"AI agent" gets used loosely enough that it's worth pinning down what actually separates one from the autocomplete-style assistant that came before it. A plain code-completion model predicts the next few tokens based on what's around your cursor and stops — it has no memory of whether its suggestion worked, and no way to act beyond suggesting text.

An agent adds a loop around that same underlying model: it can decide on an action (read a file, run a command, edit a line), take that action against a real system, observe the result, and decide on the next action based on what it just saw — repeating that cycle until it judges the task done or it hits a limit you've set. The model itself often hasn't changed much between the two; what changed is the scaffolding that lets it act and re-check rather than just suggest once.

This is why an agent can do things autocomplete structurally can't, like "fix the failing test" — it can run the test, read the failure, edit the code, run the test again, and repeat until it passes or it gives up. Autocomplete has no mechanism to run anything; it only ever proposes text based on static context.

The tradeoff is that agency without a leash is dangerous. Every serious agent tool draws a line around what it's allowed to do without asking — reading files versus writing them, running a linter versus running `rm -rf`, staying inside a sandboxed container versus touching your actual filesystem. The permission boundaries a tool sets, and whether you've reviewed them, matter more with an agent than they ever did with a suggestion you could just not accept.

A useful gut check when a tool calls itself "agentic": can it take an action, observe what happened, and change its next move based on that observation, without you manually feeding it the result each time? If yes, it's an agent by this definition. If it only ever produces a single suggestion per prompt, it's a very good autocomplete — genuinely useful, just a different thing.