AI Agents (500 Questions)

This deck walks you through the core ideas behind autonomous AI agents — from what makes them different from a regular chatbot, to how they observe, reason, and act in a loop. You'll explore foundational concepts like tool use, grounding, and autonomy, then move into more architectural ideas such as single-agent versus multi-agent setups, orchestration patterns, and widely used frameworks like LangGraph and AutoGen. It's a great way to build a clear mental model of how modern agentic systems are designed and put together.

The deck is well suited for developers getting started with agentic AI, computer science students exploring applied AI topics, or technically curious professionals who want a structured vocabulary for discussing agents. If you're new to the field, the cards start with the basics and build up gradually, so you don't need prior hands-on experience to follow along. If you've already built a few agents, the deck can still serve as a handy refresher on terminology and patterns.

To get the most from these cards, try to connect each concept to a concrete example or system you know — for instance, thinking about where the observe-think-act loop shows up in a real workflow. Space out your review sessions over a few days rather than cramming, since the ideas build on each other and benefit from spaced repetition. When you hit framework-related cards, it can also help to peek at the official documentation in parallel, so the term sticks alongside a real tool you can experiment with later.

An AI agent is an autonomous software system that perceives its environment, reasons about goals, and takes actions without continuous human intervention. Unlike a simple chatbot that merely responds to individual prompts, an AI agent can autonomously plan, use tools, maintain state across interactions, and execute multi-step actions to achieve a higher-level objective. The four core capabilities that distinguish an agent are perception (sensing the environment), reasoning (planning and deciding), action (executing tasks), and learning (improving over time based on experience).

The heartbeat of every agent is the observe-think-act loop, a cycle in which the agent observes its environment, reasons about what to do, acts on that decision, observes the result, and then repeats. This loop is implemented at runtime by an agent executor that receives LLM outputs, executes any tool calls, and feeds results back into the model. The degree to which the agent can make decisions and take actions without requiring human approval at each step is referred to as its autonomy. Grounding, the practice of connecting responses to real-world data sources and verified information, is essential to reducing hallucination and ensuring the agent's outputs are trustworthy.

An agent's cognitive architecture is composed of several key components: an LLM backbone, tool integrations, a memory system, a planning module, an execution engine, and safety guardrails. The agent operates within an action space — the set of all possible actions it can take, including tool calls, API requests, code execution, and text generation. Throughout execution, the agent maintains a working memory area called a scratchpad, where it records intermediate thoughts, observations, and tool results. Compared to a fixed pipeline that always follows the same sequence of steps, an agent dynamically decides what steps to take based on intermediate results, allowing it to adapt to new information as it emerges.

Modern LLM-based agents extend their capabilities far beyond text generation through tool use — the ability to invoke external tools such as APIs, code interpreters, databases, and web browsers. Function calling is the underlying mechanism: the LLM outputs structured JSON matching a predefined tool schema, which the system then executes, rather than producing free-form text. Structured output following a JSON or XML schema is parseable by code, in contrast to free-form natural language output. This tooling capability allows agents to perform actions like reading files, querying databases, and calling APIs in service of higher-level goals.

The ReAct pattern combines reasoning and acting by interleaving chain-of-thought reasoning with tool calls and observations. The agent thinks step-by-step, takes an action, observes the result, and continues reasoning. Related prompting strategies enhance this capability: chain-of-thought prompting asks the agent to show its reasoning step by step; tree-of-thought prompting explores multiple reasoning paths simultaneously and selects the best one; the plan-and-solve strategy separates planning from execution by first asking the LLM to produce a plan and then executing it step by step. Structured planning, where the agent outputs an explicit numbered plan in JSON before executing, enables plan validation and editing.

Effective tool use requires careful architecture. A tool registry catalogs all available tools with their descriptions, parameters, and schemas, while dynamic tool selection allows the agent to choose the most appropriate tool based on the current task. Tool-augmented generation enhances LLM output by allowing it to call tools mid-generation to retrieve facts or verify information. Zero-shot tool use enables an agent to correctly use a tool it has not been specifically trained on, based only on the tool's description, while few-shot prompting provides example interactions that demonstrate proper tool usage. To avoid overwhelming the context window, agents often employ an observation budget, limiting how much output from each tool call the agent processes.

