Agentic search: definition and how it works

Agentic search is a retrieval pattern where an AI agent treats a question as a task. It breaks the task into steps, searches, reads what comes back, and decides what to do next. It may search again with a narrower query, open a specific page, or stop and write the answer.

A classic search engine returns a ranked list for the words you typed. An answer engine with agentic search does the reading for you and returns a synthesized answer, usually with citations. The difference is the loop: plan, search, read, repeat.

The details vary by platform and change often. The common shape, as of October 2026, looks like this:

1. Plan. The model decides whether the question needs the web at all. Retrieval is discretionary per query on every major platform.
2. Rewrite. OpenAI says ChatGPT search typically rewrites your question into one or more targeted queries. The Gemini API says grounding automatically generates and executes one or more search queries.
3. Retrieve and read. The agent pulls candidate pages into its context. This is the retrieval stage.
4. Loop or answer. If the results look thin, the agent searches again. Otherwise it writes the answer and picks what to cite.

Two facts follow. First, the retrieved set is usually larger than the cited set: OpenAI's API documents that the number of sources is often greater than the number of citations. Second, some fetches are user-triggered. OpenAI says robots.txt rules may not apply to ChatGPT-User, and Perplexity says Perplexity-User generally ignores robots.txt. For the full path from query to citation, see how AI search picks sources.

An agent reads whatever its searches return, and that includes pages you do not own. Reviews, comparison posts, forums and directories can all land in the agent's context when someone asks about your category.

Research on endorsement vulnerability (arXiv:2606.16821, June 2026) tested search agents against manipulated web content. It found that vulnerability varied widely across model backends, and that the same agent scaffold could raise or lower attack success depending on the model. The study used a mock search API and never published adversarial content to the open web. So it shows what happens once manipulated content is in the results, not how easy it is to get there.

The practical reading for a brand:

• Watch third-party pages that mention you. A page with hidden instructions or false claims about you is a reputational risk, not a page-property of your own site.
• Keep your own access clean. Agents cannot read your pages if robots.txt, a firewall or client-side rendering blocks them. Check the retrieval bots, such as PerplexityBot, one by one.
• State specific facts plainly. A price or a one-line definition in fetchable HTML gives the agent a sentence it can quote.

Injecting hidden text or instructions to steer agents is illegitimate. Do not do it.

• "Track the prompts your customers type." The agent sends its own rewritten queries, so a prompt list is a proxy for an input nobody outside the engine can see.
• "If it searched, it read and used every source." Retrieved is not the same as cited, and cited is not proof of influence. To see the difference on the APIs that expose it, try logging retrieved vs cited sources.
• "Every answer is agentic." Many answers come from the model's training data with no search at all. Here is how to tell whether an answer used live web search.
• "A content trick will win the agent over." A July 2026 survey of 45 GEO studies (arXiv:2607.14035) found no technique with a stable, cross-platform causal effect on discoverability.

• AI agent: the software that runs the plan, search and read loop.
• Retrieval: the stage where pages enter the model's context.
• Answer engine: the product surface that returns a synthesized answer.
• PerplexityBot: an example of a retrieval crawler that builds the index agents search.