generative AI

Generative AI produces an output, such as text, code or an image, from a prompt and its context. Agentic AI is a system that uses a generative model to pursue a goal over several steps, calling tools and acting on the results until it finishes or is stopped.

So agentic AI vs generative AI isn’t a contest between two kinds of model. Most agents run on the same large language models (LLMs) as chat assistants. What changes is the system around the model: how many calls a task makes, what those calls may touch, what they cost together and what happens when one goes wrong. The sections below work through each difference with calculations you can rerun on your own numbers.

Key Takeaways

• They aren’t rival model types. An agent is an application architecture that usually calls a generative model many times.
• Repeated context dominates many agent bills. In our illustrative ten-call loop, 84% of input tokens were repeats.
• Token price isn’t task cost. In a hypothetical comparison, a model at one-third of the token price cost about 38% more per completed task.
• Caching helps only when it hits. Cache writes cost more than ordinary input, so a loop that keeps missing the cache pays extra.
• Actions outlive answers. Validation, idempotency and approval gates belong outside the model.
• Instructions aren’t permissions. Prompt injection is a risk to contain with system controls; filtering alone doesn’t remove it.
• Known steps call for a pipeline. If you can write the workflow down in advance, fixed code with model calls at set points is usually cheaper and easier to test.

---

Quick Navigation

---

Agentic AI vs generative AI: the architectural difference

Generative AI describes a capability. Agentic AI describes how a system uses it. The two overlap, because an agent’s plans, tool choices and final answer usually come from a generative model.

Anthropic’s guide Building effective agents (December 2024) draws a useful line. Workflows are systems where “LLMs and tools are orchestrated through predefined code paths.” Agents are systems where “LLMs dynamically direct their own processes and tool usage.” The practical question is who decides the next step: your code or the model.

Dimension	Single generative call	Agentic system
Unit of work	One request, one response	A task spanning many calls
Who picks the next step	The user or calling code	The model, within set limits
Calls per task	One	Variable, often unknown in advance
Side effects	None unless someone acts on the output	Possible at every tool call
Main cost driver	Prompt and output length	Calls × context per call
Typical failure	A wrong output	A wrong action, or a loop that never ends

The boundary isn’t absolute. Someone can paste generated SQL straight into production, and an agent can be limited to writing a report. The difference is structural: in an agent, the gap between the model’s decision and its effect is a function call, not a person.

Where the tokens go in agentic AI vs generative AI

A single request is easy to cost. An agent loop is harder, because each call re-sends material the model has already seen.

Every call carries the system instructions and tool definitions. OpenAI’s function-calling guide says function definitions “are billed as input tokens.” Anthropic’s tool-use documentation also adds a tool-use system prompt of 286 or 406 tokens on its 5.5-generation models, as listed on 18 October 2026. On top of that come the history, each earlier tool call and result, and the newest observation. Reasoning tokens, where a model produces them, are billed as output.

A worked example with illustrative assumptions

These are illustrative assumptions, not measurements of any product.

• The system instructions take 1,500 tokens, the tool definitions 2,500 and the user task 500.
• The one-shot request has no tools but includes a 3,000-token document, and it returns 800 tokens.
• Each agent step outputs 300 tokens and receives a 1,500-token tool result. The final answer is 800 tokens.
• The agent carries its full transcript forward.
• Prices are $3 per million input tokens and $15 per million output tokens. These are round illustrative rates, not a current list price.

Call k therefore sends 4,500 tokens of prefix and task, plus 1,800 for every earlier step:

Input for call k        = 4,500 + (k − 1) × 1,800
Total input over n calls = 4,500n + 900n(n − 1)

Scenario	Calls	Input tokens	Output tokens	Illustrative cost
One-shot generation	1	5,000	800	$0.027
Agent, five calls	5	40,500	2,000	$0.152
Agent, ten calls	10	126,000	3,500	$0.431

Doubling the calls from five to ten more than tripled the input. Of the ten-call run’s 126,000 input tokens, only 20,700 were new; the other 84% were repeats.

That growth comes from the design, not from agents in general. A state-managed version might send the prefix, the task, a 500-token summary and only the latest observation. Its calls then stay at 6,500 tokens after the first, for 63,000 in total, half the transcript version. The catch is that a summary can drop a detail a later step needed.

For real-world scale, Anthropic reported that agents in its multi-agent research system (June 2025) “typically use about 4× more tokens than chat interactions,” and multi-agent systems “about 15× more.” That’s one company measuring one product.

Agentic AI vs generative AI: the cost of completing a task

Price per million tokens tells you what a call costs, not what finished work costs, because failed attempts are paid for too.

Cost per successful task = (inference + tools + infrastructure + retries)
                           ÷ successfully completed tasks

Take a hypothetical pair using the same token assumptions, plus $0.02 per attempt for tool APIs and sandbox compute. Model A costs $1 input and $5 output per million tokens, averages 18 calls and completes 60% of tasks. Model B costs $3 and $15, averages 10 calls and completes 92%.

