The Agent: When a Model Learns to Act

At the end of the last chapter we had a genuinely capable assistant. It could reach outside its own frozen knowledge, search a body of documents by meaning, and ground its answers in sources you could open and check. It was, for the length of a reply, a grounded specialist that showed its working.

And I asked you to notice the shape of it, because that shape is the whole reason for this final chapter. Everything we had built was reactive and single-shot. A question came in; the machinery did one retrieval; the model produced one answer, and stopped. But a hard question in the real world is almost never one lookup. It is a small investigation — search, read, notice a gap, search again with a better query, cross-reference, and only then conclude. Our assistant could not do that. It answered once and fell silent, however incomplete the answer.

This chapter closes that gap, and in doing so it completes the machine. The idea is deceptively small: instead of using the model to produce a final answer, we let the model produce an action — and we wrap it in a loop. That single change transforms an oracle you consult into an agent that works on your behalf. It is the difference between a colleague who answers the question you asked and one you can hand a task to and trust to see it through. Let us build it.

Part I — The loop that changes everything

Here is the move, and it is worth stating starkly because it inverts how you have probably been picturing these systems.

Until now, the model's job ended when it produced text. In an agent, the model's text is the program. At each turn, instead of only being able to answer, the model is given a second option: to emit a request to do something — to call a tool. A small, dumb loop surrounds it and does the rest. The loop reads the goal and everything that has happened so far, hands it to the model, and looks at what the model produced. If the model asked to take an action, the loop executes that action in the real world, appends the result to the running transcript, and goes back to the model for the next step. If the model instead produced a final answer, the loop stops. That is the entire architecture of an agent.

Figure 1. The agent loop — the whole of it. A conventional program has its steps fixed in advance by a human. An agent's steps are invented at runtime by the model: it looks at the situation, decides the next action, sees the result, and decides again. Nothing here is a new kind of neural network. It is the very same model from the previous seven chapters, placed inside a loop and given the option to act instead of only to answer.

Dwell on how strange and powerful this reframing is. A traditional program is a fixed sequence of instructions a human wrote down ahead of time. An agent is not — its sequence of actions is generated on the fly, by the model, in response to what it finds as it goes. The "program" is a loop around a mind that writes its own next line at every step. And it ends not when a human-written script runs out, but when the model itself judges the task complete and simply stops asking to act. The intelligence lives entirely in the model; the loop around it is a few lines of bookkeeping.

Part II — Tools: the model's hands

An agent is only as capable as the actions it can take, so let us be precise about what an "action" actually is. A tool is anything the model can do in the world beyond producing text: read a file, run a shell command, execute code, call an external service, edit a document, send a message — and, tellingly, search a set of documents, which means the entire retrieval machinery of the last chapter is now simply one tool among many the agent can reach for.

Mechanically, a tool call is humbler than it sounds, and it rests entirely on things we have already built. The model does not reach out and touch the world directly. It writes a request — in its ordinary output tokens — that says, in a structured form the loop can recognise, "use the search tool, with this query" or "run this command." The loop parses that request, calls the real function on the model's behalf, and takes whatever comes back — the search results, the command's output, the file's contents — and feeds it into the transcript as more tokens, which the model then reads on its next turn. Text goes out asking for an action; the world's response comes back as text to be read.

Figure 2. The mechanics of a tool call. It bottoms out in exactly what we have built all along: the model reads and writes tokens, and the loop is what turns certain of those tokens into real actions and pastes the real results back into the transcript. The hands are the loop's; the decision to use them is the model's.

Notice what this preserves. Nothing about the model changed. It is still the tower from Chapter Four, doing next-token prediction, over a transcript in the document format from Chapter One — a format now extended with a couple more roles, one marking "the model is requesting a tool" and one marking "here is the tool's result," exactly as Chapter Six's chat format had roles for "user" and "assistant." An agent is not a new species of AI. It is our language model, given hands and a loop, and taught the etiquette of using them.

Part III — How it learned to reach

That etiquette does not come for free, and where it comes from should now sound familiar: it is more of the post-training from Chapter Six. A base model, fresh from pretraining, cannot reliably produce a properly-formatted tool call at the right moment — it has no idea that such a convention is wanted. So it is taught, in exactly the two ways we already know: shown many demonstration traces of an assistant using tools well (instruction tuning), and then refined against preferences for traces that solved the task efficiently and safely (preference learning). The model learns when a question needs a search rather than a direct answer, how to phrase the tool call, and how to read a result and decide what to do next — all as learned behaviour, nudged into the same weights by the same gradient descent.

