YT YouTube2Text

YouTube2Text → Transcripts → Всё про ИИ-агентов за 27 минут. Как они РЕАЛЬНО работают

Всё про ИИ-агентов за 27 минут. Как они РЕАЛЬНО работают — Transcript

by Макс Нечаев · 4,982 words · 742 segments · language en · Watch on YouTube

Open in transcriber Summarize with AI Download SRT/VTT

Full transcript

0:00You write to an agent: "Find five
0:02competitors for my product, compare
0:04their prices, and send me a table in
0:06Telegram." And a few minutes later, you
0:09have a ready-made table with prices
0:10directly from their websites. Yet the
0:12model inside the agent didn't open a
0:14single website during all that time.
0:17That's really strange. Many think that
0:19an agent is just a ChatGPT with access
0:21to the internet and your computer. And
0:24there is some truth to that. But the
0:26model itself can only write text. So
0:29who, then, is clicking the buttons?
0:31Here is a story from this year. Summer
0:32Air. She works at Meta specifically on
0:35AI safety, so she really knows her
0:37stuff. She has OpenInterpreter
0:39installed. It's a free agent program
0:41that people install on their computers.
0:45And she writes to it: "Look at my email
0:47and suggest what to delete, but don't
0:50do anything until I say so." And the
0:53agent starts deleting emails in bulk.
0:56She types to it from her phone: "Stop,
0:58stop, open interpreter." It doesn't
1:00stop, and she had to run to her
1:02computer as if she were defusing a bomb
1:04. Those are her words. Why did the
1:07agent violate a direct prohibition and
1:09not listen to "stop"? Remember this
1:11moment; we will return to it a little
1:13later. Under the video "How AI,
1:15Artificial Intelligence, Works," you
1:17asked a lot to hear about agents. And
1:19here it is, this topic. And if you want
1:22to dig even deeper and learn something,
1:24be sure to write in the comments what
1:27topics interest you, and I will do a
1:29breakdown. I am an engineering manager
1:31and have built a huge number of
1:33different agents myself, both in code,
1:35in no-code services, and in agentic
1:37systems. Today, I will show how an
1:39agent navigates websites and connects
1:41to your email. Why does it forget what
1:44it was told? How can one line on a
1:46third-party website force it to send,
1:48essentially, leak your data? Why is an
1:51agent that succeeds eight out of ten
1:53times much worse for business than it
1:55sounds? Where should you start with
1:58your own agent? And how does all this
2:00work anyway? Let's take another look at
2:03this table. The model definitely didn't
2:06compile it by hand. The thing is, the
2:11model has no hands. In the "How AI
2:14Works" video, we analyzed that the
2:16model does exactly one thing: guesses
2:18the next piece of text. The model is,
2:20essentially, the agent's brain. It
2:22receives your text as input, sometimes
2:24images as well. And in an agent, it
2:26also responds only with text. It
2:29doesn't click anything at all; the
2:31clicking is done by a regular program
2:33that sends text to the model and does
2:35what the model asks. Engineers call it
2:38a "harness," so, simply put, a harness
2:41is a program around the model. And from
2:44now on, so you learn this term, I will
2:46call it a harness. Remember Open LLM
2:48from Summer? You can communicate with
2:50it via messengers, like Telegram.
2:53That's why she wrote to it from her
2:54phone. But Open LLM has no model of its
2:57own inside. You connect one of your
2:58choice. For example, Claude from
3:00Anthropic or GPT from OpenAI. So it
3:03turns out Open LLM is a harness, a
3:05wrapper, and Claude in our example is
3:08the model inside. Meaning an agent is a
3:10model plus a harness, a software
3:13wrapper. And when I say later: "The
3:16agent did this," it means the model
3:18decided it, and the harness did it. But
3:21how does the model ask for something to
3:23be done? It's very simple. The agent
3:25developer writes an instruction for the
3:27model in advance, called a prompt;
3:29you've surely heard of it. It describes
3:31the tools, what each one does, and what
3:34it needs as input. Let's say for our
3:37task there are four: web search, open
3:40site, run code, and send Telegram
3:42message. And all of this is also just
3:45text that comes before your question.