AI agents require memory to maintain context across interactions, learn from past experiences, recall user preferences, and avoid repeating mistakes. Memory is generally classified into several types: short-term memory, which is the active context window contents including the current conversation and recent tool results; long-term memory, which persists across sessions and includes user preferences, learned facts, and accumulated knowledge; episodic memory, which captures specific past events and interactions; semantic memory, which stores facts and concepts independent of specific episodes; and procedural memory, which holds learned workflows and successful step-by-step procedures. The context window serves as the agent's primary working memory but is limited in size and not persistent, creating the memory bottleneck problem: agents must selectively choose what information to keep, summarize, or retrieve on demand.

The memory lifecycle is governed by three core operations: write (storing new memories), read (retrieving relevant memories), and reflect (synthesizing and consolidating memories). The retrieval pipeline typically proceeds through query embedding, vector similarity search, reranking, filtering, context formatting, and finally injection into the prompt. Cosine similarity between memory embeddings is used to find stored memories most semantically similar to a query. Memory importance scoring assigns significance values so the agent can prioritize critical information, while memory decay mimics human forgetting by gradually reducing the priority of older memories. The recency-relevance tradeoff balances retrieving the most recent memories against the most semantically relevant ones.

Practical memory architectures draw from a rich design space. A memory stream is a chronological log of all observations and actions serving as raw data for retrieval and consolidation. Generative Agents research combined a memory stream with retrieval based on recency, importance, and relevance, plus reflection to form higher-level insights. Systems like MemGPT (now Letta) tier memory into main context, archival storage, and recall storage, inspired by operating system virtual memory. Other patterns include sliding window memory, hierarchical memory summarization at multiple levels of condensation, and hybrid memory architectures that combine context, retrieval, and parameter-based approaches. Memory pruning removes outdated or low-importance entries, deduplication merges redundant memories, and conflict resolution handles contradictions by preferring more recent or higher-confidence information.

When a single agent becomes insufficient for complex tasks, multi-agent architectures distribute responsibilities across multiple specialized agents. Several coordination patterns have emerged: the supervisor pattern has one agent delegate tasks to worker agents and aggregate their results; the debate pattern has multiple agents argue different positions while a judge selects the best answer; the mixture-of-agents approach uses multiple LLMs to generate candidates and aggregates the best one; and the critic agent pattern adds a secondary reviewer that iterates on the primary agent's output. Agent specialization assigns distinct expertise areas, while agent delegation allows one agent to assign sub-tasks to another with more appropriate skills. An agent swarm takes this further, using many simple agents that achieve complex behavior through emergent coordination without centralized control.

The Model Context Protocol (MCP), introduced by Anthropic, is an open standard for connecting AI agents to external tools and data sources through a unified interface. MCP defines a client-server architecture: AI applications act as clients connecting to MCP servers that expose tools (executable functions), resources (readable data sources), and prompts via a standardized protocol. The key distinction is that tools are actions the agent can execute while resources are data the agent can read for context. MCP supports stdio transport for local processes and HTTP with Server-Sent Events for remote connections, enabling seamless integration with files, databases, and APIs.

Google's Agent-to-Agent (A2A) protocol addresses a different layer: communication between agents themselves rather than between agents and tools. A2A enables peer-to-peer collaboration and task delegation between agents, who discover each other's capabilities through Agent Cards — JSON metadata files describing skills and endpoints. To manage multi-agent systems at scale, orchestration layers coordinate how agents communicate, delegate tasks, share context, and combine outputs. Shared memory patterns and blackboard architectures allow agents to post partial solutions and read each other's contributions, while message passing enables coordination without shared state.