💡 There is no new engine. An agent is the complete stack of the previous seven chapters — tokenizer, embeddings, attention, the deep tower, pretrained knowledge, an assistant's manners, and retrieval — with two additions that are almost embarrassingly modest: a loop that feeds the model's outputs back to it, and a training pass that taught the model to emit tool calls. That is the entire distance from “a model that answers” to “a system that acts.” The capability feels like a different order of thing. The machinery underneath is the same machinery, wrapped.

Part IV — The investigation

Now watch the single-shot limitation of the last chapter simply dissolve. Because the loop lets the model act, see the result, and act again, it can conduct a genuine multi-step investigation — precisely the thing a hard real-world question demands.

Figure 3. A worked investigation. Step 3 is the one a single-shot system could never reach: the agent noticed that the generic guideline it first retrieved did not fit the specific patient, and changed its own plan in response. This capacity to course-correct mid-task — to let what it finds reshape what it does next — is exactly what the loop buys, and it is why agents can tackle problems that a one-shot answer cannot.

The same mechanism scales further than a single investigation. One of the tools an agent can be given is the ability to spawn another agent — a fresh loop, with its own goal, its own tools, and its own transcript, which reports its finding back when done. This lets a large task be broken into pieces and delegated, a manager agent parcelling out sub-problems to workers. The recursion is natural because a sub-agent is not a special construct; it is just another instance of the same loop. It is turtles, and every turtle is one you have now met.

Part V — The new care it demands

We have built something genuinely powerful, and I would be failing you badly if I ended the book on the triumph without the warning, because the warning is the more important half — especially for those of us who will deploy these systems where the stakes are human.

An assistant that only answers is, at worst, wrong on your screen. An agent acts. It runs commands on real machines, edits real files, sends real messages, moves real money, changes real records. The moment a language model is given hands, every one of the failure modes we catalogued across this book — the confident hallucination of Chapter Five, the sycophancy and polished fabrication of Chapter Six, the wrong-passage retrieval of Chapter Seven — stops being a bad sentence and becomes a bad action. And because the agent works in a loop, an error early in a chain silently poisons everything downstream of it: a wrong fact fetched at step three is quietly assumed at steps four through ten. The mistakes do not just persist. They compound.

Figure 4. The discipline that makes agency safe: a gate on every proposed action, granting autonomy in proportion to how reversible the action is. Reading is cheap and freely allowed; sending, editing, and spending pause for a human; the irreversible and the forbidden are blocked outright. This is not bureaucratic caution — it is the direct acknowledgement that a system which can be confidently wrong should not also be able, unsupervised, to do the irreversible.

⚕️ The line I would draw in medicine, and why. An agent with read-only access to the literature and a patient's record is a research assistant — a genuinely useful one. An agent with write access to the record, or worse, the ability to order and prescribe, is a categorically different risk, because now a hallucinated fact or a mis-retrieved guideline does not produce a wrong paragraph on a screen — it produces a wrong action in a patient's care. Everything this book taught you about how these systems fail is an argument for keeping the human decisively in the loop at exactly the point where the agent's proposal becomes an act. Understanding the machine is not a reason to trust it more. It is the reason to know precisely where not to.

The whole machine

And so we arrive at the end, with the machine complete. Let us see all of it at once.

Figure 5. The complete machine, eight chapters in one image. Read it from the bottom up and it is the arc of the whole book: a sentence is split into tokens, the tokens are given meaning, they learn to read each other, they are refined through a deep tower, the tower is filled by training, shaped into an assistant, grounded in real documents, and finally — wrapped in a loop with tools — set free to act.

Return, for a moment, to where we began. Chapter One opened with you typing a sentence and pressing enter, and with the quiet, unremarkable-seeming act of that sentence being taken apart. I said then that everything the machine does happens downstream of that first disassembly, and that if you wanted to understand these systems from the ground up, that was the ground.

You can now follow that sentence the entire distance. You can watch it shatter into tokens, each token find its place in a landscape of meaning, the tokens turn and read one another through attention, the whole rise up a deep tower that was itself filled, weight by weight, by the long patient descent of training. You can see how a mere predictor of text was shaped into something that answers helpfully, then given the means to look things up and show its working, and finally set inside a loop where it can reach out and act. None of it is magic to you any longer. All of it is machinery you understand.

That understanding is not merely satisfying. It is, increasingly, a form of responsibility. These systems are being handed into medicine, into law, into the places where being confidently wrong has a cost measured in human terms. The people who understand them from the inside — who know not just what they can do but exactly how and where they fail — are the ones who can deploy them with the care the stakes deserve. You are now, whatever your field, one of those people. That was the whole point.

The machine is built. What you choose to build with it is the part no book can write for you.

— Neal