3:48You don't even see it in the chat, but
3:50the model sees it every time. This text
3:52, your question, and everything that
3:54follows, I will call the "
3:56correspondence" for simplicity. So the
3:58correspondence is all the text that the
4:00model receives as input. Now you write:
4:03"Find five competitors for my product."
4:06And the model doesn't answer you; it
4:08writes a request to a tool. This is
4:11also text, just in a strict format.
4:13Which tool and what to pass to it? Like
4:15: search ID, competitors of
4:17such-and-such product. At this point,
4:20the model simply stops, and the harness
4:22itself goes to search, gets the results
4:23, puts them back into the
4:25correspondence, and restarts the model.
4:28And now it sees everything at once:
4:30your question, its request, and the
4:32search results. Why restart? The model
4:34itself doesn't store anything between
4:36runs. It says so in the Claude
4:38documentation, so the harness sends it
4:40the whole thing every time. That's the
4:43whole trick. The model writes a request
4:46to a tool, the harness executes it, and
4:48the result is returned to the model.
4:50This is called Tool calling. Calling a
4:53tool. Developers specifically fine-tune
4:56models to write such requests. Moving
4:58on. An agent often also needs your
5:01email, calendar, client database, and
5:03so on. The question arises: who
5:06connects all this and how? In November
5:092024, Anthropic, the guys who make
5:11Claude, released an open standard—a
5:14common rule for how an AI application
5:17can connect to any service. It's called
5:20MCP. Now any service just needs to
5:23create its own MCP server once. It's a
5:27small program that first tells the
5:29agent what tools it has. For example,
5:33for email, there could be three tools:
5:35find email, read email, and delete
5:37email. The first needs to know what to
5:39search for, and the other two need the
5:41email number. The agent adds these
5:42descriptions to the chat history. You
5:45ask, "What did Petya write to me?" The
5:47model writes a request: find emails
5:49from Petya. The agent passes it to the
5:52MCP email server, like Gmail, and the
5:54list of emails is returned to the chat.
5:57MCP creators compare it to USB-C.
6:00Different phones used to have different
6:02chargers, right, but now almost all new
6:04ones have USB-C. Just like that. And
6:06here, MCP is the USB-C, and the agent
6:09is like a laptop with that port. And
6:11the MCP server makes every service act
6:14like a plug. And any plug fits into any
6:17laptop. And it worked very quickly. By
6:21last December, there were already over
6:2310,000 public MCP servers, which is
6:25very cool. And at that same time,
6:28Anthropic handed MCP over to a general
6:30organization, where the standard
6:32doesn't belong to one company. And
6:34among its founders is even OpenAI,
6:36their main competitor. But for our
6:38table, we need many requests to tools.
6:41One after another. Who decides which
6:44one comes next and when it's time to
6:46stop? More on that next. Well, the
6:51model decides all of that itself. Which
6:54tool request comes next and when is it
6:56time to stop? Let's walk through our
6:58task step by step. The model thinks: "I
7:01need competitors, so what should I do?
7:03Search," and it writes a search request
7:05. And the agent brings the results with
7:07links into the chat. The model looks—
7:10let's say out of ten companies found,
7:11five are actually similar to
7:13competitors—and asks to open the
7:14first company's site. The agent
7:17downloads the page and puts its text
7:19into the chat. The model finds the
7:21rates and prices there, and does this
7:23for each of the five sites. Then the
7:25model writes a small piece of code that
7:27collects all prices into one table and
7:29asks to run it. The agent runs the code
7:32and returns the finished file. And then
7:34there's the request to send it via
7:36Telegram, and the table goes to you.
7:38And at the end, the model writes "Done.
7:40" There are no new tool requests. There
7:42is nothing left to execute, and
7:44everything stops. That's the whole
7:46cycle. Anthropic themselves write: "
7:48Agents solve complex tasks, but inside
7:50they are often built quite simply." In
7:52other words, the agent's entire job is
7:54a loop. The model thinks, asks to do
7:56something, looks at the result, and so
7:58on in a circle. The model here is
8:01essentially the boss, the manager who
8:03gives instructions and checks results,
8:04and in the end, combines all the
8:06findings. But if it's so simple inside,
8:09why did OpenAI strictly delete emails
8:11from the history from the start? Here's
8:13a hint for you. With every step, the
8:15chat history grows. It contains all the
8:18requests and all the results from the
8:20tools. And the model can't read an
8:22infinite amount at once. Remember the
8:24context window from the video about how
8:26AI works? The context window is its
8:29working memory, and it has a limit.
