New look for the field notes.
Field Note #1: What’s an AI agent?
An AI agent is software that handles a task for you. Picture asking a smart assistant to plan a vacation. It books the flight and the hotel. Adds the details to your calendar. You stated the goal. The assistant figured out the steps. That’s an agent.
Autonomy. The agent picks the steps to your goal. Run a task twice and the steps can differ. That makes it both more useful and more risky.
THE LOOP · HOW IT WORKS
01 Think. It plans the next step.
02 Act. One tool does one action.
03 See. It reads the result.
04 Think again. The plan gets updated.
05 Done. The task is finished.
The loop repeats until the task is done.
WHAT’S INSIDE · FIVE PARTS
- Model. The brain. ChatGPT, Claude. Thinks and decides.
- – Tools. What the agent can do. Web search, calendar, files, code.
- – Agent. Connects the model to the tools.
- – Context. What’s in front of the agent. Documents, prior messages.
- – Identity. Out of the box it signs in as you. Card 2 sets up a separate login.
FRAMEWORKS
- LangChain. Where beginners start. Big toolbox. Many models.
- – LangGraph. Production work. Checkpoints and rules.
- – CrewAI. Multi-agent teams. Each agent plays a role.
- – Microsoft and AWS. Enterprise stacks. Semantic Kernel, Strands.
- – Why so many: field’s new. No winner yet. Big tech builds in-house.
TOOLS AND PROTOCOLS
- Function calling. The original. Agent picks from a menu of functions.
- – MCP. The new standard. One tool catalog works across models.
- – The flow. Pick a tool, call it, read the result, decide next move.
IN USE TODAY · AT SCALE
- Customer service. Question and answer, account lookups, refunds.
- – Software development. Read code, write code, run tests.
- – Research and analysis. Summarize long documents fast.
- – Internal automation. Expense reports, IT, scheduling.
Most agents handle narrow tasks rather than full autonomy. Many run with little approval or oversight.
WHY IT’S RISKY
- Prompt injection. Hidden instructions in text the agent reads.
- – Permission inheritance. Inherits your access. Admin equals admin agent.
- – Identity confusion. The agent acts. The record says you did it.
- – Tool misuse. What the agent can use, an attacker can use.
- – Hallucination at action. AI invents a fact. Agent acts on it.
- – Runaway loops. Stuck repeating. Burns budget.
- – Memory poisoning. Attacker plants memory. Agent acts on it later.
WHAT HELPS
- Decide who is responsible for the agent’s mistakes before you run it.
- – Give it the fewest permissions.
- – Prefer actions you can undo.
- – Log everything.
- – Human in the loop for high-impact actions.
Agents are still new. Identity standards and better observation tools are coming, with regulators catching up. Today’s patterns will look naive in three years.
Most agents you’ll use run on this loop and these parts.
Keep going. Card 2 sets up the environment. Card 3 runs the first agent: vincearnold.com/field-notes
#AgenticAI #AIGovernance #CISO #AISecurity
First comment (posted after publishing): Sources: OWASP GenAI Security Project, NIST, CSA, EU AI Act. Setup guide: vincearnold.com/field-notes