Agents inherit every limitation of the underlying LLM (see Generative AI Limitations) and add new ones specific to taking actions in a loop — compounding errors, unpredictable paths, and genuine safety stakes when tools can affect the real world.
Technical Limitations
| Limitation | What It Means in Practice |
|---|---|
| Compounding errors | A wrong decision at step 2 can cascade into a completely wrong outcome by step 5 — errors compound across a multi-step loop in a way a single LLM call never can |
| Unpredictable paths | The same goal can be reached via different tool-call sequences across runs, complicating both testing and debugging |
| Infinite/repetitive loops | A model can get stuck calling the same tool repeatedly without making real progress. See Infinite Agent Loops. |
| Tool selection errors | The model can choose the wrong tool, or the right tool with wrong arguments |
Operational Risks
- Cost multiplication — an agentic loop makes multiple LLM calls per task, not one; cost scales with the number of iterations, which is harder to predict than a single-call feature
- Latency — multi-step reasoning and tool calls take meaningfully longer than a single response, often a poor fit for latency-sensitive, real-time interactions
- Debugging difficulty — diagnosing why an agent took a particular sequence of actions requires proper tracing (see Agent Observability), not just reading a single response
Safety Risks — Because Agents Can Take Real Actions
- Unintended actions — a misfired tool call can send a real email, modify real data, or spend real money, unlike a plain chatbot's worst case (a wrong sentence)
- Prompt injection — malicious content in retrieved data or tool results can attempt to manipulate the agent's next decision (see Agent Prompt Injection)
- Privilege escalation risk — an agent with broad tool access, if manipulated, has a correspondingly broad blast radius; see Least-Privilege Agents
How This Shapes Real Architecture Decisions
This is exactly why production agent systems build in: strict tool permissions and input validation, iteration limits, human approval for high-impact actions (sending money, deleting data, publishing content), full tracing/logging of every decision and tool call, and evaluation before deployment — not as optional extras, but as the baseline for a responsibly-built agent.
Common Mistakes
- Giving an agent broad tool permissions "to be safe" (in the sense of covering more cases) — this is backwards; broader permissions mean a larger blast radius if something goes wrong
- Shipping an agent to production without any iteration cap or human-approval gate on irreversible actions
- Evaluating only the final answer's quality, ignoring whether the agent's tool choices and intermediate steps were actually correct (see Agent Evaluation)
Interview Relevance
"What's uniquely risky about AI agents compared to a plain chatbot?" — the expected answer centers on real-world action-taking capability and compounding multi-step errors, not just "LLMs can hallucinate" (true, but not the agent-specific part of the answer).
Practice Question
Design three concrete safeguards for an agent that has permission to send emails on a user's behalf.
