Two leading labs publish two different definitions of the word. In a single meeting it covers a lone tool call and a fully autonomous loop. A skeptic's taxonomy of what teams actually mean by agentic — and the four specific things to say instead.
Here is a received belief worth dismantling: that “agentic” is a useful word merely overused, and the cure is to use it more carefully. It is not overuse. A word can be overused and still mean something — “scalable” is exhausted and still points at a real property. “Agentic” has a different problem: it has been stretched across so wide a range of systems that it no longer narrows anything down, and a word that does not narrow anything down is not a tired word. It is an empty one. The distinction matters because the two failures have different fixes, and only one of them is “say it less.”
Watch the emptiness operate. A planning meeting, the architecture review for a new product, four people using “agentic” about the same system — and the meeting runs smoothly, because nobody notices the four of them mean four different things. To the first, “agentic” means the product has a model that can call a function instead of only emitting text. To the second, it means a fixed multi-step pipeline — retrieve, then summarize, then format, the steps wired in advance. To the third, it means a planning loop, where the model chooses its own next step until it decides it is done. To the fourth, it means the thing the risk reviewer is afraid of: a system that runs unsupervised and takes consequential actions on its own. The meeting reaches a decision. The decision means four things. That is the defect this essay is about — not hype, hype is loud and harmless, but a word that manufactures the appearance of agreement between people who have not agreed.
“Agent” had a definition before any of this, and it was not vague. The standard artificial-intelligence text, Russell and Norvig, defines an agent as anything that perceives its environment through sensors and acts upon it through actuators, and a rational agent as one that acts to achieve the best expected outcome. That is a genuine definition with three parts: a perception component, an action component, and a criterion for what counts as acting well. It is decades old, it predates the current boom by a generation, and it comfortably described thermostats, chess programs, and route planners without anyone feeling the term was under strain.
Notice what that older definition did not do: it did not gesture at autonomy as a vibe. It pinned the concept to observable structure — find the sensors, find the actuators, identify the objective, and you could say with confidence whether the word applied. The boundary was inspectable.
The current usage did not refine that definition or replace it with a better one. It inflated it — stretched a term that pointed at a specific structure across a range so wide, from a single function call to an unsupervised operator, that the structure dropped out. What is left is the connotation: “agentic” now signals modern, autonomous, impressive without committing to any architecture that would make those adjectives checkable. The word kept its glow and lost its referent, and a glowing word with no referent is the most dangerous kind to put in a document, because it reads as precise to everyone and means something different to each of them.
The clearest evidence that “agentic” no longer carries a fixed meaning is that the two organizations with the most authority to fix one have published two different definitions — and, worse than merely different, definitions along two different axes, which means they do not even disagree about an answer, they disagree about the question.
Anthropic, in its guidance on building effective agents, draws a control-flow line. Workflows are “systems where LLMs and tools are orchestrated through predefined code paths.” Agents are “systems where LLMs dynamically direct their own processes and tool usage.” Those are two genuinely distinct things, and the distinction is sharp: it turns on who picks the next step, your code or the model. But then the guidance files both of them under the umbrella term “agentic systems.” So in Anthropic’s own careful, deliberate usage, “agentic” already spans a fixed predefined pipeline and a self-directing loop at the same time — the umbrella covers both children.
OpenAI, in its work on governing agentic AI systems, defines the property along a different axis entirely — not control flow but supervision, and not a category but a degree: “the degree to which a system can adaptively achieve complex goals in complex environments with limited direct human supervision.” That is a dial, not a box. A system is more or less agentic depending on how much human oversight it still requires.
Sit with how deep that disagreement runs. It is not two teams giving slightly different wordings of one idea. One has built a taxonomy — a system is in one bucket or another based on who controls the loop. The other has built a spectrum — a system sits on a line based on how supervised it is. A system can be a “workflow” in Anthropic’s scheme (predefined paths) while sitting high on OpenAI’s spectrum (little supervision), or an “agent” in Anthropic’s scheme while sitting low on OpenAI’s. The two definitions can disagree about the same system without contradicting each other, because they are not measuring the same thing. When the two leading authorities cannot agree on what axis the word even lives on, the word is not a definition waiting to be tightened. It is a mood.
The academic literature, which is supposed to be the place terms get disciplined, did not converge either — it diversified. Within a few weeks of each other, two large survey papers on LLM-based agents appeared: “The Rise and Potential of LLM Based Agents” (arXiv 2309.07864) and “A Survey on LLM based Autonomous Agents” (arXiv 2308.11432). Each imposed its own framework on the term — its own decomposition of what an “agent” is built from. The cognitive-architectures work, CoALA (arXiv 2309.02427), decomposed “language agent” along a third set of dimensions again: memory, action space, decision procedure.
