Do you know what AI agents are?

AI that does things, not just answers questions. What AI agents are, where they're showing up in your software, and the simple rules that keep them safe.

October 26, 2026 · 6 min read · Current as of Oct 26, 2026 · By Anthony Carey

Over the past year, the AI tools your staff use have started doing more than answering questions. They can read email, fill in forms, update spreadsheets and click through websites on their own. These are called AI agents, and they're arriving inside software many businesses already pay for. Here's what they are in plain English, and the few rules that keep them from turning into a problem.

The short answer

A chatbot answers questions. An AI agent takes actions. You give it a goal, such as "move next Thursday's appointments and let the patients know", and it works out the steps, uses your apps to carry them out, and checks its progress as it goes.

The joint guidance from six national cyber security agencies (listed below) describes agentic AI as systems that use an AI model to reason about the situation, make decisions and take actions, and that are meant to run without a person watching every step.

How it works

Every agent has three parts:

A brain: an AI model, like the ones behind ChatGPT, Gemini, Copilot, Grok or Claude, that reads the goal and decides the next step.
Hands: connections to your apps, such as email, calendar, accounting software or a web browser.
Permissions: what those connections allow. Reading a mailbox is very different from sending from it, paying a bill or deleting files.

How an AI agent works: you set a goal, the AI model breaks it into steps, connected apps carry them out, and permissions decide what it may do: reading allowed, sending and paying only after asking, deleting never. It checks each result and repeats until done. The catch: it acts with your access and believes what it reads, so hidden instructions in an email or web page can steer it. — Our diagram. The permissions shown are an example of sensible settings, not how every product ships.

Picture the front desk of a Watertown dental office. A hygienist is out sick next week. A chatbot can write a polite email for the patients. An agent can find every affected appointment, offer each patient new times, update the schedule and send the messages. That's the appeal, and it's also the risk: the agent is doing real work with real access.

Where you'll run into them

Every major AI company now sells agents, and so does much of the software small businesses already run. As of late October 2026:

Inside software you may already use

Product	What its agents do	Your control
QuickBooks Online (Intuit)	Bookkeeping, chasing unpaid invoices, running payroll, checking sales tax returns	Acts "with your permission"; Intuit says AI features can't be turned off one by one
Shopify Sidekick	Carries out store tasks you describe in plain English	Can't change your store without your approval
Meta Business Agent	Answers customers on WhatsApp, Messenger and Instagram, books appointments, recommends products	You choose when a person takes over the conversation
Google Workspace (Gemini)	Works across Gmail, Docs, Sheets and Calendar; "coworker agents" get their own Workspace account	Gemini features are on by default; admins set permissions, and actions are logged
Microsoft 365 Copilot	Agents in Outlook, Teams and Office. Microsoft’s separate Copilot app adds Autopilot (private preview), which keeps working on ongoing tasks	Admins install, block or approve agents (Agents > All agents)

General-purpose AI assistants

Company	Agent product	Your control
Amazon	Alexa+ books reservations, orders takeout and schedules home services	Not spelled out on Amazon's page
Anthropic	Claude Duet (waitlist) works across connected apps like Gmail and QuickBooks	Asks before sending, paying, signing or deleting
Google	Gemini Spark, a round-the-clock personal agent (paid Google AI plans, rolling out country by country)	Built to ask first before high-stakes actions
OpenAI	ChatGPT "dots": always-on agents with their own computer and browser	Checks risky actions against your rules; password changes always stay with you
xAI	Grok Bot (beta): "AI teammates" that sign into your tools and learn workflows	Comes back to you "when something needs your approval"

The pattern to notice: the controls vary a lot from product to product, and some features arrive switched on. Whoever runs your IT should check the settings, not assume them.

What it means for your business

The upside is real. Agents are good at repetitive, well-defined jobs: chasing unpaid invoices, rescheduling, pulling a weekly report together from three systems. Government guidance agrees they can automate "repetitive, well-defined and low-risk tasks."

The risks come from the same place as the benefits: access.

It acts with your keys. Anything the agent can reach, a mistake can reach, and so can anyone who manages to trick it. Security experts call this excessive agency: an agent with more functions, permissions or independence than its job needs.
It can be fooled by what it reads. An agent that reads email or web pages can pick up hidden instructions planted there (prompt injection). The guidance below gives exactly this example: a malicious email that talks an email-handling agent into downloading malware. There is no complete fix for this yet, so the answer is limiting what a fooled agent could do.
It can be confidently wrong. AI models still get facts wrong, and an agent may act on a mistake before anyone notices.
It can be hard to trace. When something goes wrong, it isn't always clear afterward what the agent did or why.

In late April, the cyber security agencies of the US (CISA and NSA), Canada, Australia, New Zealand and the UK published joint guidance on adopting agentic AI. It's written for large organizations and critical infrastructure, but its core advice scales down to a ten-person office: start with low-risk, well-defined tasks; never give an agent broad or unrestricted access, especially to sensitive data; and keep a human in control of anything high-impact.

What to do

Decide who says yes. One person, the owner or whoever runs your IT, approves any AI agent before it connects to business email, files, banking or payroll. Staff shouldn't connect work accounts to personal AI subscriptions on their own.
Start small. Begin with tasks where a mistake is cheap: summarizing, drafting, looking things up. Move to sending or changing things only once you trust the results.
Give it the least access that works. Read-only if it only needs to read. Its own account, never someone's administrator login.
Keep a person on anything that can't be undone. Payments, messages to customers, deleting records, signing documents. Check that the tool really asks first, and don't turn that off.
Keep readers and doers apart. An agent that reads outside email or browses the web shouldn't also be able to send money or files.
Know where the off switch is. If you use Microsoft 365, have your administrator check the Agents page in the admin center: see what's installed, and block what you don't want.
Write it down. Add a short paragraph to your AI policy covering which agents are approved, what they may access, and who approves new ones.

Sources

Guidance and definitions

Careful adoption of agentic AI services: joint guidance from the Australian, US (CISA and NSA), Canadian, New Zealand and UK cyber agencies, April 30, 2026.
CISA: Careful Adoption of Agentic AI Services and the Canadian Centre for Cyber Security announcement
OWASP: LLM06:2025 Excessive Agency and LLM01:2025 Prompt Injection

Products named above (each company's own page)