From AI Model to AI Agent - Nebius Academy
Week 2:
This post is a little late. Life doesn’t always follow the ideal roadmap.
I missed Saturday’s session as my 5-year-old was in hospital after exhibiting worrying neurological symptoms. A very stressful few days, with numerous tests including an MRI and lumbar puncture. Thankfully, it was a manageable diagnosis with a good prognosis.
It did make me reflect on AI. How it should augment, not replace. The tech is powerful, but moments like that remind you how irreplaceable human empathy is.
Also, massive appreciation for the NHS. The care we received was genuinely outstanding.
This week a deep-dive on what actually makes agents useful: Tools
Last week: agents could reason.
This week: agents learn to act.
4 Key Takeaways:
1. LLMs don’t execute. Your code runs the world! Tools address 4 main gaps of an LLM - Knowledge, Computation, State, Memory.
2. The Tool Loop. The entire system is built around one loop and the loop is yours:
Think → Act (tool call) → Observe → Repeat
Every paradigm follows the same loop:
→ Model decides and emits JSON tool call
→ Your code executes
→ Result injected back into context
→ Model continues reasoning
3. A tool is not just a function. It’s a contract between model and system. The real skill isn’t calling tools. It’s deciding which paradigm to use and when.
🧠 CLI → fast, low setup but risky
⚙️ Functions → core logic, your foundational building block
🌐 APIs → connecting to real-world data
🔌 MCP → shared tool infrastructure at scale (M x N becomes M + N)
🤖 A2A → When tools aren’t enough, delegation of complex tasks to another agent. Not just calling a function but hiring a specialist
Same loop. Different abstraction layers.
4. Security! System prompts will not save you. Architecture will. Prompt injection is not theoretical, it is the default failure mode when you combine private data, untrusted content, and external actions.
What Actually Works (Defence-in-depth):
🧹 Pre-processing: strip scripts, HTML comments, unsafe content
📦 Structural wrapping: <tool_result> to mark untrusted data
🔐 Least privilege: default to read-only, restrict write actions
👤 Human-in-the-loop: approval required for sensitive actions
🔍 Output scanning: detect and block PII, secrets, API leaks
Next week:
Building agents that don’t just call tools but coordinate, delegate, and operate autonomously.
Quote of the day:
"Without tools, The agent is all brain and no body.”