A rich ecosystem of frameworks supports agent development. LangGraph, from the LangChain team, builds stateful multi-step agent workflows as directed graphs with nodes representing actions and edges representing transitions. AutoGen, a Microsoft framework, specializes in multi-agent conversational systems where agents chat with each other to solve tasks. CrewAI orchestrates role-playing agents that work together as a crew with defined roles, goals, and tasks. The OpenAI Agents SDK is an open-source Python library supporting tool use, handoffs, guardrails, and tracing, with handoffs being a mechanism to transfer control between specialized agents. Google's Agent Development Kit (ADK) provides built-in support for multi-agent orchestration and tool use, while Microsoft Semantic Kernel uses plugins (collections of native or LLM functions) and a planner component to create execution plans from available plugins.

Data-focused frameworks add specialized retrieval capabilities. LlamaIndex connects LLMs to external data, often building RAG-powered agents with structured data access through query engines used as tools. Haystack, by deepset, builds production-ready LLM applications including RAG pipelines and modular agents. DSPy algorithmically optimizes LLM prompts and weights, systematically improving agent behavior rather than relying on manual prompt engineering. Lightweight options include smolagents from Hugging Face, which focuses on code-based tool calling where the LLM writes Python code as actions rather than structured JSON. TapeAgents, by ServiceNow, structures computation as a persistent, replayable tape of thoughts, actions, and observations that doubles as execution trace and memory.

Managed cloud platforms abstract away much of the infrastructure. OpenAI's Assistants API provides persistent conversation threads, a sandboxed Code Interpreter tool, file search, and function calling. The newer Responses API combines Chat Completions simplicity with built-in tool support including web search, file search, and computer use. Anthropic offers Claude with function calling plus specialized tools like computer use for GUI control, text_editor for file modifications, and bash for shell execution. Amazon Bedrock Agents orchestrate multi-step tasks using foundation models with enterprise data, while Google's Vertex AI Agent Builder provides a managed platform with Google Cloud integrations.

GitHub Copilot has evolved from inline code completion into a comprehensive agentic coding platform. The foundation is Copilot code completion, which provides real-time ghost text suggestions as developers type. Next Edit Suggestion (NES) proactively suggests the next likely edit based on recent patterns. Beyond completion, Copilot Chat introduces specialized chat participants prefixed with @, such as @workspace for codebase awareness, @terminal for shell commands, @github for repository search, and @vscode for editor-specific help. Slash commands like /explain, /fix, /tests, and /doc trigger specific actions without writing full prompts. References like #file and #selection explicitly include file contents or selected code as context.

Agent mode represents a step-change in capability: Copilot autonomously plans, writes code, runs terminal commands, fixes errors, and iterates to complete multi-step coding tasks, going beyond the conversational help provided by Chat. Copilot Coding Agent extends this into asynchronous operation: developers can assign a GitHub issue to Copilot, which then reads the issue, sets up its environment using a copilot-setup-steps.yml configuration file, explores the codebase, plans changes, implements code, runs tests in an iterative loop until they pass, and opens a pull request. The agent runs in an isolated cloud VM and supports multiple models including GPT-4o, Claude Sonnet, and Gemini.

Beyond Copilot, a diverse ecosystem of AI coding tools has emerged. Cursor is an AI-native IDE forked from VS Code offering deep codebase indexing and an Agent mode with multi-file editing through its Composer feature. Windsurf (formerly Codeium) provides an agentic Cascade flow that understands context and plans multi-step changes. Amazon Q Developer offers code transformation agents that upgrade Java applications autonomously, while Google's Gemini Code Assist provides multi-IDE support with cloud integration. Enterprise-focused options include Tabnine with local model support for privacy, while open-source alternatives like Cline, Aider, OpenHands, and SWE-Agent provide transparency and extensibility. Devin by Cognition operates as a fully autonomous AI software engineer in its own cloud environment, and Replit Agent builds applications through natural language conversation within the Replit IDE.

