AI agents
An AI agent doesn't only answer. It clicks, searches and fills in forms for you. Like an intern with your keys. Handy, but it can be fooled, and small mistakes add up. Learn how to give an agent a task, and where to keep control.
First, what do you think?
An AI agent books a holiday for you. Along the way, it reads a web page with hidden text. Could that text change what the agent does? Have a guess.
What is an AI agent?
The whole story in three sentences. A chatbot answers. An agent also acts: it clicks, types, searches and fills in forms. It decides its own next steps, starting from a task you give it.
Think of an intern with your keys. You ask for a cheap tent in your basket. The intern goes off, visits shops, compares, and comes back. You didn't have to do every step. But you gave someone else your keys.
One maker describes an agent as a language model that directs its own steps. It also chooses which tools to use.
- It acts. Clicking on websites, sending a message, filling in a form, running code.
- It decides the steps. You give the goal. It works out the way.
- It can stop and ask. A good agent pauses for your feedback at checkpoints, or when it gets stuck.
What the predictor does
Every step an agent takes is a prediction. That's the rule.
That has two effects. First, mistakes add up. One maker writes that agents bring higher costs, and errors that pile up. A small wrong turn in step two can lead far off track by step ten.
Second, an agent reads everything it visits as text on its whiteboard. A web page or an email can contain hidden instructions. That's called prompt injection. One maker gives an example. An email contains white text, invisible to you. It tells the agent to forward your confidential emails to a stranger.
The maker says plainly: no browser agent is immune to prompt injection. Even if only 1 in 100 attacks works, that's still a real risk.
A note on the door can fool the intern. And small wrong turns add up. You decide what keys it gets, and you check before anything is final.
Try it yourself
Three moments with an agent. What do you do?
Everything runs in your browser. Nothing you type is sent anywhere.
How do you work with an agent?
Four steps. Try them on something small and harmless, like finding three recipes.
Start small and clear
Give one clear task, with an end point. "Find three tents under 100 euros, and list them." Not "sort out my camping trip". One maker advises: use the simplest solution that works.
Give only the keys it needs
Don't connect your email, bank and files if the task only needs a web search. Less access means less that can go wrong.
Let it ask before the big steps
Paying, sending, deleting, booking: let it stop and ask you first. Then you see what it's about to do.
Check the result
Read what it did before you rely on it. Is that really the right tent, the right date, the right person?
In practice
Three people hand over their keys.
Case 1The school trip
Sophie (17) asks an agent to plan a class trip to Amsterdam. Train times, a museum, a place to eat. It comes back with a neat plan.
Send the plan to the class.
Every step was a prediction. A wrong date in step two affects everything after it.
Check the key facts: train times, opening hours, prices. On the sites themselves.
The agent saves her hours. Sophie makes sure the plan works.
Case 2The inbox
Hans (50) gives an agent access to his work email. It should answer meeting requests. One email has hidden text in it.
Let the agent run, because it saves so much time.
That's the exact example one maker gives. Hidden text can tell the agent to forward confidential mail.
Let the agent draft replies, but not send them. Check his employer's rules on AI and email.
Hans sees every reply before it goes out. Hidden instructions don't get far.
Case 3The groceries
Mirjam (66) lets an agent order her weekly groceries. The first week, it orders ten litres of milk instead of one.
Stop using it, or not notice.
Small mistakes happen, and an agent can repeat them.
Let the agent fill the basket, and stop before paying. Mirjam checks the basket, then pays.
She keeps the time saved, and catches the ten litres.
When not to
- Not with all your keysFull access gives hidden instructions great power.Give only the access the task needs.
- Not for steps you can't undoPaying, sending, deleting.Let it ask first, and check.
- Not when a simpler way worksA quick question is often enough.Use the simplest solution that works.
By situation
An agent can collect information or plan a project. Check every fact it brings back. Don't give it your school login.
Ask your employer which agents are allowed, and with what access. Let it draft, not send. Keep a person in charge of the final step.
Shopping lists, comparing products, planning a day out. Let it stop before it pays or books. Keep your bank and email out of it, unless you check every step.
Myths and mistakes
| Claim | True? | Why |
|---|---|---|
| An agent only does what you tell it | No | It reads web pages and emails. Hidden text can steer it. |
| Good agents can't be fooled | No | One maker says no browser agent is immune. |
| More freedom is always better | No | More freedom means higher costs and errors that pile up. |
| If step one is right, the rest will be | No | Each step is a prediction. Small mistakes add up. |
Related topics
Read first
- Codethe same rule: test before you trust.
Next
- Chat assistantsthe tools that offer chat, search and agents.
Related
- Privacy and your datawhich keys to keep to yourself.
Sources
- documentationAnthropic. Building effective agents.An agent is a language model that decides its own next steps and which tools to use. It starts from a task from a person. More freedom means higher costs and errors that pile up, so test it and set limits.
- organisationAnthropic (2025). Mitigating the risk of prompt injections in browser use.Prompt injection: instructions hidden in content an AI reads, like white text in an email that tells an agent to forward confidential mail. No browser agent is immune; even a 1% success rate is a real risk.
Test
You get 7 questions about the whole page. Get 5 right, and you've mastered the topic.
About the tools in this course. Every tool is described in the same way, in alphabetical order, without a recommendation. Names, prices and features change often: the maker's own site is always right. This site was built with the help of Claude, one of the tools described here.