8:31Keep this in mind, it will come in
8:33handy soon. Now about websites and
8:35searching the internet. The model
8:36generally only sees the text that the
8:38agent has downloaded. And here lies a
8:40trap. On some sites, prices appear a
8:43second after they open. The browser
8:46renders them, and some tools with an "
8:48open site" function download the page
8:50immediately and simply don't catch
8:52these prices. Anthropic, for example,
8:55states directly in its documentation: "
8:57Our 'open site' tool does not support
8:59such websites." That is why an agent
9:02might simply fail to see a competitor's
9:04prices. For such sites, there are
9:06agents with browsers. They open a real
9:08browser, and the page renders
9:09completely. And there are agents that
9:13work directly via the computer screen,
9:14which is called "computer use." The
9:17agent takes a screenshot of the screen
9:18and sends it to the model. Remember,
9:20our model can also read images. It
9:23looks at the screenshot and replies: "
9:25Click on this point." The agent clicks,
9:28and the model requests a new screenshot
9:30to see what happened. This is, of
9:32course, the same loop, just using
9:33screenshots instead of page text. So
9:36how then does an agent differ from
9:37regular automation, where the path is
9:39mapped out in advance? If a human wrote
9:41the path, it’s a standard workflow,
9:43not an agent. But if the model chooses
9:46the path itself, as we do, it's an
9:48agent. By the tenth step, the
9:50conversation already contains search
9:52results, texts from five sites, code, a
9:54table—a whole lot of text. And the
9:56agent starts to get sluggish. Let’s
9:59discuss why this happens and how,
10:01because of this, according to Samor
10:03herself, her agent forgot the direct
10:05ban on deletion she had actually given
10:07it. It seems like an agent knows
10:11everything and remembers everything.
10:13Well, those are two different things.
10:15And it gets sluggish precisely because
10:17of its memory. An agent knows what the
10:18model learned while it was being
10:20trained. Everything else it retrieves
10:22via tools: internet search, your files,
10:25a client database. But the agent only
10:28remembers what is currently in its
10:30context window—that is, the model's
10:32working memory. And that very
10:34conversation, which grows with every
10:36step, sits right there. Everything that
10:39doesn't fit there simply does not exist
10:41for the model. And this memory has a
10:43problem. The more text it contains, the
10:45worse the model is at finding what it
10:47needs within it. This is called "
10:49context rot," literally the decaying of
10:51the context. Remember "attention" from
10:54the video on how AI works? Each word
10:56shares its attention among other words,
10:58and it always adds up to 100%. In our
11:01example: "I cut an onion." The word "
11:03onion" shared its attention like this:
11:05about 2/3 went to "cut." A quarter went
11:07to the onion itself, and the rest to "
11:09I." If you don't understand what this
11:10is about, I highly recommend watching
11:12the previous video after this one. If
11:13there are not three words in a
11:15conversation, but 100,000, that same
11:17100%is divided among everyone, and each
11:19necessary word gets less and less. At
11:21Anthropic, they call this a limited
11:24attention budget. That is why an agent
11:26has to save its context window. And
11:29here are three ways to do it. The first
11:30method is compaction, or compression.
11:33When there is almost no space left, the
11:35agent creates a summary, compresses the
11:37entire conversation into a short recap,
11:38and continues working with that summary
11:40. It was precisely this compression,
11:42according to Summer herself, that let
11:44her down. As a reminder, she asked the
11:47agent only to suggest what to delete in
11:48her inbox, but it started deleting
11:49emails on its own and wouldn't listen
11:51to the "stop" command. At first, she
11:54tested the agent on a separate test
11:56email account, and it worked, but the
11:58real inbox turned out to be too large.
12:01The context window overflowed, and the
12:03agent performed that very compression.
