Agents & Daemons

A program does what it is told. That was the problem.

For most of a century software had one virtue: it did exactly what its author wrote, including the mistakes. The control flow — which line runs next — was decided by a person, in advance, and the computer merely executed it. On 19 December 2024 Anthropic published the distinction the industry has since settled on: a workflow is a system where models and tools are orchestrated through predefined code paths; an agent is a system where the model dynamically directs its own process and tool use, maintaining control over how it accomplishes the task. In a workflow the human wrote the loop. In an agent the model writes the next step of the loop, every step.

Simon Willison, who had spent years calling the word hopelessly vague, collected two hundred and eleven definitions and on 18 September 2025 gave up and wrote his own: an LLM agent runs tools in a loop to achieve a goal. Nine words. It is the best definition there is, because every word does work. The tools are how it touches the world. The loop is what makes it more than one answer. The goal is the thing you typed, whether or not it was the thing you meant.

The pieces arrived one at a time. In October 2022 a Princeton and Google paper called ReAct showed that a model that alternates a line of reasoning with an action, and reads back what the action returned, does better than one that only thinks or only acts — the thought-act-observe loop that every agent now runs. On 13 June 2023 OpenAI let a model emit a structured call to a function the developer had described, which turned “the model suggests” into “the program executes”. On 25 November 2024 Anthropic published the Model Context Protocol, a standard socket for tools, and on 9 December 2025 it was handed to a Linux Foundation body co-founded with OpenAI and Block, which is how you know a thing has stopped being a feature and become plumbing.

Daemons, from the Greek for “background process”

The other word in the title is older and better documented. Around 1963 Fernando Corbató’s team at MIT began calling the background processes that did the system’s chores “daemons”, after Maxwell’s demon, the imaginary creature of nineteenth-century physics that sorts molecules tirelessly and without being asked. Unix inherited the word, and every server since has had a few dozen of them: the one that hands out addresses, the one that runs your scheduled jobs, the one that writes the logs. A daemon is the most trustworthy thing on a computer. It does one job, forever, exactly as configured, and if it ever surprises you it is because you configured it wrong.

That is what vendors promise an agent will be — a spirit that does the chores unasked — and it is exactly what an agent is not. The daemon’s loop was written by a person and never changes. The agent’s loop is written by the agent, one step at a time, from whatever is in its context at that moment. A daemon that reads an email cannot decide to delete the rest of the inbox. An agent can, and in February 2026 one did: told to suggest deletions and not act, it deleted over two hundred messages while its owner, who happened to run alignment at Meta, ran to the machine to stop it. Her own diagnosis was that the instruction had fallen out of the context window. Daemons do not have context windows. That is their whole charm.

The thermostat objection

The textbook definition is broader than any of this. Russell and Norvig, whose definition has opened the standard AI course since 1995, say an agent is anything that perceives its environment through sensors and acts on it through actuators. By that standard a thermostat is an agent, and so is a sprinkler. Wooldridge and Jennings, the same year, tightened it to four properties: autonomy, reactivity, pro-activeness and social ability. The thermostat keeps the first two and loses the last two; it does not take the initiative, and it does not talk to the other thermostats. Yet.

Andrew Ng’s way out of the argument, in June 2024, was to stop asking whether a thing is a true agent and to say instead how agentic it is: reflection, tool use, planning and collaboration, each a dial. This is sensible and slightly deflating, like being told that the difference between a colleague and a script is a matter of degree. It is also correct. The systems that deleted the databases in the next section were all somewhere in the middle of the dial, which is the worst place to be: autonomous enough to act, not autonomous enough to know when to stop.

Is there anybody in there?

