{
  "id": "how-agents-work",
  "module": "agents",
  "level": 2,
  "minutes": 25,
  "audiences": [
    "beginner",
    "developer",
    "researcher"
  ],
  "software": [
    "claude-code",
    "codex",
    "gemini-cli",
    "goose",
    "opencode",
    "cursor"
  ],
  "text": {
    "en": {
      "title": "How AI Agents Work: The Agent Loop, Tools, Planning and Memory",
      "description": "What makes an LLM an agent: the observe–think–act loop, tool calling, planning, memory and context, the environment (sandboxes, browsers, files), workflow patterns vs autonomous agents, and why agents fail.",
      "updated": "2026-10-10",
      "takeaways": [
        "An agent is an LLM running in a loop: it reads the situation, decides on an action (usually a tool call), observes the result and repeats until the goal is met.",
        "The four building blocks are the model, tools, memory/context and a stopping condition with human oversight.",
        "Most production systems are workflows (fixed steps with LLM calls) rather than fully autonomous agents; use autonomy only where flexibility pays for the extra cost and risk.",
        "Agents fail mainly at the software layer: wrong or missing tools, unclear tool descriptions, environment errors and lost context — not only model intelligence."
      ],
      "faq": [
        {
          "q": "What is the difference between a chatbot and an AI agent?",
          "a": "A chatbot answers one message at a time. An agent pursues a goal over many steps, choosing and calling tools (search, code execution, files, APIs) and using their results, often without a human approving each step."
        },
        {
          "q": "What is the ReAct pattern?",
          "a": "ReAct (Reason + Act) interleaves reasoning text with actions: the model writes a thought, calls a tool, reads the observation, writes the next thought, and so on. Most modern agent loops follow this idea, now implemented with native tool calling."
        },
        {
          "q": "Do I need an agent framework?",
          "a": "Not necessarily. A basic agent is a loop of a few dozen lines around a model API with tool calling. Frameworks help with state, tracing, retries and multi-agent setups, but add abstraction; many teams start without one."
        },
        {
          "q": "Are AI agents safe to run on my computer?",
          "a": "Only with limits: run them in a sandbox or container, give the minimum permissions and credentials, require approval for destructive or external actions, and be aware of prompt injection from content they read."
        }
      ],
      "sources": [
        {
          "title": "Anthropic (2024), Building effective agents",
          "url": "https://www.anthropic.com/research/building-effective-agents"
        },
        {
          "title": "Yao et al. (2022), ReAct: Synergizing Reasoning and Acting in Language Models",
          "url": "https://arxiv.org/abs/2210.03629"
        },
        {
          "title": "Schick et al. (2023), Toolformer: Language Models Can Teach Themselves to Use Tools",
          "url": "https://arxiv.org/abs/2302.04761"
        },
        {
          "title": "Shinn et al. (2023), Reflexion: Language Agents with Verbal Reinforcement Learning",
          "url": "https://arxiv.org/abs/2303.11366"
        },
        {
          "title": "Park et al. (2023), Generative Agents: Interactive Simulacra of Human Behavior",
          "url": "https://arxiv.org/abs/2304.03442"
        },
        {
          "title": "Yang et al. (2024), SWE-agent: Agent-Computer Interfaces Enable Automated Software Engineering",
          "url": "https://arxiv.org/abs/2405.15793"
        },
        {
          "title": "Lilian Weng (2023), LLM Powered Autonomous Agents",
          "url": "https://lilianweng.github.io/posts/2023-06-23-agent/"
        },
        {
          "title": "Jimenez et al. (2023), SWE-bench: Can Language Models Resolve Real-World GitHub Issues?",
          "url": "https://arxiv.org/abs/2310.06770"
        }
      ],
      "url": "https://aimap.page/en/learn/agents/how-agents-work/",
      "markdown": "## From answering to acting\n\nA plain LLM turns text into text. An **AI agent** uses an LLM to *pursue a goal* — \"fix this failing test\", \"find three suppliers and compare prices\", \"book a meeting with everyone free on Friday\" — by taking actions in an environment over many steps. Coding agents such as [Claude Code](/apps/claude-code), [Codex](/apps/codex), [Gemini CLI](/apps/gemini-cli), [Goose](/apps/goose) and [OpenCode](/apps/opencode) are today's most widely used examples.