Start here: AI, from autocomplete to agents

The name is older than the technology most people now mean by it. "Artificial intelligence" was named in a 1955 proposal by John McCarthy, Marvin Minsky, Nathaniel Rochester and Claude Shannon, for a two-month study at Dartmouth in the summer of 1956. For seventy years the term has covered many methods. This page uses it in the narrow sense of the chat apps: a large language model, an LLM. It covers what an LLM is, what it costs, and how far it can be left to run on its own.

At bottom, an LLM predicts what comes next. It is trained on a large body of text "to predict the next word, given the previous context" (Anthropic glossary, Pretraining). Carl Bergstrom and Jevin West put it in one line: "Fundamentally, large language models are autocomplete systems" (Bergstrom and West).

To score what comes next, the model needs a way to say which words relate. It turns each word into a list of numbers, a vector, which works as a position in a space with many dimensions. Related words land close together. A 2013 method called word2vec showed that vectors learned from large amounts of text can measure "syntactic and semantic word similarities" (Mikolov et al.). OpenAI's guide states the rule in one line: "The distance between two vectors measures their relatedness" (OpenAI, embeddings).

The design behind today's LLMs is the transformer, from a 2017 paper titled "Attention Is All You Need" (Vaswani et al.). Its core move, attention, "enables every token to attend to every other token across the entire context" (Anthropic, context engineering). Each word checks every other word before the next one is chosen.

The text the model can see in one go is its context window: "all the text a language model can reference when generating a response, including the response itself", a "working memory" (Anthropic, context windows). In a chat app, each turn sends the whole conversation back in, all the history plus the new message, and the reply becomes part of the next turn's input (same page).

Because the model predicts a likely continuation, it can write text that reads right and is wrong. A 2025 paper describes models that "guess when uncertain, producing plausible yet incorrect statements", and finds that training and testing "reward guessing over acknowledging uncertainty" (Kalai et al.).

Models read and write tokens, pieces of text that "can correspond to words, subwords, characters, or even bytes" (Anthropic glossary). OpenAI's rule of thumb: "1 token is approximately 4 characters or 0.75 words for English text" (OpenAI, key concepts), so a token is about three quarters of a word. The ratio varies by model and language: for Claude, "the number of characters a token represents depends on the model and the language" (Anthropic glossary), and on the newest Claude tokenizer a million tokens hold about 555,000 words, against 750,000 on earlier models (Anthropic, models overview).

A model is one trained system, and makers ship them in sizes. As of 2026-11-01, Anthropic offers Claude Haiku "for high-volume, latency-sensitive tasks", Sonnet as "the best combination of speed and intelligence", Opus "for long-running agentic coding and knowledge work" and Fable "for demanding reasoning and long-horizon agentic work", priced from $0.10 to $10 per million input tokens (Anthropic, models overview).

The same model can also run harder or lighter. Anthropic's effort setting trades "response thoroughness and token efficiency with a single model" (Anthropic, effort); OpenAI's reasoning.effort "guides the model on how much to think when performing a task" (OpenAI, reasoning).

How much a person must do while a machine works is an old question. Levels of automation were first drawn up for remote-controlled undersea machines, in 1978 work by T. B. Sheridan, W. L. Verplank and T. L. Brooks at MIT (NASA record). In 2012 Human Rights Watch set out three terms for weapons that now fit any automation: in the loop, machines that act "only with a human command"; on the loop, machines that act "under the oversight of a human operator who can override" them; out of the loop, machines that act "without any human input or interaction". This page keeps the first two and names the third level the way it shows up with LLMs: agentic.

On the loop, one person watches many machines. Human-robot research calls this fan-out, "the number of robots that a user [can] effectively operate at once", and it has a price: "As fan-out increases, interaction effort also increases" (Olsen and Goodrich, 2003).

At the agentic level, the watching itself moves to machines. In software, a monitor tracks total memory use and stops a build before it crashes the computer, whatever the person asked for. A weather agent flags another system when a storm is coming in. The name for this level, machines monitoring machines, is Island Lab's own framing of the space Human Rights Watch calls out of the loop.

1. Chat. A person types and the model answers. In the loop: every step waits for a human.
2. The terminal. A coding tool runs the model beside the files, so it can read, edit and run code while the person approves its steps.
3. Several terminals at once. Sean ran several sessions side by side with tools like Cursor, moving between them: on the loop.
4. Agents on loops. An agent is an LLM "using tools based on environmental feedback in a loop" (Anthropic, building effective agents). One checks the weather, one the price of oil, one searches for new research once a day; each compiles what it finds and flags another system when something changes. Agentic.

What plugs agents into tools and data is usually an MCP server. The Model Context Protocol is "an open-source standard for connecting AI applications to external systems", in its makers' words "like a USB-C port for AI applications" (MCP).

Loops take power: every run spends tokens. In return the system keeps working while nobody types, and what the loops gather feeds new work, such as a page built from everything they collected, held to standing rules like "use green only for positive results".

Three things follow. First, newcomers gain most: in support and in writing, the tool narrowed the gap between the least and most experienced. Second, the frontier is jagged: the same tool helps on one task and hurts on the next, and people misjudge which, as the 2025 developers did. At work, then, the output has to be checked.

2. Write the rules down. Instructions repeated in every chat go into a rules file the tool reads at the start of each session: CLAUDE.md for Claude Code, which its /init command drafts and which should stay "under 200 lines" (Claude Code, memory), or AGENTS.md, an open format "used by over 60k open-source projects" (agents.md). A rules file is "context, not enforced configuration": the model reads it and usually follows it.

3. Give every task a check. "Claude stops when the work looks done", so it needs "something it can run that comes back pass or fail": a test, a build's exit code, a linter, a script that compares output with a known answer (Claude Code, best practices). With a check in place, the person can step from in the loop to on the loop.

5. Chain fixed steps before freeing an agent. Most jobs are workflows, fixed steps chained in code: one call feeds the next (prompt chaining), a first call sends the job to the right handler (routing), several calls run at once (parallelization), one model hands out pieces and gathers them (orchestrator-workers), or one model drafts while another grades (evaluator-optimizer) (Anthropic, building effective agents). An open-ended agent suits work whose steps cannot be predicted, at "higher costs, and the potential for compounding errors" (same). Side jobs go to subagents, helper agents each running "in its own context window" with its own tool limits (Claude Code, subagents).

6. Enforce what must always hold. A hook is a command the harness (the program that runs the model and its tools) runs at set points, so "certain actions always happen rather than relying on the LLM to choose to run them" (Claude Code, hooks). Rules that allow no exceptions become hooks; high-stakes actions keep a human approval (OWASP, LLM01).

One risk grows with every step. Prompt injection, text in a web page or file that steers the model, is first on OWASP's list of risks for LLM applications, and retrieval and fine-tuning "do not fully mitigate prompt injection vulnerabilities" (OWASP, LLM01). Simon Willison names the dangerous mix: access to private data, exposure to untrusted content and "the ability to externally communicate"; an agent with all three can be tricked into leaking, and "the only way to stay safe there is to avoid that lethal trifecta combination entirely" (Willison). Anthropic's agent framework opens with "keeping humans in control while enabling agent autonomy", and Claude Code "has read-only permissions by default" (Anthropic, agent framework).