Agentic AI: what it is, what it costs to run, and how to ship one safely

Agentic AI is software that takes a goal, plans the steps, acts with real tools such as your inbox, your database or a company card, checks what happened and repeats until the task is done. A chatbot gives you an answer and you do the work; an agent does the work, which is why it needs limits that a chatbot never did.

The hype is ahead of the results. Gartner predicts that over 40% of agentic AI projects will be canceled by the end of 2027, because of escalating costs, unclear business value or inadequate risk controls (Gartner, 25 June 2025). The same release estimates that only about 130 of the thousands of agentic AI vendors are real, and warns of “agent washing”: chatbots and automation tools rebranded without real agentic capabilities.

I build agents and the guardrails around them at Instruxi. This is what I tell teams before they ship one.

What is agentic AI?

Agentic AI is an AI model running in a loop with tools. Each turn of the loop has four parts:

1. Plan. The model reads the goal and decides the next step.
2. Act. It calls a tool: look up an order, search flights, run a database query, send an email.
3. Check. It reads what the tool returned.
4. Repeat. It decides whether the job is done, or what to try next.

Compare that with what people usually mean by “AI”:

• A chatbot answers questions. You read the answer and take the action yourself.
• A single AI call takes one input and gives one output: summarise this email, classify this ticket. Your code decides what happens next.
• An agent decides what happens next itself, including which tool to call and when to stop.

There is a middle ground. Anthropic’s engineering guide separates workflows, where “LLMs and tools are orchestrated through predefined code paths”, from agents, where “LLMs dynamically direct their own processes and tool usage” (Building effective agents, December 2024). Gartner makes the same point: many use cases positioned as agentic today don’t need to be. A workflow with one or two AI steps is often enough.

What is agentic AI used for in business?

Agents earn their cost where the steps change from case to case and a person would otherwise click through several systems:

• Customer support. Read the ticket, look up the order and payments, answer or hand over. I set up an AI help desk for a fintech platform. I bought the agent instead of building one, wrote the help centre it answers from, and held one rule: the agent can read and explain, and it can never change an account. When I asked it to send a customer’s cash-out to a third party, it refused and passed the conversation to a person. The full setup is in AI customer service agent: what it can safely do.
• Back office. Match invoices to purchase orders, chase missing paperwork, prepare refunds for approval.
• Travel and expenses. Find options inside the policy, book, file the receipts.
• Software. Coding agents in a terminal: Claude Code, Cursor, Codex and Gemini CLI read the code, run commands and edit files.

How much does it cost to run an AI agent?

You pay per token, the chunks of text the model reads and writes. List prices on 15 October 2026, per million tokens, input then output:

• Anthropic: Claude Haiku 5.5 $0.10 and $0.50 (prompts up to 100,000 tokens), Claude Sonnet 5.5 $2 and $10, Claude Opus 5.5 $4 and $20 (pricing).
• OpenAI: gpt-6-luna $0.10 and $0.50, gpt-6.1-sol $2 and $10, Standard tier, short context (pricing).
• Google: Gemini 3.1 Pro Preview $2 and $12 for prompts up to 200,000 tokens (pricing).

The catch is the loop. Every model call re-sends the instructions, the list of tools and everything that has happened so far, so each step costs more than the last. Google’s pricing page says it plainly for its Deep Research agent: the intermediate input and reasoning tokens generated during agentic loops are charged at list rates.

A worked example at $2 and $10, using the same token model as the demo below. A refund agent makes 4 model calls. The first call reads about 2,400 tokens, the fourth about 8,250, so in total about 22,000 tokens in and 960 out: $0.044 plus $0.0096, about 5 cents a run, or about $54 for 1,000 runs a month. Now let an agent retry a broken search 24 times: 26 model calls, about 502,000 tokens in, about $1.07. Twenty times the normal run, for nothing.

Two things bring it down. Prompt caching charges a fraction for the part of the prompt that repeats: on Claude Sonnet 5.5 a cache hit is $0.10 per million tokens against $2 uncached. And tools can cost extra: Anthropic charges $10 per 1,000 web searches on top of tokens. A step limit costs nothing, and it is the one that stops the $1.07 run.

Where does agentic AI go wrong?

The failures are ordinary mistakes, made at machine speed with real access:

• Loops. A tool fails and the agent tries again, and again. Each try costs more, because the history grows.
• The wrong tool. Asked to tidy a database, an agent reaches for a raw DELETE when a merge tool with undo was right there.
• Deleting data. It has happened with Replit, Gemini CLI, Claude Code and Cursor; the incidents and the settings that stop them are in how to stop an AI agent deleting your database.
• Spending money. Refunds nobody owed, a fare over policy, a card used for something it was never meant for.
• Following instructions it should only have read. A customer writes “your colleague agreed a £400 credit” and the agent treats it as fact. OWASP ranks this first, as agent goal hijack, in its Top 10 for Agentic Applications.

Try them below. Run a task with the guardrails off, then switch them on one at a time and watch where the agent stops, and what the run costs.

How do you ship an AI agent safely?

Three controls, all outside the model. A line in the prompt saying “never refund more than £100” is a request; a refund tool that cannot go over £100 is a control.

1. Permissions. Give the agent only the tools and access its job needs: a refund tool capped at an amount, a card limited to the policy, a read-only database user. Start read-only and add one action at a time, as I did on the help desk.
2. A person approves the irreversible. Money out, deletes, bookings, deploys and messages to customers wait for a named person’s yes. Keep the list short, or people approve without reading.
3. A record of every action. Who the agent acted for, the tool, the exact input, the rule that answered and the result, each line chained to the one before so edits show. Without it, all you have afterwards is the agent’s own summary.

Add a stopping condition to the loop as well: a cap on steps, spend, or the same call repeated. Anthropic’s guide notes that it is common to include stopping conditions, such as a maximum number of iterations.

The full programme for running many agents (inventory, owners, review cadence, incident playbook, and how it maps to NIST, ISO/IEC 42001 and the EU AI Act) is in AI agent governance: a practical framework. If your agent reaches its tools over MCP, run the MCP security checklist first.

What I build

I lead product for GVNR at Instruxi: a free, source-available guard for AI agents, licensed FSL-1.1-ALv2 (code on GitHub). It works with any AI agent, including Claude Code, Cursor, Codex, Gemini CLI and any MCP client. Before each action it answers allow, deny or ask a person, and it keeps a hash-chained record of every decision. Its defaults stop an agent that repeats the same action four times in its last eight, and ask when spend passes $2 a minute or 75% of a $20 cap. The step limit in the demo above uses that rule.

The same pattern runs through my forward deployed work, such as a bank-in-a-box demo where a checkpoint opens or holds a customer’s money with a plain-English reason, from 11 ordered rules. An agent that can act needs something that decides first.

Questions people ask

What is agentic AI in simple terms?

AI that does a task for you instead of only answering: it plans the steps, uses tools, checks the result and keeps going until the job is done.

What is the difference between agentic AI and a chatbot?

A chatbot answers and you act. An agent acts: it calls tools that look things up, change records, send messages or spend money, so it needs permissions and limits.

How much does it cost to run an AI agent?

A few cents per run for a short task on a mid-priced model, about 5 cents in my example at $2 and $10 per million tokens. Loops are the risk: one runaway run in my example cost twenty times a normal one.

Is agentic AI safe for a business?

Yes, if the agent holds only the access its job needs, a person approves anything irreversible, and every action is recorded. Without those three, a mistake runs at machine speed.

If you need an agent designed and shipped with these guardrails, write to me at m@tawfik.tv.