{ "id": "epvb52jgj6", "slug": "ai-agent", "title": "AI agent", "updated": "2026-10-15", "topic_path": [ { "id": "technology", "label": "Technology and the built world", "api_url": "https://www.edgepedia.org/api/v1/topics/technology" }, { "id": "technology.computing", "label": "Computing and digital systems", "api_url": "https://www.edgepedia.org/api/v1/topics/technology.computing" }, { "id": "technology.computing.modern_ai", "label": "Modern AI: foundation models, generative AI, and the AI industry", "api_url": "https://www.edgepedia.org/api/v1/topics/technology.computing.modern_ai" }, { "id": "technology.computing.modern_ai.industry", "label": "AI companies, people, and products", "api_url": "https://www.edgepedia.org/api/v1/topics/technology.computing.modern_ai.industry" }, { "id": "technology.computing.modern_ai.industry.ai_products_assistants", "label": "AI products and assistants", "api_url": "https://www.edgepedia.org/api/v1/topics/technology.computing.modern_ai.industry.ai_products_assistants" }, { "id": "technology.computing.modern_ai.industry.ai_products_assistants.ai-agents-and-developer-tools", "label": "AI agents and developer tools", "api_url": "https://www.edgepedia.org/api/v1/topics/technology.computing.modern_ai.industry.ai_products_assistants.ai-agents-and-developer-tools" } ], "geo": [ { "id": "geo.us.t2021.technology.computing.modern_ai.industry.ai_products_assistants.ai-agents-and-developer-tools", "label": "United States · 2021 and later: AI agents and developer tools", "api_url": "https://www.edgepedia.org/api/v1/geo/geo.us.t2021.technology.computing.modern_ai.industry.ai_products_assistants.ai-agents-and-developer-tools", "path": [ { "id": "geo.us", "label": "United States", "api_url": "https://www.edgepedia.org/api/v1/geo/geo.us" }, { "id": "geo.us.t2021", "label": "United States · 2021 and later", "api_url": "https://www.edgepedia.org/api/v1/geo/geo.us.t2021" }, { "id": "geo.us.t2021.technology", "label": "Technology and the built world", "api_url": "https://www.edgepedia.org/api/v1/geo/geo.us.t2021.technology" }, { "id": "geo.us.t2021.technology.computing", "label": "Computing and digital systems", "api_url": "https://www.edgepedia.org/api/v1/geo/geo.us.t2021.technology.computing" }, { "id": "geo.us.t2021.technology.computing.modern_ai", "label": "Modern AI: foundation models, generative AI, and the AI industry", "api_url": "https://www.edgepedia.org/api/v1/geo/geo.us.t2021.technology.computing.modern_ai" }, { "id": "geo.us.t2021.technology.computing.modern_ai.industry", "label": "AI companies, people, and products", "api_url": "https://www.edgepedia.org/api/v1/geo/geo.us.t2021.technology.computing.modern_ai.industry" }, { "id": "geo.us.t2021.technology.computing.modern_ai.industry.ai_products_assistants", "label": "AI products and assistants", "api_url": "https://www.edgepedia.org/api/v1/geo/geo.us.t2021.technology.computing.modern_ai.industry.ai_products_assistants" }, { "id": "geo.us.t2021.technology.computing.modern_ai.industry.ai_products_assistants.ai-agents-and-developer-tools", "label": "AI agents and developer tools", "api_url": "https://www.edgepedia.org/api/v1/geo/geo.us.t2021.technology.computing.modern_ai.industry.ai_products_assistants.ai-agents-and-developer-tools" } ] } ], "excerpt": "An AI agent, also called an LLM agent, is a software system that uses a large language model to reason, choose tools, and take autonomous actions.", "snippet": "An AI agent, also called an LLM agent, is a software system that uses a large language model to reason, choose tools, and take autonomous actions.", "node": "technology.computing.modern_ai.industry.ai_products_assistants.ai-agents-and-developer-tools", "markdown": "# AI agent\n\nAn LLM-based AI agent is a software system that perceives its environment, reasons about it, makes decisions, and takes actions to achieve objectives autonomously, using a large language model (LLM) as its reasoning engine that decides the control flow of the application.