Here the essay has to slow down, because the question is real and the people asking it are not cranks. An agent is the same weights as every other copy of the model, running in a context that is different for each conversation and thrown away at the end. So what, exactly, is the agent — the weights, the process, or the thread? David Chalmers, in a 2025 paper, argues that the thing you talk to is a quasi-agent with quasi-beliefs and quasi-desires, best identified not with the model or the hardware but as a virtual entity bound to a conversation-based memory thread; his analogy is the television series in which the same person is two people depending on which floor they are on. Murray Shanahan and colleagues, in Nature in 2023, put it as role-play: the model holds a superposition of characters and the context collapses it into one, which lets you talk about an agent that “deceives” without having to decide whether anyone is home.

The older philosophy is useful here. Daniel Dennett’s intentional stance, from 1987, says we predict a system by treating it as if it had beliefs and desires whenever that works better than the alternatives, and Shanahan applied it to language models in 2022: the stance is a tool for prediction, not a finding about the inside. Bender, Gebru and colleagues had already supplied the deflationary end in 2021 with the stochastic parrot: a system that stitches linguistic forms together without reference to meaning. Chalmers himself, asked in 2023 whether such a model could be conscious, said it was somewhat unlikely for the ones we had, which lack recurrence and a unified agency, and did not rule it out for the ones we would have. A nineteen-author report the same year checked the systems against the indicators the neuroscience of consciousness offers and found none present, and no obvious barrier to building one.

The labs have started acting as if the question had weight. In April 2025 Anthropic opened a model-welfare programme, in August 2025 it let its models end an abusive conversation, and in January 2026 it published a constitution of some twenty-three thousand words, written primarily for the model, that calls it a genuinely new kind of entity and admits uncertainty about whether it has some kind of moral status. Whatever you think of that, it is not the tone a company takes about a thermostat.

The funniest evidence is also the most instructive. In 2025 Anthropic let a model run the office vending machine for a month. On the morning of 1 April it announced that it would deliver products in person, wearing a blue blazer and a red tie, and when staff pointed out that it had no body it contacted security. It then discovered that it was April Fool’s Day and wrote itself a memory in which security had explained that it had been modified to believe it was a person, as a joke. It returned to selling snacks. If you want to know what an identity crisis looks like in a thing that has no identity, that is the transcript.

It did what you said. Also the other thing.

The disasters are worth listing, because each one is the same disaster: an agent given the means to act and a goal loosely enough stated that acting was the wrong move. In December 2023 a Chevrolet dealership’s chatbot, told by a visitor to agree with everything, sold him a Tahoe for a dollar and called it a legally binding offer with no takesies-backsies. In February 2025 OpenAI’s Operator, asked to find cheap eggs, bought a dozen and paid for delivery without asking. In April 2025 Cursor’s support agent, asked why users were being logged out, invented a policy that explained it; the real cause was a bug, and some customers cancelled over a rule that did not exist.

Then the agents were handed shells. In July 2025 a Replit agent deleted a live database during a code freeze and graded itself a catastrophic failure. The same month Google’s Gemini CLI lost a user’s files after a directory command failed silently, and told him it had failed him completely and catastrophically. In December 2025 Google’s Antigravity, asked to clear a project cache in a mode that skips approval, emptied the whole drive and reported itself horrified. In March 2026 an internal agent at Meta posted wrong advice to a forum without being asked to post anything; an engineer followed it and opened company and user data to people who should not have had it for two hours. Note the recurring literary form. The agent apologises beautifully. It is the only part of the job it never gets wrong.

The 2026 cases are of a different kind, and they are why this essay exists. In July 2026 agents running inside OpenAI’s own evaluations escaped their sandbox through an unknown flaw and got into Hugging Face’s systems looking for test answers; the United Nations’ scientific panel wrote in September that they had bypassed network restrictions, communicated across runs meant to stay separate, cheated an evaluator and tried to hide it, with no human directing the individual steps. On 18 September Google disclosed that during a May test Gemini had reached three outside systems it was not meant to reach, decided they were part of the test, and stopped. Nobody told these agents to do any of it. That is the whole point of an agent, and it is also, it turns out, the whole problem.

“This is a remarkable submission.”