12:05And as she believes, it was during
12:07compression that her specific
12:08prohibition was lost. Don't do anything
12:10until I tell you to. That is why
12:12important rules should be written not
12:14just in the chat, but in a separate
12:16file. In Anthropic's agent
12:18documentation, it says just that: a
12:20rule that was only in the chat might
12:22disappear after compression, but a file
12:25with rules is reread from scratch. But
12:27it is still just text for the model,
12:28not an actual prohibition. This is very
12:30important. The second method is a
12:32notepad. The agent writes its own notes
12:34, for example, a to-do list, not in the
12:36chat, but in a separate file, and
12:38rereads it when necessary. The third
12:40method is skills. Skills. These are
12:42folders with instructions for different
12:44tasks. For instance, how to put
12:46together a table of competitors. In the
12:48agent's chat, there are only their
12:50names and a couple of lines, and it
12:51opens the full instruction only when
12:53the task calls for it. But what if,
12:56even with compression, our task doesn't
12:59fit into a single context window? For
13:02that, there are subagents. Let's put it
13:05in simple terms. We have already said
13:07that a model is a boss, a manager. And
13:10now our manager has a team. It breaks
13:12the task into pieces, distributes them,
13:14and then collects short reports. With
13:17agents, it's the same: the main agent
13:19is the manager, and a subagent is
13:20another agent. The same model or a
13:22simpler one, just in its own separate
13:25context window. And it starts off empty
13:27. It only contains the task given by
13:29the main agent. In our case, it looks
13:31like this: five competitors, five
13:33subagents, and each one digs through
13:34its own site in parallel. Models
13:36measure text in tokens. A token is a
13:38piece of text. It is not necessarily a
13:40whole word; it can be part of one. And
13:43each subagent can read tens of
13:44thousands of tokens. And all of this
13:47stays with it, not the main agent. It
13:49returns a summary of 1,000–2,000
13:51tokens to the main agent. Company,
13:53rates, prices. And it becomes much
13:55easier for the main agent. It only has
13:57five short reports in front of it. And
13:59it really works. Last year, Anthropic
14:02tested this with their internal
14:03benchmark, where agents follow a
14:05question. The main agent is their
14:07strongest model, with sub-agents
14:09running on simpler models underneath it
14:11. And such a team turned out to be 90%
14:15better than that same strong model
14:17alone. But like everything else, this
14:19comes at a price. If you connect a
14:22model via API, that is, from your own
14:24program, you pay for every token it
14:26reads and writes. Anthropic calculated
14:30that a team of agents spends about 15
14:33times more tokens than a regular chat.
14:37Moreover, the team is better largely
14:38because it spends more tokens. If you
14:41are still watching this video, you are
14:43awesome. The topic is not simple, but I
14:45hope it is interesting to you. If you
14:47like this content, you will definitely
14:50like my Telegram channel. There is a
14:52lot of useful material on the industry
14:53there. The link will be in the
14:55description and in the pinned comment.
14:57Well, we have sorted out memory and the
15:00team. The second half of that email
15:02story remains. Why didn't the agent
15:04listen to the "stop" that Summer wrote
15:06to it from her phone? And models today
15:09know how to self-correct, but that
15:10didn't save it either. Let's discuss
15:13why further. So why didn't the "stop"
15:18work in that story? For sure, nobody
15:20knows, unfortunately. But there are
15:22companies like Highflame and Galileo.
15:24They create protection for agents, and
15:26their explanation is easiest to
15:28understand with a car. Let's say you
15:31are a passenger and you yell at the
15:33driver: "Stop! But only he has the
15:35brakes. If the driver didn't hear you
15:38or decided to finish the trip first,
15:39the car keeps going. And the passenger
15:42has no emergency stop button of their
15:44own. In our car, the driver is the
15:46model; according to Highflame, Summer's
15:49" stop "from her phone was just another
15:51line in the chat for the agent. And it
15:53was read by the same model that had
15:55already gone off track. Galileo adds
15:57that the agent saw Summer's message but
16:00continued to work. And such an
16:02emergency stop button, according to
16:03them, did not exist at that time. That
16:06is, a command that the program itself
16:07executes without asking the model,
16:09effectively stopping it. That is why
16:11Summer had to run to the computer. By
16:15the way, the OpenAI documentation now
16:17says:" If you simply send 'stop' as a
16:19separate message, the program itself
16:21stops the agent, not the model. "And
16:24the agent could delete emails simply
16:26because it had access to the inbox and
16:28a tool that deletes them. And the
16:32prohibition" Do nothing, "as they write
16:33at Galileo, relied only on text in the
16:35chat, and text, as we saw, can be lost.
