": lambda expr: str(eval(expr, {"__builtins__": {}}, {})),
    "get_time": lambda: __import__("datetime").datetime.now().isoformat(),
}

def agent(goal, max_steps=5):
    history = [f"Goal: {goal}"]
    for step in range(max_steps):
        reply = call_model("\n".join(history))     # you implement this
        if reply.startswith("TOOL:"):
            name, _, arg = reply[5:].partition(" ")
            result = TOOLS[name](arg) if arg else TOOLS[name]()
            history.append(f"Tool {name} -> {result}")
        else:
            return reply
    return "gave up"

You are done when

Hard questions

Try to answer before you reveal. If you can answer these, you understood the lesson.

Q1Your agent has only calculator and get_time — no file access, no network. Argue that it is still not safe.Reveal
The eval in the calculator is a full Python expression evaluator. Even with __builtins__ stripped, attribute traversal from an object literal can reach the import machinery. A model that has been injected can emit an expression rather than a sum. The lesson is general: a tool's name tells you its intent, and its implementation tells you its capability. Only the second one matters. Use ast.literal_eval or a real expression parser.
Q2Where exactly, in your loop, does untrusted content become an instruction?Reveal
At history.append(f"Tool {name} -> {result}"). That result is text from outside, concatenated into the same string the model reads as its instructions. There is no marker separating it. Everything in Track B follows from that single line, and no amount of prompt wording removes it — only removing the capability does.

Please sign in to continue.

Questions people ask

Is Siri an agent?

A small, tightly fenced one. It has a few tools (timer, message, music) and a very short loop. Modern coding and browsing agents have hundreds of tools and loops that run for hours. Same shape, wildly different blast radius.

Why give agents tools at all? Isn't that asking for trouble?

Because tools are the entire point. A model that can only talk can only ever produce a suggestion you must carry out yourself. Tools are also, unavoidably, the attack surface. Security work is about keeping the usefulness while shrinking the damage.

How does the agent decide which tool to use?

Each tool has a name and a written description. Those descriptions are put in front of the model, and the model guesses which one fits. That means a tool description is a prompt — and a malicious tool description can hijack behaviour. See Module 15.

What stops an agent looping forever?

Limits you set: a maximum number of steps, a time limit, a spend limit, or a rule that it must ask a human after N actions. If you did not set one, there isn't one.

Are agents actually used for real things yet?

Yes. Coding assistants that edit and run code, customer support bots that issue refunds, research agents that browse and buy, ops agents that restart servers. Every one of those verbs is a real-world consequence.

Lesson test

5 questions. Get 3 right (60%) to pass and complete this lesson.

Sign in with your phone number to take the test and save your progress