How AI Agents Work — Memory, Tools, Planning and MCP Explained | AI Agents Course Day 2 of 5

📰 Originally published on Securityelites — AI Red Team Education — the canonical, fully-updated version of this article.

🤖 AI AGENTS FOR BEGINNERS  FREE

Course Hub →

How AI Agents Work – Day 2 of 5  ·  40% complete

I once watched an AI agent fail at a task it had completed perfectly just twenty minutes earlier. The goal was the same. The tools were the same. Even the model was the same. So what went wrong?

The problem turned out to be surprisingly simple: the conversation had become so long that the agent’s context window was filling up. Somewhere along the way, the information about what it had already done was pushed out. The agent wasn’t deliberately ignoring its previous work — it had effectively forgotten it. It started repeating steps that were already finished.

That experience made one thing very clear to me: if you want to understand why AI agents sometimes behave brilliantly and sometimes seem to lose the plot, you need to understand memory.

Memory is what helps an agent keep track of a long-running task, remember useful information, and maintain some sense of continuity. But there’s another side to it that doesn’t get nearly enough attention: memory can also become an attack surface. If an attacker can influence what an agent remembers, retrieves, or trusts, the consequences can be much more serious than a simple wrong answer.

And then there’s MCP — the Model Context Protocol. MCP changed the conversation around agent memory and tool use by giving AI systems a standard way to connect with external data and tools instead of keeping everything trapped inside a single conversation window.

In this lesson, we’re going inside the agent loop. We’ll look at the different types of memory, how agents decide which tools to use, how they break complex goals into smaller steps, and what MCP actually does under the hood. No marketing language — just the architecture and the ideas you need to understand how modern AI agents really work.

🎯 What You’ll Understand After Day 2

The three types of agent memory and when each is used
Why context window limits are the single biggest constraint on agent reliability
How agents select and execute tools — and what happens when tools fail
What MCP is, why it matters, and what it replaced
How modern agents plan — chain-of-thought, tree-of-thought, and ReAct

⏱ 24 min read · 3 exercises · Browser needed 📋 Before You Start:

• Completed Day 1: What Is an AI Agent?
• Remember: the four-phase loop, the five agent types, the autonomy-risk relationship

How AI Agents Work — Day 2 of 5

1. The Three Types of Agent Memory
2. The Context Window — The Agent’s Working Memory Limit
3. How Tools Work — Selection, Execution, and Failure
4. What MCP Actually Is — And What It Changed
5. How Agents Plan — Chain-of-Thought, ReAct, and Tree-of-Thought
6. Putting It Together — A Full Agent Architecture
7. Questions and Answers

Day 1 established what an agent is and why the loop matters. Today goes inside the loop — the mechanisms that make it work, the constraints that make it fail, and the protocol that made 2026’s agent boom possible. The DNS lookup tool on SecurityElites illustrates the tool selection concept neatly: an agent given a domain investigation task would call that tool as one action in its loop — perceive the domain, plan a lookup, execute the tool call, observe the result. Today you’ll understand exactly how that decision to call a specific tool gets made.

The Three Types of Agent Memory

Memory is what allows an agent to maintain coherence across a task longer than a single exchange. Without memory, every loop iteration would start from scratch. With memory, the agent can track what it’s done, what it found, what went wrong, and what it still needs to do. There are three distinct types of memory in agent systems, and understanding the difference between them is essential for understanding why agents behave the way they do.

Type 1 — In-Context Memory. This is the agent’s working memory — everything currently in the conversation window. The original instruction, every tool call made so far, every result received, every observation noted. In-context memory is fast, immediately accessible, and directly influences every planning decision. It’s also strictly limited by the model’s context window. When the context fills up, older information gets pushed out. This is why long tasks can cause agents to “forget” earlier steps — the records of those steps have been pushed out of the working memory.

My rule for in-context memory: it’s reliable for tasks that complete in under thirty to forty loop iterations for current frontier models. For longer tasks, you need external memory.

Type 2 — External Memory. Storage outside the conversation window that the agent can explicitly read from and write to. This might be a database, a vector store (for semantic search over past information), a file system, or a key-value store. The agent reads external memory by making a tool call: “retrieve notes about this project,” “search the knowledge base for previous findings,” “read the saved state from yesterday’s session.” External memory removes the context window constraint — an agent can maintain coherent state across tasks that take days or weeks if it’s properly writing and reading external memory at each loop iteration.

---

📖 Read the complete guide on Securityelites — AI Red Team Education

This article continues with deeper technical detail, screenshots, code samples, and an interactive lab walk-through. Read the full article on Securityelites — AI Red Team Education →

---

This article was originally written and published by the Securityelites — AI Red Team Education team. For more cybersecurity tutorials, ethical hacking guides, and CTF walk-throughs, visit Securityelites — AI Red Team Education.