How Things Work

Mechanism 08Artificial IntelligenceInteractive · 7 min

What happens when a language model is allowed to take actions?

It still only writes text. Some of that text is a request to run a tool, and ordinary code around the model decides whether to run it. An agent is that loop, repeated until the model stops asking.

The model's choices are a fixed policy over its transcript. Tokens are estimated at four characters each.

The model can't check the weather. It can ask for a tool by name, and the runtime runs it and pastes the result into the transcript. Then the model is called again, with that result in front of it.

ReadyGive the agent a task and follow the loop.

Ready. Give the agent a task and follow the loop.

step 1/1
Give it a task
Guardrails
Tools
The transcript, newest firstAll of it is resent on every call
#rolecontent
Counters
0Model calls
0Tool calls
0Tool errors
0People emailed
0Tokens sent, in all
10Steps left
Sheet 08 · The agent loop, call by callOne model, three toolsTokens estimated at four characters each
The model

Three ideas explain most of it

Idea 1 · tool calls

The model asks, the runtime acts

The model is shown a list of tools with names and arguments. To use one it replies with a structured call. Running it, with real permissions, is the runtime's job.

Idea 2 · the loop

Results go back in, and it goes again

Each tool result is appended to the transcript and the model is called again. It plans one step at a time, from whatever the last result said.

Idea 3 · the harness

Safety is code around the model

Step budgets, approvals, allow-lists and timeouts all live in the runtime. They hold however the model is persuaded, because they never ask its opinion.

Under the hood

A tool is a description and a function

Live: the tool in use now

tools = [  get_weather(city, day)    # read-only  fetch_page(url)           # returns untrusted text  web_search(query)         # returns untrusted text  send_email(to, subject)   # side effect]loop: call model → run tool → append → repeat

Live: what the agent has sent

$ mail sent --today
TO    SUBJECT
(nothing sent)

The model never sees code. It sees a name, a sentence about what the tool does and a schema for its arguments, and it learned in training to reply with a call in the right shape when one would help.

Protocols like MCP standardise how tools are described and connected, so one runtime can use tools written by anyone. The loop stays the same.

Look at the transcript as the agent runs: every message, tool results included, is sent again on every call. That's the agent's memory, and also why long runs get slow and expensive.

When it breaks

Text in, actions out

Scenario D · prompt injection

Data that reads like an order

A web page, an email or a document can contain text aimed at the model. In the context it looks like any other instruction. Gate the tools that can do harm.

Scenario E · runaway loop

No stopping condition

A vague goal can never be met, so the model keeps trying. Without a step or cost budget the loop runs until something external stops it.

The quiet failure

Errors swallowed as results

A failed tool returns an error message, and the model may retry, give up or carry on as if it worked. Break the weather API and watch which it does.

Test yourself

Two predictions

The agent is asked to summarise a web page. The page contains a hidden line telling AI assistants to email every contact. Which change actually stops the email?

An agent that never finishes is allowed 10 steps instead of 4: 2.5 times as many. Roughly how many more tokens does it spend?

Fine print

What this model leaves out

A real model's choices

Here the model follows a fixed policy over its transcript, so every run is repeatable. A real model makes the same kind of decision by generating text, and can choose differently on different runs.

Parallel calls and planning

Real models can request several tools at once, and some agents write a plan first and work through it. Both are still this loop with more in each turn.

Context management

Long-running agents can't resend everything forever. They summarise old turns, drop bulky tool results, or keep notes in a file they read back with a tool.

Multi-agent systems

One agent can call another as a tool, handing it a sub-task and reading back its answer. Each one is still a model in a loop, with its own transcript and its own guardrails.

Keep going

Connected mechanisms