When Did My Script Become an Agent?

There is a Python file on my homelab that started out as maybe forty lines whose entire job was to sort log entries into two piles. It has since acquired a tool list, a retry loop, and what I can only describe as opinions. At no point did I sit down and decide to build an agent. I just kept adding things on Tuesday evenings, and then one day I realised I could no longer predict what it would do before I ran it.

That is roughly where this question got interesting for me. Everyone is shipping agents now, along with agentic platforms, agentic workflows, and agentic something else that will have made it into a press release by the time you read this. Meanwhile a lot of us have scripts that call a model somewhere in the middle, and it is genuinely unclear which side of the line we are standing on, or whether the line exists anywhere outside a marketing deck.

The obvious answer, that it becomes an agent when the AI makes a decision, falls apart as soon as you poke it. Practically everything makes a decision with a model now. My log sorter asks a model whether a line is worth a human looking at. My drafts folder contains a script that asks a model whether a sentence sounds pompous, which is a decision, and frequently a correct one. Nobody would call either of those an agent, and yet a model is making the call in both.

The distinction that has held up for me is duller and more useful than the one in the press releases. It comes down to who owns the control flow.

When my script asks a model to classify something and then branches on the answer, the model filled in a variable. I designed the decision. Every route the program can take is sitting there in the source, and I could draw the whole thing on a napkin. The model is a subroutine that happens to return fuzzy values instead of integers, which is unusual, but it is still a subroutine sitting inside a shape I built. However good the prompt is, that program is a script.

It turns into something else when the model starts deciding what happens next rather than what something is. When the next step is not in a match statement I wrote, but in a list of tools I handed over with an unspoken figure it out. The loop is the real giveaway. Act, look at the result, decide again, possibly go back and try a different way round. A script runs from A to B to C and I know its shape before I start it. An agent runs until it decides it is finished, and the number of steps along the way was never mine to know.

So there are three questions worth asking about any of these systems. Whether the sequence was chosen by a developer or by a model. Whether the set of possible actions is written down somewhere or left open ended. And whether the model gets to see the consequences of its own last action before choosing the next one. Answer those honestly and the label mostly sorts itself out without anyone having to argue about definitions.

Except the label is not really the point, and this is where I think the whole conversation drifts.

From a security perspective it makes remarkably little difference what we call the thing. What matters is what it can do without a human confirming, and what the world looks like if the model is wrong at every single step rather than occasionally. A humble little script with delete permissions and untrusted text landing in its prompt is a far more alarming object than a fully autonomous agent that can only read files and write summaries. Autonomy multiplied by blast radius, not the noun on the architecture diagram.

Which leaves two slightly awkward observations. A good deal of what is sold as agentic turns out to be a script with a well written system prompt and a confident demo. And a good deal of what we still casually call scripts quietly became agents the afternoon somebody added a tool list, without anyone going back to redo the risk assessment, because it was still the same file with the same name in the same repository.

I have not gone back and redone mine either. It is on the list, somewhere below the thing that sorts logs into two piles.