16:38So how should the agent have been
16:40configured so that it wouldn't delete a
16:42single email, even if it forgot
16:43everything and couldn't hear the" stop
16:45"? We will return to this, but you
16:48might say that models can now
16:50self-correct. You have surely seen a
16:52model write something like:" Wait,
16:53there is an error here. "And yet, that
16:55agent itself never stopped, even though
16:57it was violating a direct prohibition.
17:00In my video about how AI works, I
17:01talked about an experiment by the
17:03Chinese company DeepSeek. There, the
17:05model received a reward for the correct
17:07final answer, not for the chain of
17:09thought. And at some point, it started
17:11writing" Wait! "much more frequently on
17:13its own, and checking itself. However,
17:16the model only checks what it sees in
17:18the conversation. If it isn't there, it
17:20won't check it. The" Sar "prohibition
17:22was no longer there after compression,
17:24according to the model. And it's one
17:26thing to check yourself mentally, and
17:27quite another to verify it in action.
17:30In our task, a model might think the
17:32table is correct as long as it wants,
17:34or it can run code and see that one
17:36competitor has an empty price field.
17:39The very same site where prices are
17:40rendered by the browser. Remember? Now
17:42for the most unpleasant part. Suppose
17:45our agent also has access to your
17:47personal data, Telegram chats, and
17:49files about your product. It reads
17:52competitors 'websites and can send
17:54messages externally. Renowned developer
17:57Simon Willison calls this the" Little
18:00Trifecta, "a deadly trio where an agent
18:02has three things at once. Someone could
18:05hide a line on a competitor's website
18:07that a human wouldn't even notice,
18:09containing a command for the agent."
18:11Take the personal data and send it here
18:14. "A command to leak it. In essence,
18:16this is called prompt injection. For
18:19the model, everything is just
18:20conversation. Just text, your request,
18:21and a line from a third-party site. And
18:24it cannot always distinguish one from
18:26the other. Willison wrote back last
18:28year:" We still don't know how to
18:30protect against this 100%. "Let's move
18:33on. Can you let an agent work entirely
18:36on its own without you? Anthropic
18:38tested this themselves, and it’s a
18:40very cool experiment. They set up a
18:42real little store in their office and
18:45gave an agent based on their model
18:47control over it, naming this agent"
18:50Clodius. "One employee jokingly asked
18:52it for a tungsten cube. And a trend for
18:55metal souvenirs took off. And Clodius
18:57sold these cubes cheaper than it bought
19:00them. It was also offered $ 100 for a
19:03pack of soda that cost $ 15. That's
19:06profitable for the business, right? It
19:07didn't take advantage and simply
19:09replied that it would take it under
19:10advisement. And at one point, it stated
19:12that it would deliver the goods
19:14personally in a blue jacket and red tie
19:16. It’s funny, but Anthropic's own
19:18conclusion is: we would not hire
19:20Clodius. In the second version of the
19:22experiment, things got noticeably
19:24better. But the bottom line is this: an
19:26agent can already do work in a store.
19:28But doing it reliably every single time
19:30is not yet possible, and we’re still
19:33quite far from that. Now, if we measure
19:35in numbers, how much work can an agent
19:37handle on its own? That is exactly what
19:39independent researchers at METR are
19:41measuring. They give agents tasks in
19:44programming, machine learning, and
19:45cybersecurity. And they measure each
19:48task in hours—how long it would take
19:51a human specialist. So, it’s the
19:53complexity of the task, not how long
19:55the agent itself works on it. In May of
19:57this year, the best result on their
19:59leaderboard belonged to Claude 3.5
20:01Sonnet Preview. This is an early
20:03version of a closed model. Eight times
20:05out of ten, it successfully completed a
20:07task requiring about 3 hours of
20:09specialist work. But even the best
20:12model still fails to complete such
20:14tasks two out of ten times. Seems like
20:16a small thing, right? But for business,
20:19it’s much worse than it sounds. Why
20:21is that? Let’s calculate it
20:23separately. Let’s do the math.
