Agentic AI

Agentic AI describes systems that pursue a goal through autonomous, multi-step action rather than a single one-shot answer. An agentic system plans, invokes tools, observes the results, makes decisions, and adapts its next step based on what it learns — looping until the task is done or it needs human input.

What separates agentic from one-shot AI

• Planning and decomposition — breaking a goal into sub-tasks instead of answering immediately.
• Tool use — calling external functions, APIs, and data sources to act on the world (see function calling).
• Iteration with feedback — using the output of one action to decide the next, rather than committing to a fixed script.
• Some autonomy and memory — operating with limited supervision and carrying context across steps.

The building blocks come straight from the agent ecosystem: function calling / tool use is how the model actually invokes a capability; the Model Context Protocol standardizes how those tools and data sources are discovered and connected; and Agent2Agent (A2A) lets independent agents coordinate. In practice an AI agent uses MCP to reach its tools and A2A to delegate to peers.

Why it matters for security and operations Autonomy is exactly what makes agentic AI useful and risky. An agent that can read files, send messages, or execute commands inherits the blast radius of those capabilities — and untrusted tool descriptions or tool outputs can hijack its behavior through prompt injection. Treat agentic systems with least-privilege credentials, human-in-the-loop approval for irreversible actions, and sandboxing. The MCP Security Risks post covers the concrete attack classes (tool poisoning, confused-deputy, rug pulls), and Claude Cowork looks at autonomous desktop agents from an MSP angle.

For orchestration patterns see Claude Code Dynamic Workflows and the Claude Agent SDK guide.