Agents can still make mistakes — fluent, confident mistakes.

The loop is powerful because it compounds. That is also why it is uncomfortable. A wrong token in chat is a shrug. A wrong token that becomes a tool argument is an incident.

This is not “agents are fake.” It is not “agents replace everyone.” It is: agents amplify both competence and risk. AI Right Now Part 6 asked what it may touch. Here is why that question gets harder every turn.

Tool calls fail in ordinary ways

Timeouts. Wrong endpoints. Stale documentation. Schema drift. Permission denied. The model will often narrate a success anyway, or retry a broken call with a slightly different hallucination. Your runtime must treat tool errors as first-class observations, not as vibes.

If the agent cannot see a failure, it will plan the next step on a lie.

Long workflows compound errors

Step 3 is only as good as the observation from step 2. Retrieve the wrong customer. Summarize the wrong ticket. Email the wrong recipient. Each hop looks locally reasonable. The trajectory is not.

This is why “it worked in the demo” is a weak claim. Demos are short, happy paths. Production is long, messy paths.

Security becomes much more important

The attack surface is no longer only “what did it say?” It is “what did it do?” Prompt injection — untrusted text that hijacks the next tool call — sits at the top of the OWASP GenAI LLM Top 10 (2026) as LLM01. Excessive agency (LLM03) is the cousin: too many tools, too much permission, too little stop.

A polite agent with open access is more dangerous than a blunt agent in a sandbox. Logs, allowlists, and human gates are not bureaucracy. They are how you survive the loop.

Evaluation becomes difficult

You cannot score an agent with a single quiz answer when success means a messy real-world state: the ticket exists, the refund is right, the email was not sent twice. Trajectories branch. Tools are flaky. “Correct” is a property of the world after the run, not of the last sentence.

That is why Part 8 exists as its own chapter. Eval is not a footnote. It is how you know the loop is safe enough to ship.

Example

An agent is told to “close out old alerts.” It marks twenty as resolved. Eighteen were noise. Two were real outages with quiet customers. The transcript looks helpful. The world is worse.

A safer design: classify and propose closures. A human confirms the two that spend reputation.

Conclusion

Design for approval gates, least privilege, and visible traces of every tool use. The uncomfortable reality is not a reason to freeze. It is the reason policy, evaluation, and shipping are three parts.

Takeaway: The agent loop compounds competence and error — security and eval get harder because actions, not answers, are the product.

Sources

Part 4: Why Agents Are Different
Part 6: Where Agents Actually Make Sense