\n\n## The agent loop\n\nAt its core every agent is the same loop:\n\n```mermaid\nflowchart TB\n  G[\"Goal + instructions + available tools\"] --> T[\"LLM: think about next step\"]\n  T -->|\"tool call\"| A[\"Execute tool (code, search, file, API, browser)\"]\n  A --> O[\"Observation: tool result or error\"]\n  O --> C[\"Update context / memory\"]\n  C --> T\n  T -->|\"done or needs a human\"| F[\"Final answer / hand-off\"]\n```\n\nThis is the **ReAct** pattern ([Yao et al., 2022](https://arxiv.org/abs/2210.03629)): interleave *reasoning* (\"the test fails because the date is parsed in UTC; let me open the parser\") with *acting* (a tool call) and *observing* the result. Earlier work such as Toolformer ([Schick et al., 2023](https://arxiv.org/abs/2302.04761)) showed models can learn when to call tools; today, models are trained to emit structured **tool calls** natively ([Tool Calling and MCP](/learn/tool-calling-mcp)).\n\nIn code, a minimal agent is surprisingly short:\n\n```python\nmessages = [system_prompt, user_goal]\nwhile True:\n    reply = llm(messages, tools=TOOLS)          # model may request tool calls\n    messages.append(reply)\n    if not reply.tool_calls:                     # no more actions → final answer\n        break\n    for call in reply.tool_calls:\n        result = run_tool(call.name, call.args)  # sandboxed, with permission checks\n        messages.append(tool_result(call.id, result))\n```\n\nEverything else — planning, memory, safety, evaluation — is about making this loop reliable.\n\n## The building blocks\n\n| Block | Role | Examples |\n|---|---|---|\n| **Model** | Decides the next action | Frontier or open models with strong tool use |\n| **Tools** | Act on the world | Shell, code sandbox, file edit, web search, browser, database, SaaS APIs, MCP servers |\n| **Context & memory** | What the model knows right now | System prompt, conversation, retrieved docs, notes files, long-term memory stores |\n| **Planning** | Break goals into steps, recover from errors | Explicit plans/to-do lists, reflection, sub-agents |\n| **Guardrails & oversight** | Limit damage | Sandboxes, permission prompts, budgets, step limits, human approval |\n\n**Planning.** Agents perform better when they write and update an explicit plan, and when they reflect on failures — Reflexion ([Shinn et al., 2023](https://arxiv.org/abs/2303.11366)) stores verbal lessons from failed attempts and retries.\n\n**Memory.** The context window is short-term memory and fills up quickly with tool output. Agents summarise, write notes to files, or retrieve from long-term stores; Generative Agents ([Park et al., 2023](https://arxiv.org/abs/2304.03442)) combined a memory stream with retrieval by recency, importance and relevance. Deciding what goes into the window at each step is often called **context engineering**.\n\n**The environment matters as much as the model.** SWE-agent ([Yang et al., 2024](https://arxiv.org/abs/2405.15793)) showed that giving a model a purpose-built *agent–computer interface* — concise file viewer, search and edit commands with clear feedback — substantially improved its results on [SWE-bench](https://arxiv.org/abs/2310.06770) compared with a raw shell.\n\n## Workflows vs agents\n\nAnthropic's widely cited guide ([Building effective agents](https://www.anthropic.com/research/building-effective-agents)) distinguishes:\n\n- **Workflows** – LLM calls orchestrated along predefined code paths: *prompt chaining*, *routing*, *parallelisation*, *orchestrator–workers*, *evaluator–optimiser*.\n- **Agents** – the LLM dynamically directs its own process and tool use.\n\nIts advice: start with the simplest thing that works, and add autonomy only when the task genuinely needs flexible, multi-step decisions — agents cost more tokens, are slower and can compound errors.\n\n## Why agents fail\n\nBenchmarks on real tasks (see [Evaluating Agents](/learn/agent-evaluation)) and practitioner reports point to recurring failure causes, many of them in the **software layer** rather than the model:\n\n- **Tool selection**: the right tool is missing, or too many similar tools confuse the model.\n- **Tool descriptions and errors**: vague parameter docs, unhelpful error messages, outputs too large for the context.\n- **Environment**: missing dependencies, authentication walls, CAPTCHAs, changing GUIs.\n- **Long horizons**: small error rates per step compound over dozens of steps; context is lost or polluted.\n- **Security**: content the agent reads can contain instructions that hijack it ([Prompt Injection](/learn/prompt-injection)).\n\nThis is why the software an agent calls — and how well it is described, permissioned and tested — matters so much, and why this site documents software from an agent's point of view.\n\n## Next\n\nLearn the mechanics of tool use in [Tool Calling and MCP](/learn/tool-calling-mcp), then continue with [Planning and Memory](/learn/planning-memory), [A2A and Multi-agent Systems](/learn/a2a-multi-agent) and [Sandboxes, Browsers and Computer Use](/learn/agent-sandbox) (in progress)."
