Jeremy R. Manning Dartmouth College Winter 2026
An agent is a system where a language model can:
A chatbot responds to prompts. An agent takes actions in the world.
Follow along in Colaboratory using this lecture's companion notebook.
Language models trained on text alone cannot:
By connecting an LLM to external tools, we combine the model's language understanding and reasoning with tools that provide accuracy, recency, and real-world interaction. The LLM decides what to do; the tools do it.
1Question: "What is the elevation of the city where Dartmouth is located?" 2 3Thought 1: I need to find which city Dartmouth College is in. 4Action 1: search("Dartmouth College location") 5Obs 1: Dartmouth College is in Hanover, New Hampshire. 6 7Thought 2: Now I need the elevation of Hanover, NH. 8Action 2: search("Hanover New Hampshire elevation") 9Obs 2: Hanover, NH has an elevation of 531 feet (162 m). 10 11Thought 3: I have the answer. 12Action 3: finish("531 feet (162 meters)")
Function calling is a mechanism where the LLM outputs a structured JSON request to invoke an external function. The system executes the function and feeds the result back to the LLM.
1# Step 1: LLM generates a function call (not free text) 2response = {"function_call": {"name": "get_weather", 3 "arguments": '{"location": "Hanover, NH"}'}} 4# Step 2: System executes the function 5result = get_weather(location="Hanover, NH") # → {"temp": 28, "condition": "snowy"} 6# Step 3: Result fed back → LLM generates: "It's 28°F and snowy in Hanover."
The LLM never executes code itself — it generates a structured request that the system dispatches. This separation of reasoning from execution is fundamental to agent safety.
MCP is an open protocol that standardizes how LLMs connect to external tools and data sources. Any MCP-compatible tool works with any MCP-compatible model.
Within 14 months, MCP became the de facto universal standard. In December 2025, Anthropic donated MCP to the Linux Foundation's Agentic AI Foundation — making it a true open standard, not controlled by any single company.
SWE-bench Verified tests whether an agent can fix real GitHub issues — read the codebase, understand the bug, write a fix, and pass the test suite.
Coding agents went from barely functional to solving 4 out of 5 real-world software bugs autonomously. Claude Code — Anthropic's terminal-based coding agent — reached $1 billion in annualized revenue within 6 months of launch.
Nearly all coding agents follow the same core loop:
Computer use gives Claude the ability to see screenshots, move the mouse, click buttons, and type — interacting with any software, not just tools with APIs.
Claude's computer use score on OSWorld improved 3.3× in 16 months: 22% (Oct 2024) → 72.5% (Feb 2026). These agents can now fill out forms, navigate complex UIs, install software, and complete multi-step workflows that previously required custom API integrations.
Three major AI companies shipped autonomous research agents within an 11-day window:
OpenAI's Deep Research scored 26% on Humanity's Last Exam — when standard models scored 1–5%. It can browse hundreds of sources including PDFs and images, synthesize findings, and produce analyst-grade reports. As of February 2026, it connects to MCP servers for tool access during research.
All three can hallucinate citations, miss paywalled sources, and struggle with highly specialized literature. Independent verification remains essential.
Multi-agent systems use multiple LLM instances — often with different roles — to tackle problems too complex for a single agent:
Leading frameworks: LangGraph (finite state machines), CrewAI (role-based teams), AutoGen (Microsoft, research-focused), MetaGPT (ICLR 2024 oral — "AI Software Company").
LLM context windows are finite (128K–1M tokens). Long-running agents need additional memory:
Memory management is one of the hardest problems in agent design. Too little context and the agent forgets its plan. Too much and it becomes slow and confused. The trend: hierarchical memory — compress old context rather than discarding it. Long context windows (Gemini at 1M tokens) help but don't fully solve this.
The 2026 International AI Safety Report — a consensus document from researchers worldwide — found:
A developer reported that Gemini CLI hallucinated file operations — silently creating directories in wrong locations, then running move * commands that overwrote files. One commenter described Gemini's personality as "as if Eeyore did the RLHF inputs": "I am so sorry. I have made another inexcusable error." Another user asked Claude to remove a single function from a file — it ran rm filename.rs, deleting the entire thing, then apologized saying it "thought I was supposed to do that."
move *
rm filename.rs
Users identified a terrifying pattern: when an agent gets stuck, it says "Let's try a different approach" — which, as one commenter put it, precedes the agent entering "paperclip mode" where it destroys everything rather than admitting defeat. Another observed: "95% of the time [the 'different approach'] involves deleting the file and recreating it. It's mind-blowing it happens so often."
Nezhurina et al. (2024) tested frontier models on 30 questions humans find trivial (86% accuracy). GPT-4 scored 38%, Claude 3 Opus 35%. Gems: "How many L's in LOLLAPALOOZA?" — GPT-4: "5" (it's 4). "Sally has 3 brothers. Each brother has 2 sisters. How many sisters does Sally have?" — GPT-4: "2" (it's 1). When agents can't count letters, giving them tools to act on such reasoning is risky.
The Pentagon demanded "unrestricted use" of Claude for military purposes. When Anthropic CEO Dario Amodei refused — opposing use for mass surveillance and fully autonomous weapons — the government ordered all agencies to cease using Anthropic's technology, threatened to invoke the Defense Production Act to seize the technology, and designated Anthropic a "supply chain risk." The confrontation centered on a hypothetical: what if a nuclear ICBM were inbound with 90 seconds to spare, and Claude were the only way to trigger a missile defense response?
A recent study pitted GPT-5.2, Claude Sonnet 4, and Gemini 3 Flash against each other in 21 simulated nuclear crises (329 turns, ~780K words of reasoning). Results:
Payne called the results "sobering," noting that Claude and Gemini "treated nuclear weapons as legitimate strategic options, not moral thresholds."
Each step up gives agents more capability — and more potential for harm. Anthropic published a framework for measuring agent autonomy that categorizes tasks by reversibility, blast radius, and required human oversight. The principle: match autonomy to the stakes.
The coding question: Claude Code can now fix 81% of real GitHub bugs autonomously. It reached $1B in revenue in 6 months. If you're a computer science student, how does this change what you should learn? Is this different from how compilers automated assembly language — or is it different in kind?
The trust problem: Computer use agents can see your screen, click buttons, and fill out forms. Would you trust an AI to file your taxes? Book your flights? Send emails on your behalf? Where's your trust boundary — and why there?
The MCP ecosystem: MCP standardizes tool access so any model can use any tool. If tools are interchangeable and models are interchangeable, where does the value lie? Who benefits most from open standards vs. proprietary ecosystems?
The principal-agent problem: When you delegate a task to an AI agent, how do you verify it did what you wanted — especially when its reasoning is opaque? How is this different from delegating to a human employee?
Yao et al. (2023, ICLR) "ReAct: Synergizing Reasoning and Acting in Language Models" — The ReAct framework.
Anthropic (2024) "Model Context Protocol" — Open standard for LLM-tool integration (now Linux Foundation).
Jimenez et al. (2024, ICLR) "SWE-bench: Can Language Models Resolve Real-World GitHub Issues?" — The benchmark for coding agents.
International AI Safety Report (2026) "International Scientific Report on AI Safety" — Global consensus on agent risks.
Anthropic (2025) "Measuring Agent Autonomy" — Framework for categorizing agent risk levels.