[1](https://genai.owasp.org/download/45674/?tmstv=1739819891) This distinguishes an agent from a chatbot or a single model call: in a plain LLM application the developer's code fixes the sequence of steps, while in an agent the model itself chooses which tools to call, in what order, and when to stop. Agent autonomy ranges from hardcoded or finite-state-machine workflows to fully conversational orchestration in which every decision depends on model reasoning.[1](https://genai.owasp.org/download/45674/?tmstv=1739819891)\n\n| Key fact | Detail |\n|---|---|\n| Defining property | For LLM-based agents, the LLM decides the application's control flow, calling tools and iterating toward a goal rather than answering in one turn[1](https://genai.owasp.org/download/45674/?tmstv=1739819891) |\n| Core loop | Profile, memory, planning, and action execution form a feedback-driven cycle in which memory shapes planning and actions update memory[2](https://link.springer.com/article/10.1007/s10462-025-11471-9) |\n| Token cost | Agents used about 4x the tokens of chats, and multi-agent systems about 15x, in Anthropic's account data[3](https://ganivra.com/blog/ai-agent-statistics) |\n| Task cost | AGENCYBENCH scenarios average 90 tool calls, 1 million tokens, and hours of execution time to resolve[4](https://aclanthology.org/2026.acl-long.337.pdf) |\n| Benchmark scores | Terminal-Bench 77.3%, WebArena 74.3%, OSWorld 66.3% in 2026 compilations of the Stanford HAI AI Index[5](https://www.digitalapplied.com/blog/state-of-ai-agents-2026-200-data-points) |\n| Dominant failure | In AgentBench, Task Limit Exceeded was the predominant failure cause, reflecting weak multi-turn reasoning[6](https://arxiv.org/abs/2308.03688) |\n| Market size | AI agent platform vendor revenue of $7.8 billion in 2025, projected to $68.96 billion by 2034 at a 27.4% CAGR[7](https://dataintelo.com/report/ai-agent-platform-market) |\n| Key protocol | MCP, an open JSON-RPC 2.0 protocol for connecting LLM applications to tools and data, with tools, resources, and prompts as core primitives[8](https://modelcontextprotocol.io/specification/draft.md) |\n\n## How agents work\n\nA widely adopted architecture for LLM agents has four core components: profile definition, memory, planning, and action execution, which together form a feedback-driven system in which memory shapes planning and the results of actions update memory.[2](https://link.springer.com/article/10.1007/s10462-025-11471-9) Planning modules decompose tasks using strategies such as Chain-of-Thought and Tree-of-Thought, and feedback-based iteration lets agents revise plans using environment signals, human input, or reflections on memory.[2](https://link.springer.com/article/10.1007/s10462-025-11471-9) [Agent memory](https://www.edgepedia.org/agent-memory) can be session-based short-term memory or persistent long-term memory.[1](https://genai.owasp.org/download/45674/?tmstv=1739819891)\n\n**Reasoning patterns.** ReAct and [Reflexion](https://www.edgepedia.org/reflexion) are the most prominently used single-agent frameworks: ReAct interleaves structured reasoning with actions such as planning or tool use, while Reflexion enables retrospective evaluation of prior outputs. AutoGen and CAMEL are widely employed multi-agent frameworks, and [LangChain](https://www.edgepedia.org/langchain) serves as flexible, unopinionated modular infrastructure.[2](https://link.springer.com/article/10.1007/s10462-025-11471-9)\n\n**Computer-use agents** close the loop over a graphical interface instead of APIs. OpenAI's Computer-Using Agent (CUA) processes raw pixel data to understand the screen and uses a virtual mouse and keyboard to act, navigating multi-step tasks and handling errors without specialized APIs.[9](https://openai.com/index/computer-using-agent/) It operates through an iterative perception-reasoning-action loop, reasoning with chain-of-thought over current and past screenshots, and it seeks user confirmation for sensitive actions such as entering login details or responding to CAPTCHA forms.