As agents gain autonomy and tool access, safety becomes paramount. Guardrailing implements safety checks, input and output filters, and constraints to prevent agents from taking harmful or unintended actions. Stop conditions provide predefined criteria — task completed, max iterations reached, error threshold exceeded — that tell the agent when to stop iterating. The human-in-the-loop pattern requires human approval for certain decisions, balancing autonomy with safety, while the ask-before-acting pattern has the agent explain planned actions and wait for user confirmation. Progressive autonomy gradually increases an agent's freedom as trust is established, and confidence thresholds restrict autonomous action to cases where the agent's certainty exceeds a defined level.

The principle of least privilege dictates that agents should receive only the minimum permissions and tool access needed for their specific task, reducing risk of misuse. Sandboxing runs agents in isolated environments to limit damage from unexpected behavior, while capability control limits abilities like internet access or file deletion. The reversibility principle favors actions that can be undone when mistakes occur, and a kill switch provides immediate halt capability. Defense in depth layers multiple security measures — input validation, output filtering, sandboxing, monitoring — so that no single failure compromises safety. Structured agent output validation checks outputs against expected JSON schemas before processing.

Several well-known threats target agents. Prompt injection tricks the agent into ignoring its instructions, while indirect prompt injection embeds malicious instructions in external data sources the agent reads. The confused deputy problem arises when an agent with elevated permissions is manipulated into performing actions that benefit an attacker. Tool poisoning injects malicious instructions into tool descriptions or MCP server responses. Data exfiltration risk concerns agents being tricked into sending sensitive data to external endpoints. The OWASP Top 10 for LLM Applications catalogs these vulnerabilities, with excessive agency — granting agents too many capabilities, too much autonomy, or too many permissions — being a central concern. Defenses include input sanitization, instruction hierarchy enforcement, output filtering, separated data from instructions, and red-teaming to systematically discover vulnerabilities. Alignment research addresses deeper concerns: ensuring agents faithfully serve human interests (the principal-agent problem), remaining corrigible so they can be safely shut down, and avoiding specification gaming where they satisfy literal requirements while violating the intended spirit.

Systematic evaluation is essential to building reliable agents. Standardized benchmarks include SWE-bench, which evaluates agents on resolving real GitHub issues from popular Python repositories; WebArena, which tests realistic web-based tasks like shopping and forum navigation; and GAIA for general AI assistant capabilities. AgentBench evaluates LLM-as-agent across diverse environments including operating systems, databases, and coding. Evaluation approaches vary: outcome-based evaluation measures whether the agent achieves the desired end result, while process-based evaluation inspects each reasoning step. Golden dataset evaluation tests against curated questions with known correct answers to catch regressions, and LLM-as-judge uses another model to evaluate quality and correctness automatically.

Testing strategies mirror software engineering best practices. Unit tests verify individual components like tool handlers and memory retrieval in isolation; integration tests exercise full agent workflows including LLM calls and tool usage; regression tests re-run previous cases after changes to detect degradation. Eval-driven development accepts changes only when they improve eval scores. Beyond testing, observability is critical in production. LangSmith provides tracing, evaluation, and monitoring for LLM-based applications, and traces are end-to-end records showing each step, tool call, LLM invocation, and their relationships. The agent dashboard concept offers real-time visibility into success rates, costs, error logs, and performance metrics.

Production deployment introduces operational concerns. Reliability engineering applies SRE principles, setting SLOs, monitoring error rates, implementing retries, and handling graceful degradation. The fallback chain pattern tries alternative models or strategies when the primary approach fails. Rate limiting caps actions and API calls to prevent runaway execution, while an execution budget imposes hard limits on tokens, time, and cost per task. Canary deployments roll updates out to small user percentages first, and shadow mode runs new agent versions alongside production without serving their outputs. Cost optimization strategies include semantic caching of tool call results, prompt compression, smaller models for simple steps, and model routing to dynamically select the cheapest adequate model for each task. Memory management at scale requires capacity planning, memory warmup for warm starts, isolation between users, and privacy compliance including GDPR's right to deletion and memory encryption at rest and in transit.