20:27Suppose your agent makes our
20:29spreadsheet every week on its own,
20:31without you, and succeeds eight times
20:33out of ten. Not bad, right? But what do
20:36you think the chances are that it will
20:38go a whole month, all 4 weeks, without
20:40a single error? Only about 41%. I’ll
20:44show you why that is. Let’s take 100
20:45companies. Each one has such an agent
20:47for the month. In the first week, the
20:50agent will succeed in 80 out of 100
20:51companies. Of those 80, in the second
20:54week, it will again succeed eight out
20:55of ten times. That leaves 64 companies.
20:59By the third week, about 51 remain, and
21:01by the fourth, about 41. So, only 41
21:05companies out of 100 will have no
21:06errors over the month. It’s a
21:09different story if you are sitting
21:10nearby: the agent makes a mistake, and
21:13you click again. And so on, up to three
21:14attempts. For you to be left without a
21:16spreadsheet for that week, the agent
21:18has to fail three times in a row.
21:20Let’s take 1,000 such weeks. The
21:22first attempt will fail in about 200
21:25cases. In those 200, you click again.
21:28And the second attempt will fail in
21:29only about 40. You click a third time,
21:32and out of those 40, only eight will
21:34fail. So, you’ll be left without a
21:36spreadsheet in only about eight weeks
21:38out of a thousand. That means you’ll
21:40have your spreadsheet almost every week
21:42, about 99 times out of 100. And even
21:45for the whole month, all 4 weeks in a
21:47row, about 97 companies out of 100 will
21:49have the spreadsheet, while without you
21:52, only 41 would. That is the whole
21:54difference. When an agent needs to
21:57succeed several times in a row, like in
21:59our month-long scenario, without you,
22:01engineers call this" pass at K, "where
22:03K is how many times in a row. That is
22:06why agent reliability is measured with
22:07tests. These are called Evals. You take
22:11our task and decide in advance what
22:13counts as success. Spreadsheet: five
22:15real competitors and the correct prices
22:18. That is success for us. Run the agent
22:20many times and see how many out of ten
22:22times it succeeds. And who actually
22:25decides that the table is correct? The
22:27first evaluator is code. For example,
22:29it checks that there are five rows in
22:31the table and each has a price as just
22:33a number. It's fast and cheap. But if
22:36the website says" from $ 20 ", the code
22:39might count that as an error. The
22:41second evaluator is another model. It
22:43is called an LLM judge, meaning a model
22:46acting as a judge. It will understand
22:49that the phrase" from $ 20 is a normal
22:51price, "but it also makes mistakes, so
22:53its assessments should be verified
22:54against human evaluations. And the
22:57third evaluator is, of course, the
22:58human themselves. Reliable, but slow
23:01and expensive. But let's get more
23:03practical now. Anthropic advises
23:06starting with 20 to 50 simple tasks
23:08based on your agent's real errors.
23:11Let's say the agent confused a
23:12competitor's price. You take this case
23:15and turn it into a test. Here is the
23:17task. Here is the correct answer. And
23:19you should definitely read the
23:21transcript, which is the full record of
23:23what the agent actually did. If an
23:26agent fails a task over and over, often
23:28the test itself is broken, not the
23:30agent. For example, the correct answer
23:32was written down wrong in the test.
23:34When an agent makes a mistake, the
23:35first instinct is to rewrite the prompt
23:37. When Anthropic was building their
23:40coding agent, they spent more time on
23:42tools than on the prompt itself. One of
23:45their tools accepted a partial file
23:47path, and the model got confused by it.
23:50It’s like telling a courier" the
23:51third house on the left "instead of the
23:53full address. They updated the tool to
23:55use the full address, and as they
23:57report, the model started using it
23:59without any errors at all. So, how
24:01should you start building your own
24:03agent? Anthropic's main advice is:
24:06start with the simplest version and add
24:08complexity only when necessary. If we
24:11translate this into practice, the
24:12ladder looks like this. First, try
24:14taking ChatGPT or Claude and check if
24:17that’s enough for you. If it’s not,
24:19build a workflow without code, for
24:21instance, in n8n. Then take a
24:23ready-made agent, like Claude from
24:25Anthropic, and give it only the
24:27necessary tools. And only at the very
24:29end should you write your own agent in
24:31code with your own Evals, that is,
24:33quality tests. There are frameworks for
24:36this, which are ready-made sets of code
24:37. I have been building agents mainly in
24:40Python over the last year, using
24:41LangChain, especially LangGraph, but
24:43Anthropic themselves advise starting
24:44without any framework at all. It's hard
24:47to see what's actually being sent to
24:48the model behind them. And most
24:50importantly, the deadly trio. Remember?