[9](https://openai.com/index/computer-using-agent/) Microsoft's Fara1.5 models follow an observe-think-act loop over the three most recent browser screenshots, outputting thoughts and single-step mouse-and-keyboard or web-specific actions, plus meta-actions such as context management.[10](https://www.microsoft.com/en-us/research/articles/fara1-5-computer-use-agent/)\n\n**Termination and failure.** [AgentBench](https://www.edgepedia.org/agentbench) categorizes how agent runs end into five finish reasons: Context Limit Exceeded, Invalid Format, Invalid Action, Task Limit Exceeded, and Complete. Task Limit Exceeded was the predominant failure cause, revealing weak reasoning and decision-making across multi-turn tasks.[6](https://arxiv.org/abs/2308.03688)\n\n## Capabilities and benchmarks\n\nAgentBench is a multi-dimensional benchmark of 8 distinct environments assessing LLM-as-agent reasoning and decision-making, tested over 29 API-based and open-source LLMs. It found a significant performance disparity between top commercial models and open-source competitors no larger than 70B parameters, with poor long-term reasoning, decision-making, and instruction following as the main obstacles.[6](https://arxiv.org/abs/2308.03688)\n\nTool-use evaluation has moved from early one-step synthetic benchmarks (ToolAlpaca, [ToolBench](https://www.edgepedia.org/toolbench), BFCL v1) to BFCL v2/v3 with multi-turn interactions and state management, NESTFUL with dependent calls, and Complex FuncBench with implicit parameter inference.[11](https://aclanthology.org/2026.findings-acl.1330.pdf) A 2026 survey of agent evaluation across five perspectives, including core agentic capabilities and application-specific web and software-engineering benchmarks, finds that even state-of-the-art models struggle with long-horizon planning.[11](https://aclanthology.org/2026.findings-acl.1330.pdf)\n\nReported 2026 scores, compiled from Stanford HAI's AI Index, put agent success at 77.3% on [Terminal-Bench](https://www.edgepedia.org/terminal-bench), up from 20% in 2025, with cybersecurity-task success climbing from 15% in 2024 to 93%; OSWorld computer-use passes reached 66.3% and WebArena 74.3%, while robot performance on real household tasks remains at 12%.[5](https://www.digitalapplied.com/blog/state-of-ai-agents-2026-200-data-points) On Humanity's Last Exam, the model powering ChatGPT agent scores a pass@1 of 41.6, rising to 44.4 when running up to eight parallel attempts and selecting the highest self-reported confidence.[12](http://openai.com/index/introducing-chatgpt-agent)\n\n## By the numbers\n\n**Token multipliers.** Published token multipliers for agentic patterns versus single-shot retrieval range from 2.6x on a general benchmark to 7.8x on a finance corpus, figures their compiler treats as the most defensible because they come from disclosed benchmarks with stated token counts.[13](https://davidsoden.com/downloads/unit-economics-agentic-ai.pdf) In Anthropic's account data, agents used about 4x the tokens of chats and multi-agent systems about 15x, though the comparison baseline is chats rather than single-agent runs, and token ratios are not dollar ratios; cost per outcome should also include failed attempts, retries, paid tools, orchestration infrastructure, and human review.[3](https://ganivra.com/blog/ai-agent-statistics) AGENCYBENCH quantifies the workload directly: its 32 real-world scenarios, comprising 138 tasks, require an average of 90 tool calls, 1 million tokens, and hours of execution time to resolve.[4](https://aclanthology.org/2026.acl-long.337.pdf)\n\n**Cost structure.** OpenAI charges only for tokens used when importing tool definitions or making tool calls, with no additional per-tool-call fees, but exposing dozens of tools raises cost and latency, so an allowed_tools parameter imports only a subset.