Three serious, useful papers, published inside one season, all surveying the same object — and three different structural definitions of what that object is. This is not a criticism of the three; each framework is internally coherent and earns its keep. It is a measurement of the word. A term is healthy when the survey literature built to organize a field can agree on what the field’s central object is. “Agentic” could not anchor even that — and a word too loose for a survey is far too loose for a contract.
The situation is not hopeless, because the looseness is not infinite. When someone says “agentic,” they almost always mean exactly one of four things. The four are real, distinct kinds of system, and naming them is most of the cure.
sense who owns the control flow the risk surface
────────────────────── ────────────────────────── ─────────────────────────────────
A tool-calling trivial — a single call the tool: a bad call, bad arguments
B scripted pipeline your code, fixed in advance the quality of each step
C planning loop the model, in a loop the loop: runaway iterations, cost
D autonomous operator the model, unsupervised the real-world consequencesThese are four different products. They have different architectures, different cost shapes, and — the part that actually matters — different risk surfaces. A sentence that says “we are building an agentic system” and means Sense A is making a small, almost mundane claim. The identical sentence meaning Sense D is making a claim that should stop the room and trigger a formal review. The word flattens the distance between “a model can call one function” and “a system acts in the world unsupervised” down to nothing, and that distance is the single most important thing a reader of the spec needs to know.
This is the same defect the eval-driven-development essay identifies in a loose requirement: a word that admits multiple readings lets two people sign the same sentence having agreed to different things. The cost is not abstract, and it lands differently in each kind of document. “Agentic” in a product spec means four engineers can build along four architectures and each one can defensibly claim conformance — the spec did not constrain them, so it cannot adjudicate between them. “Agentic” in a contract means the scope of work is whatever the reader needs it to be, which means it will be litigated as whatever the reader needs it to be.
“Agentic” in a risk review is the worst case of the three. A risk reviewer’s entire job is to tell Sense A from Sense D — whether the thing in front of them is a model calling a function or a system acting unsupervised in the world, because those demand wildly different scrutiny. And “agentic” is precisely the word that refuses to tell them: the team hands the reviewer the one term that collapses the distinction the reviewer exists to draw. Either they treat every “agentic” system as Sense D and over-review the trivial ones into the ground, or treat them as Sense A and wave an autonomous operator through. The word does not let them be right.
There is a better axis already available, sitting in the literature. The work on levels of autonomy for AI agents (arXiv 2506.12469) defines escalating levels — each named by the human role it leaves room for — and argues that autonomy should be “a deliberate design decision, separate from capability.” That is the move. Stop describing a system with an adjective that collapses the autonomy axis into a glow, and state the autonomy level outright.
The fix costs exactly one sentence. Instead of “it’s agentic,” say which of the four senses it is, and on the autonomy question, name the level. “It calls tools.” “It runs a fixed three-step pipeline.” “It plans its own steps in a loop, with a budget cap.” “It operates unsupervised within these stated boundaries and escalates outside them.” Each of those is a few words longer than “agentic.” Each of them, unlike “agentic,” actually specifies the system — its architecture, its cost shape, and the kind of review it has earned.
None of this is an argument against building any of the four — Sense A and Sense D are both legitimate products, and so are the two between them. It is an argument against the word, the one that lets a team build one of the four and a reviewer sign off on a different one without either of them noticing the swap. “Agentic” is not a wrong word. It is an empty one, and emptiness in a spec is not a stylistic blemish you can fix in the edit pass. It is an unspecified system with a signature on it.
A short pre-flight check. If “agentic” is about to appear in a spec, a contract, a risk review, or a design doc, run the sentence through this first — and if any box stays unchecked, the word is still doing the hiding this essay describes.
The word survived because it sounds like a specification and costs nothing to write. Take away the sound, and what it specified was never there.
Our taxonomy argued prompt injection is a vulnerability class you contain, not a bug you fix. Here is the quantitative half — against the strongest published defenses, indirect-injection attack success stays high, and for agents that can act it stays alarming.
10 min →
A quality-ascending curriculum beats random shuffling — until a decaying schedule delivers your best data exactly when the learning rate is too small to absorb it. The same coupling flips proxy-model ablations: which dataset wins depends on the schedule, not the data alone.
13 min →
An agent workflow that pauses for human approval and then resumes looks safe — a person clicked approve. But the approval decision and the authority the resumed step runs under are two different objects, and most systems conflate them by carrying the approval as an in-band signal the resumed call trusts. That is a confused-deputy bug: a forged resume, a replayed request, or an approval granted at one gate authorizes an action it was never meant to. The fix is to stop transporting approval and start deriving authority from the trusted approval record at resume time, scoped to the exact suspended step — capabilities enforced at the tool boundary, fail-closed by default.
14 min →