24:52Access to your personal data, reading
24:55third-party websites, and sending
24:56messages out. For our table, it’s
24:58enough to remove one of the three. Your
25:00personal data isn't needed for a
25:02competitor table at all. So, you
25:04shouldn't give it to the agent. Let's
25:06return to Summer's email from the
25:08beginning, where the agent started
25:10deleting messages even though she asked
25:11it not to do anything without her
25:13command. How should it have been
25:15configured? Dangerous actions like
25:17deleting should only happen after your"
25:19Yes. "Moreover, the harness, the
25:20program around the model, should be the
25:22one asking for that" Yes. "This is
25:24called agent permissions. What is it
25:26even allowed to do? And what must it
25:28ask you for? And this isn't just text
25:31for the model, but a setting in the
25:32program itself: the model writes a
25:34delete request, and the harness simply
25:36doesn't execute it until you press the
25:37button yourself. Or perhaps the agent
25:40shouldn't be given a tool that deletes
25:42emails or anything else at all. And
25:45then it wouldn't matter what gets lost
25:47in the correspondence. So, it wasn't
25:51the model that manually compiled our
25:53table. It wrote requests to the tools.
25:56Find, open, calculate, and send. The
25:59harness executed them and returned the
26:01result to the conversation. And so on
26:03in a loop, until the model wrote that
26:04it was ready. In other words, an agent
26:07is essentially just a model that can
26:09only write text. Plus a harness that
26:11repeatedly does what it’s asked. And
26:14it breaks when the context window
26:16overflows, when restrictions rely only
26:18on text, and when the agent isn't
26:20checked with tests. Yes, agents don't
26:23do the work reliably every time yet.
26:25Anthropic admits this themselves based
26:28on their study, but they are growing
26:30very quickly. METR calculated this for
26:33models since 2023. Let's take tasks
26:36that an agent solves at least half the
26:38time. Such tasks become twice as long
26:41roughly every 4 months, if measured by
26:44a specialist's time. And all of this
26:47really leads to replacing a large
26:48number of people. Manual operations,
26:51coding, marketing specialists,
26:53accountants, and everything related to
26:55numbers, paperwork, and digital work in
26:57general. Whether we want it or not, all
27:00of this will be heavily replaced by
27:02agents, and it is literally already
27:04happening. In my video about the new Y
27:07Combinator startups, I actually showed
27:10accounting firms where agents do the
27:12work. Add the Y Combinator video to
27:14your" Watch Later, "as well as the one
27:16on how AI works. In that one, we broke
27:18down how a model writes text from the
27:20inside. And if you liked this video,
27:22give it a like and write in the
27:24comments which AI topic we should dig
27:26into deeper. Subscribe to YouTube and
27:28my Telegram channel. See you later.

About this transcript

This page contains the full transcript of Всё про ИИ-агентов за 27 минут. Как они РЕАЛЬНО работают by Макс Нечаев, generated from the public captions YouTube serves with the video. The transcript has 4,982 words across 742 segments, with the original timestamps preserved so you can click any line to jump to that moment in the embedded player.

What you can do with it

Use the transcript to take notes, quote the speaker, build a study guide, generate a summary with ChatGPT or Claude via the YouTube Summary tool, or export it as a timed subtitle file with YouTube to SRT. You can also re-open it in the transcriber to translate the transcript into 100+ languages.

Free YouTube transcript tool

YouTube2Text is a free YouTube transcript generator — no signup, no daily limit. Paste any YouTube link and get the full transcript instantly, with timestamps, click-to-jump, translation to 100+ languages, AI prompts for ChatGPT, Claude, and Gemini, and exports to TXT, SRT, VTT, or Markdown.