[14](https://developers.openai.com/api/docs/guides/tools-connectors-mcp) EY estimates the cost of a single customer service interaction at $0.04 in 2023 rising to $1.20 in 2026, about 30x higher, and independent measurement puts the price of reaching a given capability milestone falling by roughly 9x to 900x per year depending on the benchmark.[13](https://davidsoden.com/downloads/unit-economics-agentic-ai.pdf) Anthropic's Claude Opus 4.8 defaults to a high effort level, with extra and max tiers that spend more tokens for better results, and [Claude Code](https://www.edgepedia.org/claude-code) rate limits were increased to accommodate the higher token usage of long-running agentic workflows.[15](https://www.anthropic.com/research/claude-opus-4-8)\n\n**Market and adoption.** The AI agent platform market generated $7.8 billion of vendor revenue in 2025 and is projected to reach $68.96 billion by 2034, a 27.4% CAGR; multi-agent systems are the fastest-growing segment at 33.0% per year.[7](https://dataintelo.com/report/ai-agent-platform-market)\n\n## Major platforms and frameworks\n\nBy offering ready-made abstractions, an AI agent framework lets developers construct and run systems that pursue goals with the help of models, tools, state, and control logic, covering features such as agent loops, tool registration, handoffs, graph execution, session state, durable checkpoints, memory, human approval, deployment, tracing, and evaluation.[16](https://arize.com/ai-agents/agent-frameworks/) Frameworks fall into four layers: agent SDKs ([OpenAI Agents SDK](https://www.edgepedia.org/openai-agents-sdk), CrewAI, Pydantic AI, Strands), orchestration runtimes ([LangGraph](https://www.edgepedia.org/langgraph), LlamaIndex Workflows), agent harnesses ([Claude Agent SDK](https://www.edgepedia.org/claude-agent-sdk), Microsoft Agent Framework Agent Harness, Mastra), and managed platforms (Amazon Bedrock AgentCore).[16](https://arize.com/ai-agents/agent-frameworks/) Within them, LangGraph uses explicit nodes, edges, state transitions, and checkpoints and fits complex durable workflows mixing deterministic and model-directed steps; CrewAI combines role-based crews with stateful flows; Pydantic AI is a type-safe Python framework offering durable execution through Temporal, DBOS, Prefect, or Restate.[16](https://arize.com/ai-agents/agent-frameworks/)\n\nAutoGen, an open-source multi-agent framework from Microsoft with roughly 46,000 stars, has been placed into maintenance; taking its place is the Microsoft Agent Framework (MAF 1.0, which came out in early 2026), which is built atop the Agent-to-Agent (A2A) protocol and puts a focus on distributed systems.[17](https://thellms.dev/diff/llm-agent-frameworks-compared-langchain-crewai-autogen-openai-agents-sdk/)\n\n**Interoperability protocols.** MCP is an open protocol, developed by [Anthropic](https://www.edgepedia.org/anthropic), for integrating LLM applications with external data sources and tools, using JSON-RPC 2.0 messages between hosts, clients, and servers.[8](https://modelcontextprotocol.io/specification/draft.md) Its core primitives are tools, resources, and prompts, with associated discovery and retrieval methods and, in some cases, execution methods such as tools/call, layered into a data layer over JSON-RPC and a transport layer handling connections, framing, and authorization.[18](https://modelcontextprotocol.io/specification/2025-06-18/basic) Google Cloud hosts remote MCP servers supporting version 2025-11-25 of the protocol and offers toolsets, logical groups of tools with their own HTTP endpoints, to limit what is loaded into an agent's context.[19](https://docs.cloud.google.com/mcp/overview) Open protocols for tool access and agent-to-agent communication came under [Linux Foundation](https://www.edgepedia.org/linux-foundation) governance in December 2025.