Featured

What is Agentic Search?

And why a 4-search loop costs about 5 times one search

Originally published in The AI Engineer.

Agentic search is a model searching in a loop: it writes a query, reads the results and picks its next move, whether that is another search, a page to open or the answer. For example, a coding agent uses it to find the code behind a bug, and a research agent to gather sources for a report. It costs more than one search, and it often pays off when the first search misses.

I write The AI Engineer, where every issue ships a tool you can run on your own system. Get it in The AI Engineer.

You Already Run This Loop

You run this loop yourself whenever a first search fails. You type an error message into a search box and skim the results. The page you need is missing, so you rewrite the query from what you just read, open the page that looks closest and answer once you have it. Each step uses what the step before it found.

Hand that loop to a model and you have agentic search. The model writes the query, reads the results and picks the next move. Each call to the model carries only what its request holds, so your code sends the question and every result so far with every call. Re-sending is often where the loop's cost comes from.

When One Search Gets It Wrong

Real questions often need facts from several pages. The 2022 Self-Ask paper uses the smallest case, 2 facts from 2 pages: who was president of the United States when superconductivity was discovered? In the paper's figure, GPT-3 answered it with no search at all and gave Franklin D. Roosevelt. That answer is wrong, and one search does no better.

The loop splits the question. Its first search asks when superconductivity was discovered and finds 1911. Its second search, written from that answer, asks who was president in 1911 and finds William Howard Taft.

One search answers from whatever its top result proposes, and the loop writes its second search from what the first one found.

The paper's authors then wrote Bamboogle, 125 questions of this 2-step kind. In the paper's test, Google answered 0.0% of them right from the question as typed. With GPT-3 writing its own follow-up searches, the paper measured 60.0%.

One search is how RAG works in its basic form. Retrieval-augmented generation sends the user's words to a search, puts the top results in the prompt and lets the model answer from them. Ask RAG the superconductivity question, and it answers from whatever ranked first. In agentic search, the model can reject those results and search again.

🔗 Retrieval by meaning over your own documents is the subject of What is Semantic Search?

🔗 Other ways to put a model in the retrieval loop are compared in Agentic RAG vs CUA vs A2A

What Each Part of the Loop Does

When you build a search agent or debug one that answers wrong, you need to know which part does what. To search, the model writes a request such as search("Brave Search API price"): the name of a function your code exposes, and its argument. That request is a tool call. Your code runs the function and sends the result back as the next message.

🔗 First time handing a model a function to call? What is Function Calling? walks through one call end to end.

Agentic search runs that exchange in a loop, with every decision left to the model: what to search, which page to open and when to answer. The loop has 4 parts:

1. The model writes every query and picks the next move.
2. A search tool sends the query to a search API, which answers from its index: a stored copy of web pages, organized so a query finds the pages that match it.
3. A fetch tool downloads one page the model asks to read in full.
4. Your code starts the run, runs each tool call, sends the result back and stops the run at a cap of 8 model calls.

Your code sends the question and the 2 tools, then runs every tool call and re-sends the whole conversation, until the model answers or your code stops it at 8 calls.

🔗 Agents in general? What is an AI Agent? covers the loop in which the model decides when to stop.

You choose who does the searching. Build the search and fetch tools yourself, and your code runs every search, so you see each query and set the cap. Or switch on the search a model provider already offers, and its servers do the searching while you write less code.

Tools You Use That Already Search in a Loop

You have probably watched this loop without knowing its name. Ask a coding assistant to fix a bug, and it searches your files, reads what it finds and searches again before it answers.

Coding agents search your code. Claude Code runs grep and glob, the command-line tools you already use to search file contents and file names, over your repository. Its creator, Boris Cherny, posted in February 2026 that early versions searched a stored index of your files, an approach called RAG. In his words, “we found pretty quickly that agentic search generally works better.” How Claude Code Actually Works walks through that search.

Deep research usually runs the longest loops. OpenAI’s documentation says its deep research can “find, analyze, and synthesize hundreds of sources”, and that a run “can take tens of minutes”. Anthropic’s own deep research agent is the subject of How Anthropic Built Multi-Agent Deep Research.

Chat assistants search the web, and ChatGPT moved to the loop in 2026. David Konitzny measured ChatGPT before and after GPT-5.6 became the default in August 2026. A round is one batch of searches the model sends before it reads any results. In his dataset, 94.0% of prompts got a single round before the change. After the change, 43.5% got one round, and the other 56.5% searched again from what the first round found.

⚠️ Turning on web search can still mean one search. OpenAI’s documentation describes non-reasoning web search, in which a model that answers without a thinking step sends your question to the search tool and relays the top results.

When the Loop Pays Off

A loop that searches again and again can still answer worse than one search. The loop often pays on questions that need more than one page, but only for a model that has learned to run it. The same loop that helps one model can leave another worse off than one search.

BrowseComp-Plus is a 2025 benchmark of hard research questions over a fixed set of documents. Its authors raised gpt-oss-20B’s reasoning effort, the budget it spends thinking before it acts. The extra thinking led it to search 23.87 times per question, up from 1.87. The benchmark scored the model’s right answers at 34.58%, up from 13.37%.

