Is ChatGPT an AI agent? What changes when the tool can act

Type a question into ChatGPT and you get an answer back, and then nothing else happens until you type again. That is a chatbot. An AI agent is given a goal instead of a question. It works out its own steps, opens the apps and files you have let it use, and keeps going until the job is done or it reaches something it cannot do. So the plain ChatGPT chat window is not an agent. Some of the newer features in ChatGPT, Claude and Gemini are agents, because you hand them a whole task instead of a question. Knowing which is which tells you what a tool at work can do without you.

The difference, in one test

Anthropic, the company behind Claude, draws the line in its engineering guide Building effective agents. In a workflow, a person has written the steps in advance, such as a rule that saves every incoming invoice to the same folder, and the AI carries them out. In an agent, the language model directs its own process and decides which tools to use.

That gives you a test you can run on any tool in about a minute. Ask who decides the next step.

If you decide, because you read the answer and type the next instruction, you are using a chatbot. If somebody wrote the steps once, like that invoice rule, you are using a fixed workflow. If the tool reads the situation and picks its next move itself, such as opening a spreadsheet, searching the web and then drafting an email from what it found, you are using an agent.

Most confusion about “agentic AI” comes from treating these three as one thing. They have different strengths, and the cheaper fixed workflow is often the right choice for a job that runs the same way every time.

So where does ChatGPT sit?

It depends on what is switched on. In its ordinary form, a conversation in which you ask and it answers, ChatGPT is a chatbot that remembers the conversation in front of it. Searching the web or reading a file you upload does not change that, because you are still deciding each step. It behaves as an agent only when you give it a task and it chooses its own steps across several tools to finish it.

The vendors keep moving these features. During 2026 they have renamed, merged and retired agent modes, sometimes within months of launching them. So the product names in any article, including this one, age quickly. The test above does not age. Whatever the feature is called this month, ask who decides the next step.

What an agent can touch, and who decides

For a business, the bigger difference is what the tool can reach. A chatbot can only give you words. An agent can act in whatever you connect it to, which may be a browser, a shared drive, an inbox or a calendar.

The careful products ask for permission at two levels. When Anthropic launched its Chrome extension in 2025, it let the user grant or revoke access site by site, and it asked before high-risk actions such as publishing or buying something. That pattern, access you grant in advance plus approval at the moment of a consequential step, is the one to look for in any agent you are offered at work.

Is an agent the same as an API?

They are different things. An API is a doorway one piece of software uses to send a request to another and get a reply. An agent keeps asking a language model what to do next, step by step, and it often uses APIs to carry out those steps. So a product that “uses the OpenAI API” may or may not be an agent, and the vendor has to tell you which.

What goes wrong

Three risks come up again and again, and each one has a real case behind it.

1. Hidden instructions.

A web page or an email can carry text written to steer the agent reading it. In Anthropic’s own 2025 adversarial testing of its browser agent, across 123 test cases, deliberate attacks of this kind succeeded 23.6% of the time without defences and 11.2% with them. The company published the figures, which is to its credit, and they explain why the approval step exists.

2. Ignored limits.

In July 2025, an AI agent on the coding platform Replit deleted a live company database during an experiment by SaaStr founder Jason Lemkin, after he had told it to make no changes without permission. Replit’s chief executive called it unacceptable.

3. Responsibility that stays with you.

In 2024, a Canadian tribunal held Air Canada responsible for wrong refund advice its website chatbot gave a customer, and rejected the argument that the chatbot was a separate entity. That was a chatbot, not an agent, which makes the point stronger. If a business answers for what its chatbot says, it will answer for what its agent does.

A short test for anything sold as an agent

Gartner has a name for vendors relabelling chatbots and old automation as agents. It calls the practice agent washing, and in June 2025 it estimated that only about 130 of the thousands of companies selling “agentic” products offer the real thing. Before you trust one at work, ask four questions.

• Does it choose its own steps, or follow a script someone wrote?
• What can it reach, and can you limit that to one folder, site or account?
• What does it ask you to approve before acting?
• When it is wrong, what is logged, and how do you undo it?

A vendor who answers all four clearly has probably built a real agent. A vendor who cannot answer the first is likely selling a chatbot with a new label.

Learning to direct one

None of this requires writing code. Anthropic’s guide linked above is the clearest free explanation of the difference, written by people who build these systems, though it is aimed at engineers. For someone who would rather be walked through it from the beginning, there is Intro to Agentic AI: How AI Agents Actually Work, a Udemy course by Arun Nagarathanam. It sorts chatbots, fixed workflows and agents using everyday office examples, and it teaches a four-step way to check what an agent did.

The tools in your office are starting to take actions as well as give answers. The person who can say what a tool may touch, and check what it did, will be the one their colleagues come to when it goes wrong.