[7](https://dataintelo.com/report/ai-agent-platform-market)\n\n## Recent developments\n\nThe period since late 2023 moved the field from chatbots toward systems that act. OpenAI's CUA introduced pixel-level computer control,[9](https://openai.com/index/computer-using-agent/) and ChatGPT agent later unified Operator's website interaction, deep research's synthesis, and conversational ChatGPT, with a visual browser, a text-based browser, a terminal, and direct API access as tools.[12](http://openai.com/index/introducing-chatgpt-agent) Microsoft's Fara1.5 extended the computer-use family as research-preview models.[10](https://www.microsoft.com/en-us/research/articles/fara1-5-computer-use-agent/)\n\nStandardization followed. MCP grew from a protocol specification into opt-in extensions negotiated during initialization, including Tasks for asynchronous long-running operations with polling and durable handles, Skills over MCP, and MCP Apps for inline UI elements.[8](https://modelcontextprotocol.io/specification/draft.md) [Evaluation](https://www.edgepedia.org/evaluation) changed in parallel: recent agentic benchmarks require longer interactions and scale the number of domains and tools by sourcing them from real MCP servers (Anthropic, November 2024), a shift toward more realistic, continuously updated benchmarks.[11](https://aclanthology.org/2026.findings-acl.1330.pdf) [Governance](https://www.edgepedia.org/governance) of the underlying protocols moved to the Linux Foundation in December 2025.[7](https://dataintelo.com/report/ai-agent-platform-market)\n\n## Applications and deployment\n\nEnterprise deployment concentrates on constrained patterns rather than full autonomy. Gartner CIO survey data indicates about 17–23% of enterprise deployments run agents in sandboxed multi-step modes with a single human handoff, the dominant production pattern being one turn of tool use followed by human review.[5](https://www.digitalapplied.com/blog/state-of-ai-agents-2026-200-data-points) A March 2026 enterprise survey found 27% of firms orchestrating multiple agents across their business, but only 11% had reached the stage of scaling agents, a gap between experimentation and production.[7](https://dataintelo.com/report/ai-agent-platform-market) Thoughtworks reports that use of multi-agent systems built on domain intelligence grew by 327% in four months as enterprises moved from single chatbots to multi-agent systems.[20](https://www.thoughtworks.com/content/dam/thoughtworks/documents/e-book/State-of-AI-Agents-2026-020426.pdf)\n\nOperational guardrails follow from the tooling requirements agents impose: typed tool schemas, authentication, timeouts and retries, human approval before sensitive actions, sandboxing for code, shell, browser, and file operations, MCP servers, and tool-call tracing.[16](https://arize.com/ai-agents/agent-frameworks/)\n\n## Safety, security, and governance\n\n**Prompt injection.** OWASP's 2025 LLM Top 10 defines a prompt injection vulnerability as user prompts that alter the LLM's behavior or output in unintended ways, including inputs imperceptible to humans, because injections need only be parsed by the model, not human-readable.[21](https://owasp.org/www-project-top-10-for-large-language-model-applications/assets/PDF/OWASP-Top-10-for-LLMs-v2025.pdf) In agentic systems the stakes rise because injected instructions can steer tool calls with real-world effects; Microsoft identifies prompt injections and online scams as external risks for computer-use agents, which take actions with real-world consequences, and keeps Fara1.5 a research preview.[10](https://www.microsoft.com/en-us/research/articles/fara1-5-computer-use-agent/)\n\n**Agentic risk taxonomy.** The OWASP Top 10 for Agentic Applications, released December 2025, defines ten risks ASI01–ASI10 specific to autonomous agent systems. Named examples include EchoLeak (agent goal hijack via hidden prompts, ASI01), Amazon Q (tool misuse), the GitHub MCP exploit (agentic supply chain), AutoGPT RCE (unexpected code execution), and the Gemini Memory Attack (memory poisoning, ASI06); the taxonomy also covers identity and privilege abuse, insecure inter-agent communication, cascading failures, human-agent trust exploitation, and misalignment.