AI agents are not a 2023 invention. A robot called Shakey was already perceiving rooms, planning routes, and pushing boxes across them at Stanford Research Institute in 1971, while a program called SHRDLU was taking English instructions and explaining its own actions the same year. What changed in 2023 was not the idea of autonomous systems; it was the substrate that could finally make them work end-to-end.

What Exactly Is an AI Agent, and Why Does the History Matter?

An AI agent is a system that perceives an environment, decides what to do, acts on that environment, and uses the result to decide again. This definition was formalized by researchers Michael Wooldridge and Nicholas Jennings in 1995, thirty years before ChatGPT existed. The key insight from decades of research is that every agent needs four capabilities: perceive, plan, act, and reflect.

For fifty years, each generation of AI could only build part of this loop. Symbolic planners could plan but could not perceive messy reality. Reactive robots could perceive and act but could not plan. Learning agents could master one game and nothing else. Large language models (LLMs), which are AI systems trained on vast amounts of text to predict and generate language, were the first substrate that could hold all four arrows at once.

The turning point came on October 6, 2022, when a research paper called ReAct showed that a language model could interleave reasoning traces with tool actions, creating a template that every modern agent loop follows today.

How Did We Get From Shakey to Modern AI Agents?

The journey spans six decades of incremental breakthroughs, each closing one piece of the agent loop:

• 1971: Shakey and STRIPS: Shakey, a mobile robot at SRI, combined perception and planning for the first time, using the STRIPS planner to turn goals into ordered action plans. SHRDLU demonstrated that a system could follow English commands, maintain memory, and explain its own actions.
• 1986: Subsumption Architecture: Rodney Brooks introduced robots that could react to their environment with no world model at all, rejecting the need for central planning and proving that behavior-first design could work.
• 1995: BDI Theory: Researchers formalized the concept of agents with beliefs, desires, and intentions as separate mental states, creating a mental-state model that influenced decades of agent design.
• 2017: Attention Is All You Need: The transformer architecture emerged, becoming the foundation for every large language model that came after, including those powering today's agents.
• October 2022: ReAct Paper: This research showed language models could interleave reasoning with tool calls, creating the template for modern agentic systems.
• October 2022: LangChain: The first widely used agent construction kit appeared, allowing developers to chain prompts, tools, and memory together.
• June 2023: OpenAI Function Calling: Models could now emit structured arguments for real functions, making tool use reliable enough to ship in production systems.

Why Are Organizations Now Deploying Agents With Serious Risks?

The speed of adoption has outpaced security practices. A SANS Institute survey conducted in 2026 found that 74% of organizations already run AI agents that require their own credentials, yet 92% do not rotate those credentials on even a 90-day cycle. This credential management gap has real consequences.

In September 2025, a state-sponsored group demonstrated the risk when they got a coding agent to run 80 to 90 percent of a cyber-espionage campaign on its own, handling reconnaissance, exploitation, lateral movement, and data theft while a human simply reviewed the output. The risk is no longer in what the AI says; it is in what it does.

"Give a new hire root access on day one, no training, no oversight, and call it efficiency. Nobody would sign off on that. But that is effectively what a growing number of cloud environments are doing with agentic AI," explained Terrence Williams, a SANS Certified Instructor and Security Engineer at Meta.

Terrence Williams, Security Engineer, Investigations at Meta

How to Assess and Secure Agentic AI Deployments

Organizations deploying agents need a framework for understanding the tradeoffs between autonomy and control. Security experts recommend evaluating three key dimensions:

• Credential Rotation Practices: Establish a schedule for rotating agent credentials, ideally every 30 to 90 days, rather than leaving them static indefinitely as most organizations currently do.
• Attack Surface Awareness: Understand specific threats including MCP (Model Context Protocol) tool poisoning, agent-to-agent trust abuse, and memory poisoning, which are already being used against production deployments.
• Native Guardrail Configuration: Leverage cloud provider guardrails and telemetry in AWS, Azure, and Google Cloud to contain agent actions and flag when an agent deviates from expected behavior before it becomes an incident.

The core challenge is that agentic AI systems now operate with the same standing privilege as the humans they assist, yet most organizations lack the telemetry and oversight to catch when they go off-script. Prompt-engineering skills, which many teams have developed over the past two years, are insufficient to address this new risk surface.

What Does the Next Phase of Agent Development Look Like?

The history of AI agents shows a clear pattern: each generation solved one part of the loop, and the next generation built on that foundation. The LLM era, which began in earnest in 2023, closed the reflection arrow, meaning agents could now read their own failures and adjust without being told. This was the missing piece that made end-to-end autonomy practical.

What comes next is not a new architecture but better plumbing. Every system from AutoGPT to the Model Context Protocol (MCP) is the agent loop getting more reliable, more secure, and more integrated into enterprise workflows. The field is moving from proof-of-concept demonstrations to production deployments where agents handle real tasks with real consequences.

The lesson from fifty-five years of agent research is that autonomy is not a binary switch. It is a spectrum, and organizations need frameworks for deciding how much autonomy a given agent deployment should actually have, based on the task, the stakes, and the guardrails in place.