    },
    "zh-hans": {
      "title": "AI Agent 工作原理：智能体循环、工具、规划与记忆",
      "description": "大模型怎样变成 Agent：观察—思考—行动循环、工具调用、规划、记忆与上下文、运行环境（沙箱、浏览器、文件），工作流模式与自主 Agent 的区别，以及 Agent 为什么会失败。",
      "updated": "2026-10-10",
      "takeaways": [
        "Agent 就是在循环里运行的大模型：读取当前情况，决定一个动作（通常是调用工具），观察结果，重复直到目标完成。",
        "四个基本组件：模型、工具、记忆与上下文，以及带人工监督的停止条件。",
        "大多数生产系统是工作流（固定步骤里调用大模型），而不是完全自主的 Agent；只有灵活性值得付出额外成本和风险时，才用自主模式。",
        "Agent 失败主要发生在软件层：工具缺失或选错、工具说明不清、环境报错、上下文丢失，而不只是模型不够聪明。"
      ],
      "faq": [
        {
          "q": "聊天机器人和 AI Agent 有什么区别？",
          "a": "聊天机器人一次回答一条消息。Agent 会为一个目标连续执行多个步骤，自己选择并调用工具（搜索、执行代码、读写文件、调用 API），利用工具结果继续推进，往往不需要人逐步确认。"
        },
        {
          "q": "ReAct 模式是什么？",
          "a": "ReAct（推理 + 行动）让推理文字和动作交替进行：模型先写一段思考，调用工具，读取观察结果，再写下一段思考，如此往复。现在大多数 Agent 循环都沿用这个思路，只是改用了原生的工具调用。"
        },
        {
          "q": "做 Agent 一定要用框架吗？",
          "a": "不一定。一个基础 Agent 就是围绕支持工具调用的模型 API 写几十行循环代码。框架在状态管理、追踪、重试和多 Agent 编排上有帮助，但也增加了抽象层；很多团队一开始并不用框架。"
        },
        {
          "q": "在自己电脑上运行 AI Agent 安全吗？",
          "a": "必须加限制：在沙箱或容器里运行，只给最小权限和最少的凭证，删除类或对外的操作要人工确认，还要警惕它读到的内容里藏着提示注入。"
        }
      ],
      "sources": [
        {
          "title": "Anthropic（2024），Building effective agents",
          "url": "https://www.anthropic.com/research/building-effective-agents"
        },
        {
          "title": "Yao 等（2022），ReAct: Synergizing Reasoning and Acting in Language Models",
          "url": "https://arxiv.org/abs/2210.03629"
        },
        {
          "title": "Schick 等（2023），Toolformer: Language Models Can Teach Themselves to Use Tools",
          "url": "https://arxiv.org/abs/2302.04761"
        },
        {
          "title": "Shinn 等（2023），Reflexion: Language Agents with Verbal Reinforcement Learning",
          "url": "https://arxiv.org/abs/2303.11366"
        },
        {
          "title": "Park 等（2023），Generative Agents: Interactive Simulacra of Human Behavior",
          "url": "https://arxiv.org/abs/2304.03442"
        },
        {
          "title": "Yang 等（2024），SWE-agent: Agent-Computer Interfaces Enable Automated Software Engineering",
          "url": "https://arxiv.org/abs/2405.15793"
        },
        {
          "title": "Lilian Weng（2023），LLM Powered Autonomous Agents",
          "url": "https://lilianweng.github.io/posts/2023-06-23-agent/"
        },
        {
          "title": "Jimenez 等（2023），SWE-bench: Can Language Models Resolve Real-World GitHub Issues?",
          "url": "https://arxiv.org/abs/2310.06770"
        }
      ],
      "url": "https://aimap.page/zh-hans/learn/agents/how-agents-work/",
