Agentic AI: what AI agents are, and what they can be trusted with

Agentic AI is the shift from AI that answers to AI that does. A chatbot tells you how to compare three suppliers; an AI agent goes and compares them, builds the spreadsheet and hands it back. That is useful, and it is also why agents need more care than chatbots.

This guide explains what agentic AI means in plain words, which agents you can use today, what they can and cannot be trusted with, and what it means for a South African business.

Agentic meaning: from answers to actions

“Agentic” describes AI that acts as an agent on your behalf. An AI agent works in a loop:

1. It takes your goal, such as “find last quarter’s figures and draft a summary”.
2. It plans the steps.
3. It uses tools: web search, your files, email, a spreadsheet, a browser or code.
4. It checks what came back and decides the next step.
5. It finishes, or stops to ask you something.

Anthropic describes an agent’s tools in two groups. Read tools let it see things, such as your inbox or a web page. Write tools let it change things, such as sending an email, deleting a file or clicking a button. Write tools carry more risk, which is why Anthropic recommends human oversight for high-stakes tasks.

Everyday examples of AI agents

The vendors’ own examples give a feel for what agents do:

• Research a set of products, write up a comparison and have it ready when you come back.
• Summarise new messages in your team’s channels every weekday morning.
• Pull account history, recent emails and documents into a brief before a customer meeting.
• Sort an inbox, draft replies and flag the threads that need a person.
• Fix a bug in software, run the tests and open a pull request.

AI agents you can use today

OpenAI retired its earlier ChatGPT agent and now points people to ChatGPT Work for multi-step tasks. ChatGPT’s pricing page shows limited Work access on the free plan in the desktop app, with more on paid plans. Anthropic merged Claude Cowork into Claude, rolling out first to Pro and Max plans. For coding, our Claude Code guide covers costs and safety settings.

Claude Managed Agents, for developers

Claude Managed Agents is Anthropic’s option for businesses that want to build their own agents. It is a set of APIs that runs Claude as an autonomous agent on Anthropic’s infrastructure, with sandboxed code execution, long-running sessions, scoped permissions and tracing handled for you. Anthropic launched it in public beta on 8 April 2026. Its pricing page lists US$0.08 per session-hour of active runtime, about R1 before VAT, on top of normal token costs.

What agents can and cannot be trusted to do

Agents are good at gathering, summarising, drafting and organising: work where a mistake is easy to spot and cheap to fix. They are not yet safe to leave alone with anything that is hard to undo, such as sending money, messaging customers, deleting records or making decisions about people.

The biggest new risk is prompt injection. An agent that reads the web or your email can meet text written by an attacker to hijack it. OpenAI’s own example is an agent booking a group dinner that reads a malicious comment telling it to fetch a password reset code from your email and send it to a stranger’s website. Anthropic’s example is an email that tells the agent to ignore your instructions and transfer money.

Anthropic says such an attack needs two things at once: the agent can read content from outside your trusted sources, and it can take actions that could harm you. Remove either one and attacks become much harder. The vendors build in safeguards: Microsoft says Cowork pauses for approval before sending an email, and Anthropic says Claude always asks before permanently deleting files. Anthropic and OpenAI both say their safeguards reduce the risk but do not remove it.

South African business examples (hypothetical)

These are made-up examples of sensible first agents:

• A plumbing business in Durban. An agent reads WhatsApp enquiries, drafts a quote from the price list and books a provisional slot. A person approves each quote before it goes out.
• An accounting practice in Pretoria. An agent collects documents clients upload, checks what is missing and drafts a reminder email. Staff send the reminders and never give the agent SARS eFiling logins.
• A guesthouse on the Garden Route. An agent answers availability questions and flags complaints to the owner, but cannot change bookings or issue refunds.
• An online shop. An agent checks stock levels each morning and drafts purchase orders. The owner approves every order before any money moves.

The risks: money, customer data and a person in the loop

• Money. Do not give an agent a card, a banking login or a payment tool without spending limits and human approval. Anthropic warns that scheduled tasks run while you are not watching, so avoid scheduling anything that spends money or sends messages on your behalf.
• Customer data and POPIA. If an agent handles customers’ personal information, your business stays the responsible party. POPIA section 71 limits decisions with legal consequences, or that affect someone substantially, made solely by automated processing of their personal information. If the agent runs on servers abroad, section 72’s rules on cross-border transfers apply too. Our guide to AI and POPIA covers the basics.
• A person in the loop. Decide in advance which steps need approval, keep a log of what the agent did, and start with manual approval for anything new. Loosen it only once the agent has earned it.

If you want an agent built around your own systems with these controls in place, that is what Zaiq’s AI automation work covers.

Related guides

• Claude Code: what it is, what it costs in rand, how to start
• Microsoft Copilot in South Africa: which one, and what it costs
• Claude Design: what it makes, what it costs, how it compares
• AI trading bots in South Africa: do they work, or is it a scam?