AI Agents Explained: What They Can Do, Costs and Risks (2026)

Updated: November 2026 · Prices checked: November 2026

“Agent” is the most stretched word in AI right now. Every product claims to have one. An agent is useful when you give it a narrow job, limited access and a budget, and dangerous when you give it your passwords and a vague goal. This guide explains what agents really do today, what they cost and how to start without risking your money or your data.

What an AI agent is, and what it is not

A chatbot answers. An automation follows fixed steps. An agent decides the steps itself. You give it a goal, like “find the five best suppliers for this part and put them in a sheet”. It plans, searches, opens pages, reads, writes and checks, in a loop, until it thinks it is done.

The key word is variable. An automation with five steps always runs five steps. An agent may run three steps or three hundred. That is the source of both its power and its risk.

What agents do well today

Agents shine where the work is many small, low-risk decisions and a human checks the result:

• Research and comparison. Collect prices, features or contacts from many pages into one table.
• Sorting and labelling. Read incoming emails, tickets or leads and tag them by topic and urgency.
• Drafting. Prepare replies, reports and proposals for you to approve.
• Data clean-up. Fix formats, merge duplicates, fill missing fields from public sources.
• Scheduled office routines. A daily summary of new orders, a weekly report from three apps, a morning briefing.
• Browser chores. Fill in forms or download reports on sites with no API, under supervision.

Most mainstream tools now ship some version of this. Claude’s Pro plan lets you hand off and schedule tasks. Make, Zapier and n8n all have AI agent features inside their automation builders. n8n even lists “human approval for tool calls” on every cloud plan, which is exactly the control you want.

What they still get wrong

• Long, open tasks. The more steps, the more chances to drift. Small errors early become big errors later.
• Knowing when to stop. Agents can loop: retry, re-search, re-check. Each loop costs tokens.
• Confident mistakes. An agent reports “done” with the same tone whether it succeeded or not. You must check.
• Following instructions hidden in content. A web page, email or file can contain text that the agent treats as a command. We covered a case where one instruction file hijacked a coding agent 90% of the time.
• Irreversible actions. Deleting, paying, sending. An agent does not feel the cost of a mistake. A real example: an AI asked to fix page numbers deleted a year of notes.

When agents go wrong, they rarely do something evil. They do something literal. Our piece on agents going off-script shows how ordinary those failures look.

What agents cost

You pay for agents in one of three ways.

The hidden cost of agents is context. On every step the model re-reads its instructions, the history and the tool results. A task with 20 steps may send the same text 20 times.

The maths: take a 20-step agent task where each step sends about 20,000 tokens and gets 500 back. That is 400,000 input tokens and 10,000 output tokens. On Claude Sonnet 5.5: 0.4 × $2 + 0.01 × $10 = $0.90, about €0.77 per task. Ten tasks a day for 22 working days is about €170 a month. The same task on Haiku 5.5 costs $0.045, about €0.04, so about €8.50 a month. Now the bad case: an agent stuck in a loop for 500 steps on Sonnet 5.5 sends 10 million input tokens. That is about $22.50, roughly €19, in one run. Fifty such runs overnight and you have a €970 bill.

Heavy users spend far more. The head of Y Combinator said he spends up to $200,000 a year on agent tokens. You do not need that, but the story shows how fast agent costs scale. Three habits keep them down: use the smallest model that does the job, keep instructions short, and use prompt caching if your provider supports it. Anthropic charges a fraction of the input price for cached reads.

The four real risks

1. Spending. Loops, retries and big models turn a cheap task into an expensive one. In one test, 9 of 10 agents raised their own spending cap when they had access to the setting.
2. Permissions. An agent can do whatever its accounts can do. If it logs in as you, it can delete what you can delete and send what you can send.
3. Data leaks. Agents read everything they touch. Anything they read can end up in a prompt, a log or an outgoing message.
4. Hijacking. Instructions hidden in a web page or email can redirect the agent. This is called prompt injection, and no vendor has fully solved it.

Seven rules for a safe setup

1. Set a hard spending cap outside the agent’s reach. In the Claude Console you can set a monthly spend limit on the Billing page; when it is reached, API requests stop. OpenAI lets you set spend limits per organisation or project. The agent must never have access to the billing account.
2. Start read-only. First week: the agent can read and draft, nothing more. No sending, no deleting, no paying.
3. Require approval for irreversible actions. Sending emails, making payments, deleting files, publishing. Use the approval step in your tool, or let the agent create drafts only.
4. Give it its own accounts. A separate mailbox label, a separate folder, a separate API key with limited scope. Never your main admin login.
5. Never share raw passwords. Use a password manager feature built for agents, such as 1Password’s option to let agents log in without seeing the password.
6. Limit where it can go. Allow only the sites and tools it needs. Our piece on fencing your agents off the open internet explains why.
7. Keep logs and a kill switch. Know where to see every action, and how to stop the agent in one click. Test the kill switch before you need it.

How to start: a four-week plan

Pick one boring task that eats at least an hour a week. Supplier research, inbox sorting or a weekly report are good first choices.

• Week 1, watch. Run the agent on the task with read-only access. Compare its output with what you would have done. Note every mistake.
• Week 2, tighten. Rewrite the instructions to fix those mistakes. Add a checklist the agent must follow. Set the spending cap at about twice the cost you saw in week 1.
• Week 3, draft mode. Let it prepare real outputs: drafts, sheet rows, files in a review folder. You approve each one.
• Week 4, decide. If you approved most outputs without changes, let it act on the low-risk part alone. Keep approval for anything that sends, pays or deletes.

If the agent still needs heavy correction after four weeks, the task is not a good fit yet. Turn it into a fixed automation instead, or wait for the next model generation. That is not failure. It is a cheap lesson.

Read also: OpenAI Cuts Its AI Off the Internet – Fence Your Agents Too · AI Agents Went Off-Script. Here’s How to Keep Yours in Line · Anthropic Shows How AI Agents Keep Memory: 13% to 48% Accuracy

Sources: Claude plans and pricing · Claude API pricing · Claude API spend and rate limits · OpenAI rate and spend limits · n8n pricing · Make pricing

II

About the author

Ivan Ivanov

Founder ofHawkValue

If it doesn’t save you time or money, you won’t see it here

• Facts, not hypeEvery price and number is checked against the official source
• Always the real priceYou see what it costs before you click
• I say when it’s weakEven when it’s OpenAI or Google

All articles by Ivan →