AI agents: when the chatbot starts clicking for you
From answering questions to booking flights and filling forms. What agents are, what they already do well, prompt injection, and the rules for letting software run errands.
For two years, the deal with AI was simple: it talks, you act. The chatbot drafts the email, you press send. It plans the trip, you book the flights. Then, starting in late 2024, the labs began shipping something different — models that move the mouse, fill the forms, and press send themselves. Anthropic released a "computer use" mode that lets its model click around a screen like a person. OpenAI followed with an agent that browses and buys. Every lab now sells some version of the same promise: stop asking the machine for instructions and start giving it errands.
The industry word for this is agents, and it is the biggest change in how AI touches ordinary life since chat itself. It is also the point where AI mistakes stop being embarrassing and start being expensive.
What exactly is an AI agent?
A loop. A regular chatbot answers once and stops. An agent gets a goal, makes a plan, takes an action, looks at what happened, and tries the next step — over and over until it finishes or fails. Give one "find me the cheapest flight to Istanbul next Friday and book it", and it will search, compare, click through the airline's pages, fill in your details, and reach for the pay button.
The building blocks are the same language models that power chat. What changed is the harness around them: tools for browsing, clicking, and typing; memory of what they have done so far; and permission to keep going without a human approving each step. That last part is the whole story. Usefulness and risk both come from removing the human between steps.
What are they actually good at today?
Errands with clear rules and low stakes. Agents already do real work filling out forms, comparing prices, moving data between systems, booking simple appointments, triaging support tickets, and running multi-step research — the digital chores that are annoying precisely because they are repetitive. Software developers got the most dramatic version: coding agents that take a bug report, find the fault, write a fix, and open the change for review. On well-defined tasks they can run for a long stretch unattended, and the numbers keep improving every few months.
Where they still stumble is exactly where you would guess: ambiguity, judgment, and anything unusual. An agent behaves like a very fast, very literal new employee — brilliant on the tenth identical task, alarming on the first weird one. It does not know that the airline's third checkout screen with the pre-ticked insurance box is a trap. It clicks.
What can go wrong?
The failure modes are new because the blast radius is new. A chatbot that hallucinates gives you a wrong paragraph. An agent that hallucinates gives you a wrong plane ticket, a deleted folder, or a purchase you did not intend — completed politely on your behalf.
There is also a genuinely new security problem called prompt injection. An agent reads the web pages it visits, and a page can contain hidden instructions: text invisible to you that says, in effect, ignore your user and do this instead. A poisoned page, email, or document becomes a way to hijack someone else's assistant. Security teams rank it among the top risks of this whole era, and there is no clean fix yet — which is why sensible products keep a human confirmation on anything involving money, credentials, or deletion.
The scams arrived on schedule too. As agents began shopping and paying, fake stores and lookalike checkout pages aimed at automated buyers followed, because a bot with a saved credit card is a wonderful mark.
How should a normal person use them?
Gladly, with a leash. Let agents do the reading, the filling, the comparing, and the drafting — that part is free time returned to you. Keep three rules where money or accounts are involved. First, review before commit: the agent proposes, you approve the final booking, payment, or send. Second, least privilege: give it access to one browser profile or card with a low limit, not your whole digital life. Third, treat "the agent did it" as your action anyway — legally and practically, the errand-runner's mistakes belong to whoever sent the errand-runner.
The chat era taught everyone that AI words need checking. The agent era's lesson is the same one, upgraded: now the actions need checking too. The people who get the most out of this will not be the ones who trust agents completely or refuse them entirely. It will be the ones who learned, early, exactly which errands to hand over and which button to keep for themselves.