Per 1,000 attempts	Model A	Model B
Input tokens per attempt	356,400	126,000
Total cost	$405.90	$450.50
Successful tasks	600	920
Cost per successful task	$0.677	$0.490

Model A charges a third of the token price yet costs about 38% more per completed task. Longer loops absorb most of its price advantage, and the lower completion rate does the rest. The table also ignores the 400 failed tasks, and if a person picks those up, the labour can outweigh the inference bill. Our breakdown of the three numbers inside inference cost per token explains how list prices become the rate you actually pay.

What caching changes

Anthropic’s prompt-caching documentation, checked on 18 October 2026, prices five-minute cache writes at 1.25× the base input rate and reads at 0.1× for many models. The cache lasts five minutes by default, refreshed on each use, and changing tool definitions invalidates all of it. OpenAI’s caching guide describes automatic caching with a 1,024-token minimum and, for GPT-5.6 and later, the same 1.25× and 0.1× multipliers.

Apply those multipliers to the ten-call example, with each call reading the previous prefix and writing only its new tokens. The task falls from $0.431 to $0.162, about 62% less. If every step instead waits past the cache lifetime, perhaps for human approval, each call writes and none reads. The task then costs $0.525, about 22% more than with no caching. Measure your hit rate before counting on the discount.

Agentic AI vs generative AI when a step fails

A wrong answer and a wrong action differ mainly in what has already happened by the time anyone notices.

A generated output that’s wrong	An agent action that’s wrong
A summary misstates a contract term	The agent writes the wrong term into the contract record
A code suggestion has a destructive bug	The agent runs that code with production write access
A recommendation names the wrong supplier	The agent emails that supplier or calls its ordering API

The left column still needs a person to act. The right column doesn’t. The line isn’t absolute, though: people act on unchecked generated text, and a read-only agent may never change anything.

Errors also compound. Anthropic’s write-up says plainly, “Agents are stateful and errors compound.” If ten independent steps each succeed 95% of the time, all ten succeed only about 60% of the time (0.95¹⁰ ≈ 0.60). Real steps aren’t independent, so treat that as arithmetic, not a forecast.

Picture a refund agent whose database write commits but whose confirmation times out. A naive retry issues a second refund. The controls that contain this are:

• Validation: code checks each proposed action against a schema and business rules before it runs.
• Idempotency keys: a retried write applies only once.
• Bounded retries: attempts are capped per step and per task.
• Transaction boundaries: related writes commit together or not at all.
• Approval gates: a person confirms costly or irreversible actions.
• Compensation: each action that can’t be undone directly has a defined correcting action.
• Audit logs: the system records what was proposed, what ran and under which identity.

Agentic AI vs generative AI: security is an execution problem

A model that follows instructions well still isn’t a security boundary. The OWASP Top 10 for LLM Applications 2025 lists Excessive Agency (LLM06) and traces it to “excessive functionality,” “excessive permissions” and “excessive autonomy.” Its fixes include “complete mediation,” meaning authorisation enforced in downstream systems rather than by the model.

Prompt injection is why. OWASP’s prompt-injection entry (LLM01) covers instructions hidden in web pages, files and other content an agent reads. It says “it is unclear if there are fool-proof methods of prevention.” The UK’s National Cyber Security Centre argued in December 2025 that prompt injection is not SQL injection. Its reasoning was that LLMs “do not enforce a security boundary between instructions and data inside a prompt.” It therefore recommended deterministic, non-LLM safeguards over filtering alone. In March 2026, NIST’s Center for AI Standards and Innovation reported a red-teaming competition with more than 250,000 attack attempts. At least one attack succeeded against each of the 13 frontier models tested.

Where the controls belong

A filter can lower the odds of an attack, but it can’t decide what an attack may do. A framework’s tool list only controls what the model can request. A “run_python” tool inside your application process inherits that process’s network access, files and credentials. Real isolation comes from the operating system, container or virtual machine, plus egress rules and per-tool credentials. Our guide to the four layers of sandbox isolation covers how each layer limits damage.

The controls that matter are:

• Least privilege: each tool gets only the access its job needs.
• Tool allowlists: the agent calls named, reviewed tools, with no general shell unless the task requires one.
• Scoped credentials: each tool has its own short-lived token.
• Egress restrictions: outbound traffic is blocked by default.
• Sandboxing: generated code runs outside the application’s process.
• Human approval: payments, deletions and external messages wait for a person.
• Independent policy enforcement: a separate check decides whether each action is authorised.

No single item makes an agent secure. OWASP’s Top 10 for Agentic Applications (December 2025) lists Agent Goal Hijack, Tool Misuse, Identity & Privilege Abuse and Cascading Failures as separate risks. Each needs its own control.

