Chatbot vs AI Agent: What's the Difference?

Start hereIn 1966 ELIZA held conversations using key words and rules. Its maker wrote that it "maintains the illusion of understanding with so little machinery". Today an agent can be given access to your mailbox and act on what it finds. Is an agent just a better chatbot, or something else?

A chatbot talks with you: you send a message and it replies. An AI agent is given a goal and some tools, and takes steps on its own until the job is done or it stops. Our reading: many products sit somewhere between the two.

01At a glance

	Chatbot	AI agent
What you give it	A message	A goal or a task
Who picks the next step	You, one message at a time	The model, in a loop, until it stops
Can it act in other apps?	A simple one cannot	Yes, through the tools it is allowed to use
What can go wrong	A wrong or made-up answer	A wrong action, or one steered by hidden instructions
A date to know	Merriam-Webster’s first known use of chatbot: 1994	Russell and Norvig’s 1995 AI textbook defined an agent

Our reading, drawn from the sources below.

021. A simple example

Say you ask a chatbot how to clear old newsletters out of your inbox. It writes back some tips, and you do the work.

Now give the same job to an email agent. It opens your mailbox through a tool, finds the newsletters, moves them and tells you what it did. That is our own example, but it fits how Anthropic describes agents: language models using tools in a loop, guided by feedback from what they find.

032. What a chatbot is

Merriam-Webster defines a chatbot as a bot “that is designed to converse with human beings”. It gives 1994 as the word’s first known use.

The idea is older than the word. In 1966 Joseph Weizenbaum described ELIZA, a program running on a time-sharing system at MIT. It made some kinds of conversation between people and a computer possible.

• It spotted key words in what you typed and used rules tied to them to build a reply.
• Its only serious scripts at the time made it respond roughly as certain psychotherapists (Rogerians) would.
• Weizenbaum wrote that ELIZA “maintains the illusion of understanding with so little machinery”.

Google’s machine-learning glossary ties the word to today’s technology: it calls a chatbot an application of a large language model. In a chat, what you typed earlier and how the model replied become the context for what comes next. Our page on how large language models work explains the engine underneath.

043. What an AI agent is

Stuart Russell and Peter Norvig’s textbook Artificial Intelligence: A Modern Approach defined agent in its 1995 edition. An agent is “anything that can be viewed as perceiving its environment through sensors and acting upon that environment through effectors”. The 2021 edition’s preface still calls the intelligent agent the book’s main unifying theme.

Today’s AI labs use it more narrowly, for language-model systems that take actions:

• OpenAI: “Agents are systems that independently accomplish tasks on your behalf.”
• Google: “Software that can reason about user inputs in order to plan and execute actions on behalf of the user.”
• Anthropic separates workflows, where the steps are set in advance in code, from agents, where the model directs its own process and tool use.

OpenAI lists three parts: the model, the tools it can use to take action, and instructions that set how it behaves. Google describes an agentic loop that an agent repeats until a termination condition is met, usually in four stages: observe, reason, act, feedback.

And “agentic”?

Merriam-Webster defines agentic as “able to accomplish results with autonomy”. Its AI sense covers a system that works on its own, or with little human supervision, to complete the tasks a goal needs. Anthropic uses agentic systems as the umbrella for both workflows and agents.

Anthropic also notes that the word agent can be defined in several ways. Our AI glossary sets the main definitions side by side.

054. Where they overlap

A chat window can sit in front of either one. Anthropic gives customer support as an example that “combines familiar chatbot interfaces with enhanced capabilities through tool integration”. There, tools can pull customer data and order history, and actions such as issuing refunds or updating tickets can be handled by software.

OpenAI draws the line at control: apps that use a language model but do not let it control the workflow, such as simple chatbots, are not agents. Our reading: the question is not how it looks, but who decides what happens next.

Anthropic calls a language model with added retrieval, tools and memory the basic building block of agentic systems.

065. The differences that matter in practice

Who decides the next step. Agents start from a command or a discussion with you; once the task is clear, they plan and work independently. They may come back to you at checkpoints or when they hit a blocker.

What a mistake costs. Our reading: a chatbot’s wrong answer is text you can check before you use it. Our page on why AI makes things up covers that side.

An agent’s mistake may already be an action. Anthropic writes that agents’ autonomy “means higher costs, and the potential for compounding errors”. It advises builders to test extensively in sandboxed environments, with suitable guardrails.

