Sometime in the past two years, nearly every AI product renamed itself an agent. The chat window looks the same, the pricing page looks the same, but the word “assistant” quietly became “agent” and the marketing implied something fundamentally new. Sometimes it is. Often it’s the same chatbot wearing a different badge, and the difference between those two cases is worth being able to spot, because it determines both what the product can do for you and what can go wrong when it fails.
The distinction isn’t marketing preference. It’s architectural, it has a reasonably settled technical definition, and it changes the risk profile of the tool you’re using.
What’s the Difference Between a Chatbot and an Agent?
A chatbot responds: you send a message, it generates a reply, and control returns to you after every turn. An agent acts: it takes a goal, then decides for itself which steps, tools, and actions to take to accomplish it, working across multiple steps without asking you at each one. The dividing line is who directs the process. In a chatbot, you do. In an agent, the model does.
Anthropic’s engineering team drew this line precisely in a widely cited essay on building effective agents, distinguishing between workflows, where a model is orchestrated through predefined code paths, and agents, where the model dynamically directs its own process and tool usage. That distinction has become the closest thing the industry has to a shared definition, and it’s a useful test to apply to any product calling itself an agent.
The Spectrum, Not the Binary
In practice, products sit along a spectrum of autonomy rather than in two clean boxes.
| Level | What it does | Who’s in control | Example behavior |
|---|---|---|---|
| Plain chatbot | Answers from its training | You, every turn | Answers a question about history |
| Augmented chatbot | Answers using tools: search, file reading, code execution | You, every turn | Searches the web, then answers |
| Workflow | Runs a fixed multi-step sequence someone predefined | The developer’s code path | Always: retrieve, summarize, format |
| Agent | Chooses its own steps and tools toward a goal you set | The model, between your checkpoints | Books travel: searches, compares, fills forms, asks you before paying |
Most products marketed as agents today sit in the second and third rows. A chatbot that can search the web is genuinely more capable than one that can’t, but if you’re approving every step, it isn’t directing its own process, and calling it an agent stretches the definition. That’s not a criticism of the products. It’s a reason to look past the label at what the thing actually does.
Why the Difference Matters: Capability
Real agency unlocks a category of task a chatbot structurally can’t do: anything requiring multiple dependent steps where the right next step depends on what the previous one found. Researching a topic across many sources, fixing a bug by editing code and running tests until they pass, or handling a multi-step booking are agent-shaped tasks. A chatbot can advise you through each step. An agent can do the steps.
The cost of that capability is predictability. A chatbot’s failure is a bad answer you can ignore. An agent’s failure can be a bad action already taken.
Why the Difference Matters: Risk
This is the part product pages rarely explain. The more freely a system can act, the more a single mistake or manipulation can accomplish. An agent that reads your email, browses the web, and sends messages on your behalf combines all three into one attack surface: content it reads can contain hidden instructions, and unlike a chatbot, an agent can act on them before you see anything. This class of attack, prompt injection, sits at the top of the OWASP Top 10 for LLM Applications precisely because agentic systems turn a manipulated model into a manipulated actor.
None of that makes agents a bad idea. It makes the questions you ask before adopting one different:
- What can it actually do without asking me first, and can I change that?
- What accounts, files, and services does it have access to?
- Does it show me its steps, or only its results?
- What’s the worst single action it could take if it misread something, and is that action reversible?
- Does it read content from outside my control, like public webpages or inbound email?
For a chatbot, most of those questions barely matter. For an agent, they’re the whole evaluation, and they matter more than any capability demo. What the tool does with your data once connected is part of the same assessment.
The “Augmented Model” Middle Ground
A useful concept from the same Anthropic essay is the augmented model: a model with tools attached, like retrieval, search, or code execution, but still operating one user-directed turn at a time. Most of the genuinely useful AI products people rely on daily are augmented models. A system that looks up your documents before answering, the pattern behind retrieval-augmented generation, is augmentation, not agency: powerful, grounded, and still fully under your direction.
That middle ground is often the right choice. Autonomy is a cost you should pay only when the task genuinely needs it, which is also the advice the people building these systems give: use the simplest structure that does the job, and add agency only when simpler approaches fall short.
Frequently Asked Questions
Is ChatGPT a chatbot or an agent? The base chat experience is an augmented chatbot: it responds turn by turn under your direction, with tools like search attached. Specific features that plan and execute multi-step tasks with tools move toward agent territory. The same product can contain both modes, which is exactly why the label alone tells you little.
Are AI agents just chatbots with extra marketing? Sometimes, and that’s the problem with the word. The test is control: if the system decides its own next steps toward a goal and uses tools without your turn-by-turn direction, it’s meaningfully an agent. If you approve every step, it’s a chatbot with tools, whatever the landing page says.
Are agents more dangerous than chatbots? They carry a different risk, not just more of the same. A chatbot’s worst case is wrong information. An agent’s worst case is a wrong action taken with your permissions, which is why access limits and approval checkpoints matter far more for agents.
Do I need an agent, or is a chatbot enough? If your tasks are single questions or single documents, a chatbot or augmented chatbot covers it. Agents earn their complexity on multi-step tasks where each step depends on the last, and where you’re comfortable delegating the steps, not just the answer.
Will everything eventually be an agent? Capability is moving that direction, but the tradeoff doesn’t disappear: autonomy always costs predictability and expands what a failure can do. Expect the practical answer to stay “use the least autonomy the task needs” rather than “maximum agency everywhere.”
How to Use This Distinction
Next time a product calls itself an agent, apply the one-line test: who directs the process, me or the model? That single question sorts marketing from architecture faster than any feature list. Then, if the answer is genuinely “the model,” shift your evaluation from what it can do to what it’s permitted to do, because with agents, permissions are the product. Our coverage of these tools lives under AI tools, where that permission-first lens is applied to specific products.