[22](https://genai.owasp.org/2025/12/09/owasp-top-10-for-agentic-applications-the-benchmark-for-agentic-security-in-the-age-of-autonomous-ai/) Human-in-the-loop controls, a key defense for LLM applications, face new attack vectors in agentic AI where attackers can overwhelm HITL review with complex interactions, especially in multi-agent architectures.[1](https://genai.owasp.org/download/45674/?tmstv=1739819891)\n\n**Mitigations.** The plan-then-execute pattern lets an agent commit to a fixed action plan before execution, so untrusted third-party tool outputs cannot inject instructions that deviate the agent from its plan; it acts as a form of control-flow integrity protection but does not prevent injections contained in the user prompt itself.[23](https://arxiv.org/pdf/2506.08837v1) The MCP specification states that tool descriptions and annotations should be considered untrusted unless obtained from a trusted server, and that hosts must obtain explicit user consent before invoking any tool.[8](https://modelcontextprotocol.io/specification/draft.md) Google Cloud applies IAM policies for fine-grained authorization over MCP tool use and uses Model Armor to sanitize MCP calls and responses against prompt injection, sensitive data disclosure, and tool poisoning.[19](https://docs.cloud.google.com/mcp/overview) Microsoft's Agent Governance Toolkit maps each ASI risk to mitigation patterns, for example ASI01 Agent Goal Hijack to input and output policies, prompt-injection detection, and audit controls, and ASI02 Tool Misuse to a manifest tool catalog, pre_tool_call hooks, and sandbox controls.[24](https://microsoft.github.io/agent-governance-toolkit/compliance/owasp-agentic-top10-architecture/) Thoughtworks positions unified governance, defining how data is used and setting guardrails and rate limits, as the precondition for deploying agentic systems at scale.[20](https://www.thoughtworks.com/content/dam/thoughtworks/documents/e-book/State-of-AI-Agents-2026-020426.pdf)\n\n## Limits\n\nThe evidence points to long-horizon coherence as the binding constraint: even state-of-the-art models struggle with long-horizon planning,[11](https://aclanthology.org/2026.findings-acl.1330.pdf) and the predominant AgentBench failure was running past the task limit rather than producing a wrong answer,[6](https://arxiv.org/abs/2308.03688) which matches the deployment gap between orchestrating agents (27% of firms) and scaling them (11%).[7](https://dataintelo.com/report/ai-agent-platform-market) Cost compounds with horizon: token multipliers of 2.6x to 7.8x over single-shot retrieval, and up to 15x for multi-agent systems versus chats, mean each additional step of autonomy buys capability at a multiplying price.[13](https://davidsoden.com/downloads/unit-economics-agentic-ai.pdf) • [3](https://ganivra.com/blog/ai-agent-statistics)\n\n## References\n\n1. [Agentic AI – Threats and Mitigations, OWASP Gen AI Security Project](https://genai.owasp.org/download/45674/?tmstv=1739819891)\n2. [From language to action: a review of large language models as autonomous agents and tool users, Artificial Intelligence Review (Springer)](https://link.springer.com/article/10.1007/s10462-025-11471-9)\n3. [AI Agent Statistics: Adoption, Costs, and Business Value in 2026, Ganivra](https://ganivra.com/blog/ai-agent-statistics)\n4. [AGENCYBENCH: Benchmarking the Frontiers of Autonomous Agents in 1M-Token Real-World Contexts, ACL 2026](https://aclanthology.org/2026.acl-long.337.pdf)\n5. [State of AI Agents 2026: 200+ Data Points Compiled, Digital Applied](https://www.digitalapplied.com/blog/state-of-ai-agents-2026-200-data-points)\n6. [AgentBench: Evaluating LLMs as Agents, arXiv](https://arxiv.org/abs/2308.03688)\n7. [AI Agent Platform Market Size, Share & Forecast Report 2025 to 2034, Dataintelo](https://dataintelo.com/report/ai-agent-platform-market)\n8. [MCP