How reliable they are. METR, which has published measurements of AI agents, describes how long a task an agent can handle as a time horizon. One version is the task length, measured by how long a human expert takes, at which an agent is predicted to succeed half the time. Its tasks are mostly software, machine-learning and cybersecurity work, designed to be self-contained and well specified, with clear success criteria.

Our reading: even the yardstick is a success rate, and everyday errands are rarely that tidy.

When a person should step in. OpenAI’s guide says sensitive, irreversible or high-stakes actions should trigger human oversight until confidence in the agent’s reliability grows. Its examples are canceling orders, authorizing large refunds and making payments.

076. Safety points worth knowing

Prompt injection

OWASP’s 2026 list of security risks for language-model apps keeps prompt injection in first place. It happens when input to the model changes its behaviour in ways the developer did not intend. That input can come from you, from content the model retrieves, from a tool’s output, from images, audio or video, or from the model’s memory.

In indirect injection, the instructions arrive inside content the model reads, such as a web page, a document or an email. The user did not supply or see them.

A January 2025 NIST technical blog calls agent hijacking “a type of indirect prompt injection”. It traces the problem to a system with no clear separation between trusted instructions and untrusted outside data.

OWASP says models make no built-in distinction between instructions and data, and behave with an element of chance. So, in its words, “no reliable prevention mechanism exists today”. Our page on Clawdbot, now OpenClaw, follows one open-source agent project and the security problems it ran into.

Too much power

OWASP calls this risk excessive agency: damaging actions taken in response to unexpected, ambiguous or manipulated output from the model. It usually comes from one or more of three things: too many functions, too many permissions or too much autonomy.

In the 2026 list it climbed to third. OWASP says its practitioner vote and the incident record agree that agentic deployments are where the damage is landing.

OWASP also passes on a three-part check known as the lethal trifecta. An agent that can at the same time reach private data, take in untrusted content and communicate externally “has the conditions for high-impact exploitation”. Removing any one of the three removes those conditions.

087. Common mix-ups

• Does agentic mean fully autonomous? Anthropic notes that some of its customers use agent for fully autonomous systems that work on their own for long periods, and others for set workflows. It helps to ask which is meant.
• Does a chat window mean it is only a chatbot? As the support example shows, an agent can sit behind the same chat window.
• Do more tools make a better agent? Google’s glossary says an agent’s action space, its tools, APIs and permissions, should be “just big enough” for the task. Too large, and the agent tends to become more error prone.

098. How to tell them apart

Five questions to ask about any AI tool, drawn from the sources above (our reading):

1. Does it only reply, or does it do things in other apps and accounts?
2. Which tools and permissions does it have, and does it need all of them?
3. Does it ask you before anything that cannot be undone, such as a payment or a deletion?
4. What will it read along the way, such as web pages or emails, that a stranger could have written?
5. Can you see the steps it took? Anthropic lists showing the agent’s planning steps as one of its core principles.

10Where to go next

• Anthropic, “Building effective agents”: a plain guide to workflows and agents from a lab that builds them. The page notes that much of its tooling has changed since December 2024.
• OpenAI, “A practical guide to building agents”: what an agent is, its parts, guardrails, and when to hand control back to a person.
• Google’s machine-learning glossary: short definitions of agent, agentic, chat and more.
• OWASP Top 10 for LLM Applications 2026: a community-driven guide to the most critical security risks for apps built on language models.
• OWASP Top 10 for Agentic Applications 2026: OWASP describes it as a globally peer-reviewed framework for the most critical risks of autonomous and agentic AI systems.
• NIST’s agent-hijacking blog: how NIST tested agents against malicious instructions hidden in data.
• METR’s time-horizon page: measurements of how long a task AI agents can complete. The page says it is no longer actively updated.

11Quick answers

12Use this

13Quick quiz

How we checked this · Last checked October 2026

• We read the pages where Anthropic, OpenAI and Google define agents, and Merriam-Webster's entries in a browser, because it blocks scripts.
• For ELIZA we read the 1966 paper's abstract and a scanned copy of the full text. The publisher's own page showed a bot check, so we cite the paper's DOI.
• For the textbook definition we read the 1995 chapter and the 2021 preface on the authors' own pages.
• For security we read OWASP's 2026 list from its PDF and a NIST technical blog from January 2025. We left out test results tied to one model, because they date quickly.
• We did not test any AI product, and this page recommends none.

How we check every article →

14Sources