03 — agents & architecture

AI agent

A language model wired into a loop where it can take actions and see their results: it reasons, calls a tool, reads the output, and decides what to do next, repeating until the task is done. The security-relevant part is not the intelligence but the loop — an agent reads content nobody vetted, and acts on it, without a human in between each step. A coding agent such as Claude Code, Codex or Copilot CLI is the canonical case: it has the shell, the repository and the credentials.

Related terms

  • Agent host Agents & architecture

    The program that runs the agent loop — the CLI, IDE extension or desktop app that assembles the context, sends it to the model, receives the tool calls…

  • Tool call Agents & architecture

    The model's structured request to do something in the world — Bash("rm -rf …"), Read("/etc/passwd"), an HTTP fetch, a database query — emitted as a name…

  • Confused deputy Attack concepts

    A classic security problem, dated 1988, that agents reproduce almost perfectly: a privileged component is tricked by a less-privileged party into misusing…

Agents & architecture

Where the attacks above actually land. The vocabulary here is worth precision, because the difference between "the model decided" and "the tool ran" is the difference between a risk and an incident.

AI agent is term 1 of 8 in this part of the glossary.

Get started free Full glossary → How we test → Community agent on GitHub ↗

This page is one entry from the agentic AI security glossary, which defines 60 terms in the same style. Where a term belongs to a published taxonomy or standard — the HackAgent attack families, the OWASP lists, AMTSO's guidelines, MITRE ATLAS, ISO/IEC 42001, the NIST AI RMF, the EU AI Act — the authoritative wording is the source document's, not ours, and specifics should be verified there. "Lethal trifecta" is Simon Willison's term. OWASP® is a trademark of the OWASP Foundation; ATT&CK® and ATLAS™ are trademarks of The MITRE Corporation. Naming a framework here is description, not a claim of certification or endorsement.

glick.run — AGPL-3.0