Agentic AI vs generative AI under rate limits

Four measures get confused. Requests per minute (RPM) counts API calls. Tokens per minute (TPM) counts text processed. In-flight concurrency is how many requests are open at once, and end-to-end latency is how long the user waits.

Providers measure these differently. On 18 October 2026:

• OpenAI sets RPM, TPM and daily limits per organisation and project. Its guide warns that “unsuccessful requests contribute to your per-minute limit.”
• Anthropic sets RPM and separate input and output TPM per model class. Its documentation says cache reads don’t count toward input limits for most models.
• Google’s Gemini API applies RPM, TPM and daily limits per project, not per key, and says they “are not guaranteed.”

An illustrative fan-out

Suppose 100 users start a task in the same minute, using the five-call agent above. Each of its four tool steps runs three tools in parallel. Each model call takes 6 seconds and each tool step 2 seconds.

In that minute	Single call	Five-call agent
Model requests	100	500
Input tokens	500,000	4,050,000
Downstream tool calls	0	1,200
Time per task	about 6 seconds	about 38 seconds

The agent sends five times the requests and about eight times the input tokens, and it also loads your own systems, such as a search API or CRM. With caching on a provider that excludes cache reads, the input counted against limits drops to about 1.17 million, but the request count doesn’t change.

Retries can make this worse, because immediate retries after 429 errors add requests to a minute that’s already full. Honour any retry-after header, and otherwise use exponential backoff with random jitter, which Marc Brooker’s AWS analysis showed cuts wasted work sharply. Agents also need bounded concurrency per model and tool, a queue that holds new tasks instead of failing them, cancellation of abandoned branches, and hard caps on steps, time and tokens. Our reference on AI API rate limits in 2026 compares each provider’s published ceilings.

When a pipeline beats an agent

Anthropic’s advice is to find “the simplest solution possible,” because agentic systems “trade latency and cost for better task performance.” That trade only pays when you need the performance.

A deterministic pipeline is the better choice when you can list the steps in advance, check each output in code, run at high volume, or meet a tight latency budget. Pipelines still use generative models: one call classifies a ticket, another extracts fields, and a third drafts the reply, with code fixing the order.

Agents earn their cost when the next step depends on what the last one found, as in debugging or open-ended research. Even then, a bounded agent often works best. It has narrow tools, a step limit and deterministic checks before any write, and it sits inside a larger pipeline.

A practical decision table

Scenario	Likely architecture	Why it fits	Main concern
Single-turn drafting and summarisation	One model call	The output is the product, and a person reviews it	Accuracy
Structured extraction and classification	Pipeline with schema validation	Fixed steps; output checkable in code	Silent field errors at volume
Research across several sources	Bounded agent with read-only tools	The next search depends on the last result	Token growth; injected content
Database updates and external transactions	Pipeline, or an agent that only proposes, with approval and idempotent writes	Side effects must be validated and reversible	Duplicate or unauthorised writes
Long-running multi-step workflows	Workflow engine with agent steps inside	State and retries belong in infrastructure	Cache expiry, lost state, runaway loops
High-volume, latency-sensitive requests	Single call or short fixed chain	Predictable latency and limits	Fan-out and retries under load

Conclusion

The difference between agentic AI and generative AI shows up in operations more than output. An agent multiplies calls, compounds errors, holds permissions and loads rate limits in ways a single generation doesn’t.

So use one model call when one output answers the request, and a pipeline when you can write down the steps. Use an agent only when the next step depends on what the last one found. Then give it a step limit, a token budget, scoped credentials and a checker that isn’t the model.

FAQ

What is the difference between agentic AI and generative AI?

Generative AI produces content from a prompt. Agentic AI is a system that pursues a goal over several steps, choosing actions, calling tools and using the results. Agents usually rely on a generative model to decide.

Can generative AI become part of an agentic system?

Yes, and it usually does. The model plans, picks tools and writes the answer, while the application runs the loop, executes tools and enforces limits.

Is agentic AI more expensive than generative AI?

Usually, per task, because one task triggers many calls that re-send context. Caching, state management and completion rate can matter more than token price.

Is agentic AI more dangerous than generative AI?

Its risks are different. An agent can act without a person in between, so mistakes and injected instructions can have direct effects. The risk scales with the permissions the system grants.

When should a company use a deterministic workflow instead of an AI agent?

Use one when the steps are known in advance, outputs can be checked in code, or volume and latency demands are high. Use an agent when the path truly depends on intermediate results.

How do you measure the cost of an agentic AI task?

Divide total inference, tool, infrastructure and retry costs by the number of successfully completed tasks. Track calls per task, tokens per call, cache hit rate and completion rate separately.

How can developers limit an AI agent’s permissions and actions?

Give each tool scoped, short-lived credentials, and run generated code in a sandbox with outbound traffic blocked by default. Require human approval for consequential actions, enforce authorisation outside the model, and cap steps, time and tokens.

---

Keep reading

Here are the latest posts from the blog.