← Blog

Autonomous AI Agent: What It Is and How to Keep Control

Autonomous AI Agent: What It Is and How to Keep Control

An autonomous AI agent is an AI agent that takes a goal and carries out the steps toward it, using tools, without a person approving each step. How much it does on its own is a setting, not a yes-or-no property, so the useful question is which loops are on, what stops them, and who can say stop.

This guide explains how an autonomous agent works, the levels of autonomy, the risks, and the controls to look for. It uses POLYROB, an open-source (MIT), self-hosted AI agent, as the worked example. Every statement about POLYROB comes from the public repository at release v1.7.6, and the sources are listed at the end.

What is an autonomous AI agent?

A chatbot answers when you write. An autonomous agent can also start work: it reads a goal, plans, calls tools such as a browser, files, git or mail, checks the result and keeps going until the goal is done or a limit stops it.

Three parts make that possible:

The third part is the one that separates a useful agent from a risky one. A model that decides for itself when to stop is not a control.

How does an autonomous AI agent work?

Most agents run the same cycle. The model reads the goal and what happened so far, chooses the next tool call, the agent runs it, and the result goes back to the model. The cycle repeats until the model reports it is done or a limit trips.

In POLYROB the step loop for unattended work has several bounds. Every goal, job and helper run stops at one step limit, AUTONOMOUS_MAX_STEPS, which defaults to 150. It also stops at AUTONOMOUS_RUN_BUDGET_USD, which defaults to $2.00 of model spend per run, helpers included. Both are settings the owner controls: no goal or job can set its own budget. A single goal run has a wall-clock cap too, GOAL_MAX_RUN_SECONDS, default 1800 seconds. When a run stops before it finishes, the reason is recorded in its status.

One limit on those limits: the spend check is a guard, not a guarantee. The configuration reference says it fails open if the cost probe errors. It is also a cap per autonomous run, not a daily or monthly budget.

What are the levels of autonomy?

There is no single standard scale, so here is a simple one that is easy to test against any agent:

  1. Interactive. It acts only when you message it.
  2. Ask first. It works on its own but asks you before anything with side effects, such as pushing code or posting.
  3. Act and report. It works on its own, asks only for the highest-impact steps such as money, and tells you afterward.
  4. Unbounded. It acts without limits or review. A responsible setup should not offer this.

POLYROB maps onto the first three. Out of the box it is interactive: it acts on your messages and on nothing else. Autonomy is a set of loops you switch on. The configuration guide lists three levels you pick with /mode:

LevelAsks firstWhen you are away
ask-firstThe recommended set: push, pull requests, posting, self-changesNothing runs
standard (default)Only moneyNothing runs
on-my-ownOnly moneyScheduled jobs run, and goals on a computer with POLYROB_LOCAL; it tells you

Note the default. A fresh install does nothing while you are away. It also starts with no jobs and an empty goal board: POLYROB ships the mechanism and the work is yours.

How do you turn autonomy on, and see what it is doing?

Two commands cover it:

polyrob autonomy on        # the master switch, AUTONOMY_ENABLED
polyrob autonomy status    # every axis, the loop state, any active pause

autonomy status prints the effective posture on one card, so you do not have to guess which flag won. The behavior sits on four settings that matter most: the master switch (AUTONOMY_ENABLED), the capability mode (AUTONOMY_MODE, supervised or autonomous), the loop posture (AUTONOMY_POSTURE, silent, owner-visible or full) and the compute posture. The mode autonomous only takes effect on a single-owner machine with a bound owner. Otherwise it clamps back to supervised, and the write tells you so at once.

Then you give it work. A goal is one piece of work done once; a job is the same work at set times:

polyrob goals create "Draft the Q3 summary" \
  -b "Read reports/*.md, write one page, name the three biggest changes." \
  --acceptance "a file at reports/q3.md" \
  --priority 7

polyrob job new "every day 09:00" Summarise the inbox and post the three items that need me

Write the --acceptance line. A completion judge compares the agent’s claim with the evidence the run left. A goal that cannot be verified finishes as “done (unverified)”. Naming the file turns a claim into a check.

Pace is yours as well. By default at most 2 goal runs go at once (GOAL_MAX_CONCURRENT) and at most 6 start in a rolling 24 hours (GOAL_DAILY_QUOTA). Both are ceilings you can tighten.

What are the risks of an autonomous AI agent?

Four risks come up in every deployment, and each has a matching control to ask about.