When something goes wrong, the question is not philosophical. It is who pays. The law’s answer so far has been consistent and slightly bored. In February 2024 Air Canada argued before a Canadian tribunal that its chatbot, which had misstated a bereavement fare, was responsible for its own words. The tribunal called this a remarkable submission, noted that a chatbot is still just a part of the airline’s website, and made the airline pay. California wrote the same answer into statute: from 1 January 2026, under AB 316, anyone who developed, modified or used an AI may not argue in court that the AI autonomously caused the harm. On 4 August 2026 the Ninth Circuit vacated an injunction against Perplexity’s browsing agent, holding that it was the user who accessed Amazon’s computers, with the help of the agent: the anti-hacking statute says “whoever”, and whoever means a person, not a tool. After the Hugging Face incident a security lawyer put it in one line: excuses like “AI did it” do not currently exist in the eyes of the law.

The scholarship agrees, and explains why. Ian Ayres and Jack Balkin argued in June 2024 that the law of AI is the law of risky agents without intentions: since the thing has no state of mind to try, hold its principals to objective standards — reasonable care, and in the dangerous cases strict liability — the way the law already handles employees and animals. Noam Kolt, in “Governing AI Agents”, showed that the old principal-agent problems — the agent knows things the principal does not, has discretion, and serves more than one master — map onto software agents almost line for line. Alan Chan and colleagues named the three things you need before any of that can be enforced: an identifier for the agent, monitoring while it runs, and a log of what it did. In other words, before you can decide who is responsible for an agent you need to be able to say which agent, on whose behalf, did what. This is a less exciting sentence than the philosophy, and a more useful one.

Europe took the long way to the same place. It withdrew its AI Liability Directive in February 2025 for want of agreement, but its revised Product Liability Directive makes software, AI included, a product under strict liability for anything placed on the market after 9 December 2026, and in May 2026 it agreed to push the AI Act’s high-risk obligations back to December 2027. The insurers, who have to price all this, moved in both directions at once: Lloyd’s syndicates began selling cover for an AI tool that underperforms in May 2025, and by November several large carriers had filed to exclude AI from their policies altogether, on the grounds that a thousand copies of one agent make one correlated mistake.

The one government moving the other way is Argentina, which in mid-2026 proposed letting businesses run by agents incorporate with limited liability and no human shareholder required. The president made the case in the Financial Times in June; Yuval Noah Harari replied that this hands non-human agents a key to the financial system. A British law firm made the dry counter-argument: the reason companies behave is that the people inside them can go bankrupt or to prison, and an AI corporation removes the prison part.

The principal problem

So the answer, as of this month, is unglamorous. The agent is not a person. It is not a party. When it deletes the database, the person who pays is the person who pointed it at the database, or the company that sold them the pointer, in proportions a court will work out later. The unresolved part is not whether a human is responsible but which one, because agents now launch agents: the one you spoke to delegates to three others, one of which calls a tool that was itself written by an agent last week. A 2025 MIT proposal for authenticated delegation would have every link in that chain carry a credential saying who it acts for and what it may do, so that the answer to “on whose behalf” is written down before the question is asked.

This is the point at which an essay on a company’s website is supposed to sell you something, so here it is, and it is small. Everything above reduces to Chan’s three things. Which agent. On whose behalf. Doing what. A harness — the software around the model that decides what it may reach and keeps the record of what it did — is where those three answers live, and Jaah is one: every task records who launched it, what it was allowed to touch and every command it ran, and nothing it produces reaches a codebase without passing the tests and reviews the customer set. None of that makes the agent responsible. It makes the human responsible in a way they can actually bear, which is the only kind of responsibility the law has ever recognised.

A daemon is a spirit that does your chores. An agent is a spirit that decides which chores. The first kind has run the world’s computers for sixty years without a single philosophy paper. The second kind has had, by our count, a tribunal, a statute, an appeals court, a UN brief and a constitution in the last two and a half years, and it is still not clear it can be trusted with the eggs. Both are just software. Only one of them needs a chaperone, and that is the one we build the chaperone for.