The loop

One tool press is not yet an agent. What makes an agent is doing it in a loop.

The cycle has three beats. Observe: the application gives the model the task and relevant results. Decide: the model proposes an answer or a tool request. Act: the application validates an allowed request, runs the tool, and adds the result. Then the cycle can repeat.

The application owns the stopping rule. It may accept a final answer, stop after a step limit, pause for approval, or halt when validation fails.

And it can go around many times. A single request like "research this and write me a summary" might spin the loop a dozen times: search, read a result, search again to check it, open a document, pull a figure, cross-check it elsewhere, then finally write. Each lap feeds the next. This is what lifts an agent above a single reply. It can follow a thread through the world, gathering and testing as it goes, instead of answering in one breath from frozen memory.

But look closely at that loop and you can already see the danger built into it. Every lap is a fresh chance to go wrong, and worse, a wrong turn early does not stay put. The result of a bad step lands on the board, and the next lap builds on it as if it were true. A small slip at step three can steer every step after it, with nothing in the loop to flag it. And unless someone deliberately puts a human in the loop, nobody is checking between the laps.