Runaway cost or loops. An agent that never stops can spend without limit. Ask for a step cap, a spend cap and a time cap, and ask who owns them. In POLYROB the owner does, as shown above.

Untrusted input. An agent reads web pages, mail and tool output, and any of it can contain text meant to steer it. POLYROB treats a third party it contacted as untrusted data: the reply is framed as data, never as a command, and while that data is in the session, high-impact tools such as money, outbound messaging and code execution are denied until the owner’s next turn. This lowers the risk. It does not remove it, and the security model says so.

Self-expansion. An agent that writes its own jobs and skills can widen its own reach. A goal the agent writes for itself may ask only for a safe set of tools; money spend, code execution, scheduling and the goal and skill tools are not in that set. Skills it writes go to a review folder first and wait for you.

No hard boundary. The security model page states that its gates run in the same process as the agent and that none of them is a hard security boundary. The only hard boundary is the operating system or a container. On a server, run code execution in Docker; the AI agent sandbox guide shows how the container is locked down. The code_execution tool is off by default (CODE_EXEC_ENABLED) and the reference says plainly that it is not a sandbox.

How do you keep control of an autonomous agent?

Five controls are worth checking in any agent, with what POLYROB provides for each:

  1. A decision queue. Anything that needs you waits in /inbox until you answer with /approve, /reject or /fulfill.
  2. A stop that is a command. /pause stops all autonomous work now; polyrob autonomy pause does the same from a shell, and /resume lifts it. You can scope it to one job or goal. A plain “stop” typed to the agent is only a message, never a switch. The agent can pause its own work but cannot resume it.
  3. Caps on every run. 150 steps and $2.00 by default, set by the owner.
  4. Turn-off per task. /goal stop <id> --forever switches a title off so that no job adds it again and the agent cannot create it again.
  5. Visibility. /goals shows the board with who asked for each goal, and polyrob goals events <id> shows what happened with timestamps.

What does an autonomous agent do well, and where does it fail?

It fits work that repeats or that you would otherwise forget: a morning summary of a mailbox, a weekly check of a site for broken links, drafting a document from a folder of notes, watching a source for changes. These share a shape: the goal is clear, the result is checkable, and a wrong answer is cheap.

It fits badly where the result cannot be checked, where a mistake is costly, or where the task needs judgment about people. In those cases keep it on ask-first, or keep it interactive.

POLYROB has limits of its own. It supports eight chat surfaces: Telegram, email, WhatsApp, Discord, Slack, Signal, Feishu/Lark and DingTalk. It has no native phone or desktop apps. It does not set up a local model for you, and a small local model will plan and use tools less reliably than a large hosted one. Its serverless sandbox backends have been tested against fakes only. It is a young project with a small community.

FAQ

What is the difference between an AI agent and an autonomous AI agent?

An AI agent uses tools to do a task. An autonomous AI agent also decides the next step itself and keeps going without approval of each one. The difference is a matter of degree, set by what the agent may do unattended.

Is an autonomous AI agent safe?

It is as safe as its limits. Look for a step cap, a spend cap, a stop command and an approval queue, and run risky tools in a container. No agent that reads untrusted text is immune to manipulation, so start with tasks whose results you can check.

Can I run an autonomous AI agent on my own machine?

Yes. POLYROB runs on Linux, macOS and Windows through WSL2. You pay your model provider, or nothing with a local model, and the software is MIT licensed. Read the self-hosting guide for the full steps.

How much does an autonomous AI agent cost to run?

The agent software can be free. The cost is model usage. POLYROB caps each autonomous run at $2.00 by default and you can lower it with polyrob config set AUTONOMOUS_RUN_BUDGET_USD 0.5. That cap applies per run, so total cost also depends on how many runs you allow.

Does it work while I sleep?

Only if you turn that on. With autonomy off, which is the default, nothing runs when you are away. With on-my-own, scheduled jobs run, and goals run on a computer with POLYROB_LOCAL; it tells you.

Try it with the limits set first

Install, run the preflight, and keep autonomy off until you have set the caps:

curl -fsSL https://polyrob.dev/install.sh | bash
polyrob doctor

Install POLYROB, compare the nine pre-install checks in the open-source AI agent guide, and see how reusable procedures work on the agent skills page. The capabilities page lists the tools.

Sources

Fetched from the public repository at release v1.7.6:

POLYROB is an open-source AI agent you run and own. Install it or read the docs.