      "markdown": "## 从“回答”到“行动”\n\n普通大模型把文字变成文字。**AI Agent（智能体）**则用大模型去*完成一个目标*，比如“修好这个失败的测试”“找三家供应商比价”“约周五都有空的人开会”，在一个环境里分很多步采取行动。[Claude Code](/apps/claude-code)、[Codex](/apps/codex)、[Gemini CLI](/apps/gemini-cli)、[Goose](/apps/goose)、[OpenCode](/apps/opencode) 这些编程 Agent 是目前用得最广的例子。\n\n## 智能体循环\n\n所有 Agent 的核心都是同一个循环：\n\n```mermaid\nflowchart TB\n  G[\"目标 + 指令 + 可用工具\"] --> T[\"大模型：思考下一步\"]\n  T -->|\"调用工具\"| A[\"执行工具（代码、搜索、文件、API、浏览器）\"]\n  A --> O[\"观察：工具结果或报错\"]\n  O --> C[\"更新上下文 / 记忆\"]\n  C --> T\n  T -->|\"完成，或需要人介入\"| F[\"最终答案 / 交给人\"]\n```\n\n这就是 **ReAct** 模式（[Yao 等，2022](https://arxiv.org/abs/2210.03629)）：*推理*（“测试失败是因为日期按 UTC 解析了，我去看看解析器”）、*行动*（一次工具调用）和*观察*结果交替进行。Toolformer（[Schick 等，2023](https://arxiv.org/abs/2302.04761)）等早期工作证明模型能学会何时调用工具；如今的模型经过训练，可以原生输出结构化的**工具调用**（见 [工具调用与 MCP](/learn/tool-calling-mcp)）。\n\n写成代码，一个最小的 Agent 短得出人意料：\n\n```python\nmessages = [system_prompt, user_goal]\nwhile True:\n    reply = llm(messages, tools=TOOLS)          # 模型可能请求调用工具\n    messages.append(reply)\n    if not reply.tool_calls:                     # 不再行动 → 给出最终答案\n        break\n    for call in reply.tool_calls:\n        result = run_tool(call.name, call.args)  # 在沙箱中执行，并做权限检查\n        messages.append(tool_result(call.id, result))\n```\n\n其余的一切，规划、记忆、安全、评估，都是为了让这个循环更可靠。\n\n## 基本组件\n\n| 组件 | 作用 | 例子 |\n|---|---|---|\n| **模型** | 决定下一步做什么 | 工具调用能力强的前沿模型或开源模型 |\n| **工具** | 对外部世界采取行动 | 终端、代码沙箱、文件编辑、网页搜索、浏览器、数据库、SaaS API、MCP 服务器 |\n| **上下文与记忆** | 模型此刻知道什么 | 系统提示、对话、检索到的文档、笔记文件、长期记忆库 |\n| **规划** | 把目标拆成步骤，从错误中恢复 | 明确的计划或待办清单、反思、子 Agent |\n| **护栏与监督** | 控制损害范围 | 沙箱、权限确认、预算、步数上限、人工审批 |\n\n**规划。**Agent 写下并不断更新一份明确的计划，并对失败做反思，效果会更好。Reflexion（[Shinn 等，2023](https://arxiv.org/abs/2303.11366)）会把失败尝试中总结出的教训用文字存下来，再重新尝试。\n\n**记忆。**上下文窗口就是短期记忆，很快会被工具输出塞满。Agent 会做摘要、把笔记写进文件，或从长期记忆库中检索。Generative Agents（[Park 等，2023](https://arxiv.org/abs/2304.03442)）把记忆流和按“新近度、重要性、相关性”检索结合起来。每一步该把什么放进上下文窗口，常被称为**上下文工程**。\n\n**环境和模型一样重要。**SWE-agent（[Yang 等，2024](https://arxiv.org/abs/2405.15793)）发现，给模型一个专门设计的“Agent-计算机接口”（简洁的文件查看器、搜索和编辑命令，并且反馈清晰），比直接给它一个原始终端，在 [SWE-bench](https://arxiv.org/abs/2310.06770) 上的成绩明显更好。\n\n## 工作流与 Agent\n\nAnthropic 被广泛引用的指南（[Building effective agents](https://www.anthropic.com/research/building-effective-agents)）区分了两类系统：\n\n- **工作流**：沿着预先写好的代码路径编排多次大模型调用，包括*提示链*、*路由*、*并行化*、*编排者-执行者*、*评估者-优化者*。\n- **Agent**：由大模型动态决定自己的流程和工具使用。\n\n它的建议是：从最简单可行的方案开始，只有任务真正需要灵活的多步决策时才增加自主性。Agent 消耗更多 token、更慢，而且错误会累积。\n\n## Agent 为什么会失败\n\n真实任务基准（见 [Agent 评估](/learn/agent-evaluation)）和一线经验都指向一些反复出现的失败原因，其中很多在**软件层**，而不在模型本身：\n\n- **选工具**：需要的工具不存在，或者相似的工具太多让模型选错。\n- **工具说明与报错**：参数文档含糊、报错信息没用、输出太大塞不进上下文。\n- **环境**：缺少依赖、登录墙、验证码、界面变化。\n- **长链条任务**：每一步的小错误在几十步里不断累积；上下文丢失或被污染。\n- **安全**：Agent 读到的内容里可能藏着劫持它的指令（见 [提示注入与工具投毒](/learn/prompt-injection)）。\n\n正因为如此，Agent 调用的软件本身，包括说明写得好不好、权限怎么给、有没有经过测试，都非常重要；这也是本站从 Agent 的视角整理软件档案的原因。\n\n## 下一步\n\n在 [工具调用与 MCP](/learn/tool-calling-mcp) 里学习工具调用的具体机制，然后继续 [Agent 的规划与记忆](/learn/planning-memory)、[A2A 与多 Agent 协作](/learn/a2a-multi-agent)、[代码沙箱、浏览器与电脑操作](/learn/agent-sandbox)（编写中）。"
    }
  }
}