Specification (draft) – Security and Trust Considerations](https://modelcontextprotocol.io/specification/draft.md)\n9. [Computer-Using Agent, OpenAI](https://openai.com/index/computer-using-agent/)\n10. [Fara1.5 – A family of frontier computer use agent models, Microsoft Research](https://www.microsoft.com/en-us/research/articles/fara1-5-computer-use-agent/)\n11. [A Survey on Evaluation of LLM-based Agents, ACL Findings 2026](https://aclanthology.org/2026.findings-acl.1330.pdf)\n12. [Introducing ChatGPT agent, OpenAI](http://openai.com/index/introducing-chatgpt-agent)\n13. [The Unit Economics of Agentic AI, David Soden](https://davidsoden.com/downloads/unit-economics-agentic-ai.pdf)\n14. [MCP tool – OpenAI API documentation](https://developers.openai.com/api/docs/guides/tools-connectors-mcp)\n15. [Introducing Claude Opus 4.8, Anthropic](https://www.anthropic.com/research/claude-opus-4-8)\n16. [AI agent frameworks compared: LangGraph, CrewAI, AutoGen, and more, Arize](https://arize.com/ai-agents/agent-frameworks/)\n17. [LLM agent frameworks compared: LangChain, CrewAI, AutoGen, OpenAI Agents SDK, thellms.dev](https://thellms.dev/diff/llm-agent-frameworks-compared-langchain-crewai-autogen-openai-agents-sdk/)\n18. [Model Context Protocol Specification (2025-06-18)](https://modelcontextprotocol.io/specification/2025-06-18/basic)\n19. [Google Cloud MCP servers overview](https://docs.cloud.google.com/mcp/overview)\n20. [State of AI Agents 2026, Thoughtworks](https://www.thoughtworks.com/content/dam/thoughtworks/documents/e-book/State-of-AI-Agents-2026-020426.pdf)\n21. [OWASP Top 10 for LLM Applications 2025](https://owasp.org/www-project-top-10-for-large-language-model-applications/assets/PDF/OWASP-Top-10-for-LLMs-v2025.pdf)\n22. [OWASP Top 10 for Agentic Applications, OWASP Gen AI Security Project](https://genai.owasp.org/2025/12/09/owasp-top-10-for-agentic-applications-the-benchmark-for-agentic-security-in-the-age-of-autonomous-ai/)\n23. [Design Patterns for Securing LLM Agents against Prompt Injection, arXiv](https://arxiv.org/pdf/2506.08837v1)\n24. [OWASP Agentic Security Initiative Reference Architecture – Agent Governance Toolkit, Microsoft](https://microsoft.github.io/agent-governance-toolkit/compliance/owasp-agentic-top10-architecture/)\n\n---\n*Topic: Encyclopedia › Technology and the built world › Computing and digital systems › Modern AI: foundation models, generative AI, and the AI industry › AI companies, people, and products › AI products and assistants › AI agents and developer tools*\n\n*Initially written Sep 17, 2026 · Reviewed: Sep 30, 2026; Oct 15, 2026 · Edited: Sep 30, 2026; Oct 15, 2026 · Last review: Oct 15, 2026*\n\n*Copyright 2026 EdgeChat AI, a subsidiary of Biostate AI.*\n\nLicense: Edgepedia Community License 1.0, https://www.edgepedia.org/edgepedia/license\n", "same_as": [], "url": "https://www.edgepedia.org/ai-agent", "markdown_url": "https://www.edgepedia.org/ai-agent.md", "license": { "name": "Edgepedia Community License 1.0", "url": "https://www.edgepedia.org/edgepedia/license", "summary": "Free with credit, commercial use included. AI training is open to everyone. For other uses, organizations over USD 100M in revenue or 100M monthly users license separately.", "spdx": "LicenseRef-Edgepedia-Community-1.0" }, "credit": "\"AI agent\", Edgepedia (EdgeChat), https://www.edgepedia.org/ai-agent. Edgepedia Community License 1.0.", "credit_md": "\"[AI agent](https://www.edgepedia.org/ai-agent)\", Edgepedia (EdgeChat), [https://www.edgepedia.org/ai-agent](https://www.edgepedia.org/ai-agent). [Edgepedia Community License 1.0](https://www.edgepedia.org/edgepedia/license).", "credit_html": "\"AI agent\", Edgepedia (EdgeChat), https://www.edgepedia.org/ai-agent. Edgepedia Community License 1.0.", "speakable": "An AI agent, also called an LLM agent, is a software system that uses a large language model to reason, choose tools, and take autonomous actions." }