Agentic fraud

AI agent

Software built on an artificial intelligence (AI) model that takes a goal from a person, works out the steps, and carries them out by using other tools and services, such as searching the web, filling in forms, or making a payment, with limited human input along the way.

Asked to book a table for four on Friday, a chatbot suggests restaurants and leaves the booking to the person. An agent checks availability, makes the reservation, and adds it to the person's calendar. Other agents answer support tickets, reconcile invoices, or reorder groceries within a budget.

A system that wraps a large language model (LLM) or other AI model in a loop that lets it plan, call external tools such as application programming interfaces (APIs) and browsers, read the results, and choose its next action until it meets the goal, hits a limit, or hands control back to a person. Two capabilities separate an agent from a chatbot or assistant: it acts on outside systems instead of only producing text, and it chooses its own sequence of steps instead of following a fixed script.

An agent typically works through a loop:

It receives a goal and its limits, such as a budget or a list of tools it may use.
It breaks the goal into steps and decides which to take first.
It calls a tool, such as a search engine, a calendar, or a payment service.
It reads the result, updates its plan, and repeats until the goal is met, a limit is reached, or an action needs a person's approval.

Most agents share a few building blocks:

Model, the AI model that reasons about the goal and decides what to do next.
Tools, the services the agent may call. Open protocols such as the Model Context Protocol (MCP) and the Agent2Agent (A2A) protocol standardize how agents connect to tools and to each other.
Memory, which keeps context across steps or sessions.
Permissions, which set what the agent may do alone and when it must stop and ask a person, an arrangement called human-in-the-loop.

An AI agent sits next to terms that are easy to mix up:

Chatbot or AI assistant responds with text or suggestions, and a person still takes the action. Some products sold as assistants can act, which makes them agents in practice.
Robotic process automation (RPA) follows rules written in advance for one fixed task, while an agent decides its own steps and adapts when something changes.
Agentic identity ties an agent to a verified owner and the scope it may act within.
Agentic fraud describes agents used to commit crime.
Agent washing is marketing an ordinary chatbot or automation tool as an agent.

For more, see The Agentic Fraud Report.

Why it matters

An agent turns a model's output into real actions, so its mistakes have real consequences. A chatbot that misreads a request gives a wrong answer, while an agent that misreads it can spend money, share data, or change an account. Attacks such as prompt injection, which hides instructions in content the agent reads, can turn that access against the person who set it up.

Identity checks built for people assume someone is present to type a password, approve a prompt, or take a selfie. An agent acting on its own after one setup step never triggers those checks again. Every bank, merchant, or service it touches has to decide whether to trust a request no human typed, which means knowing which agent is acting, who it acts for, and what that person allowed. Standards bodies now treat this as its own problem: in February 2026 the US National Institute of Standards and Technology (NIST) launched an initiative on agent security and identity.

The label matters commercially too. In June 2025 the research firm Gartner estimated that only about 130 of the thousands of vendors marketing agentic AI offered genuine agent technology. A buyer who cannot tell the difference may pay for autonomy they never get, or underestimate the risk of autonomy they do get.

AI agent

Frequently asked questions