Before you rely on the loop, test it on your own questions. Take 2-step questions whose answers you know and run the loop below twice, once allowing 2 model calls and once allowing 8. Count the right answers each time: if 8 calls do not beat 2, the extra calls are only costing you. That test is a small eval, and What is an Eval? shows how to build a bigger one. The Search-R1 paper of March 2025 is the warning. On Qwen2.5–7B, a small open model, loops built by prompting alone scored lower than one search, and only the version trained to run the loop beat it.

What the Loop Costs

On list prices and the token sizes assumed below, a loop of 4 searches costs about 5 times what one search and an answer cost. Models read text, and providers bill it, in tokens, short chunks of a few characters each. Every model call sends the whole conversation again, so the loop pays for each search again on every later call.

Take a run of 4 searches, 1 page fetch and the answer, which is 6 model calls. I assume the prompt starts at 1,500 tokens and each tool call the model writes adds 150. Each search adds 2,064 tokens of results, the size OpenBenchmarks measured for the Brave Search API. The loop below asks for at most 2,064. The fetched page adds about 2,500 more tokens, my assumption for a 10 kB page. That brings the 6th call to 13,006.

Your code re-sends the first search result on 5 of the 6 calls, so the loop pays for it 5 times.

Summed, the 6 calls take 42,646 input tokens, and by my estimate they write about 1,350 output tokens. That run uses Claude Sonnet 5.5, the model in the code below, and Anthropic’s price for it puts the bill at about 10 cents. At Brave’s list price, the run’s 4 searches add 2 cents, about a sixth of the run’s 12-cent total. On the same prices, one search and an answer come to about 2.3 cents.A loop can also cost more and answer no better. A January 2026 study compared it with one search that first rewrites the query and then reranks the results, reordering them so the best match comes first. On fixed document sets where one passage answers the question, that one search often matched the loop. In the study, the loop used 2.7 to 3.6 times the input tokens and took 1.4 to 1.5 times as long.

To see those costs on your own questions, run the loop. It fits in about 45 lines of Python and prints each call’s input tokens as it runs. It reads your Brave Search API key from the BRAVE_API_KEY environment variable, and Brave includes $5 of free credits every month, about 1,000 searches. The Anthropic library reads your Anthropic key from ANTHROPIC_API_KEY. The first part defines the 2 tools and the 2 functions that run them:

import datetime, json, os, re, urllib.parse, urllib.request
import anthropic
 
MODEL = "claude-sonnet-5-5"
CAP = 8            # model calls before the loop gives up
 
TOOLS = [
    {"name": "search", "description": "Search the web. Send a short query.",
     "input_schema": {"type": "object", "properties": {"query": {"type": "string"}}, "required": ["query"]}},
    {"name": "fetch", "description": "Download one web page and return its text.",
     "input_schema": {"type": "object", "properties": {"url": {"type": "string"}}, "required": ["url"]}},
]
 
def search(query):
    url = "https://api.search.brave.com/res/v1/llm/context?" + urllib.parse.urlencode(
        {"q": query, "maximum_number_of_tokens": 2064})
    req = urllib.request.Request(url, headers={"X-Subscription-Token": os.environ["BRAVE_API_KEY"]})
    pages = json.load(urllib.request.urlopen(req, timeout=30)).get("grounding", {}).get("generic", [])
    return "\n\n".join(f"{p['title']}\n{p['url']}\n" + "\n".join(p.get("snippets", [])) for p in pages) or "no results"
 
def fetch(url):
    req = urllib.request.Request(url, headers={"User-Agent": "search-loop"})
    html = urllib.request.urlopen(req, timeout=30).read().decode("utf-8", "replace")
    return re.sub(r"\s+", " ", re.sub(r"<[^>]+>", " ", html))[:10000]

The second part is the function that runs the loop. It calls the model, runs each tool call the model makes and sends the results back. On the last call the cap allows, it makes the model answer:

def run(question):
    client = anthropic.Anthropic()
    ask = f"Today is {datetime.date.today()}. Answer the question below and name the page that says so.\n\n{question}"
    messages = [{"role": "user", "content": ask}]
    for call in range(1, CAP + 1):
        last = call == CAP   # on the last call the model must answer
        reply = client.messages.create(model=MODEL, max_tokens=1024, tools=TOOLS, messages=messages,
                                       tool_choice={"type": "none"} if last else {"type": "auto"})
        messages.append({"role": "assistant", "content": reply.content})
        print(f"call {call}: {reply.usage.input_tokens:,} tokens in")
        if reply.stop_reason != "tool_use":
            return "".join(b.text for b in reply.content if b.type == "text")
        results = []
        for block in reply.content:
            if block.type == "tool_use":
                arg = block.input.get("query") or block.input.get("url")
                print(f"  {block.name}: {arg}")
                out = search(arg) if block.name == "search" else fetch(arg)
                results.append({"type": "tool_result", "tool_use_id": block.id, "content": out})
        messages.append({"role": "user", "content": results})
    return f"stopped after {CAP} calls without an answer"
 
 
if __name__ == "__main__":
    print(run(input("Question: ")))

🏗️ Run one question both ways. This week, run a question your assistant answered wrong through the loop above twice. Use CAP = 2, one round of searches and then an answer, and then CAP = 8. Compare the 2 answers and the tokens each run prints.

Where the Loop Breaks

Now suppose a planted page is among the results. In July 2026 Zscaler found one: documentation for a fake Python library, built to rank high in search results for dependency errors. The page told any AI agent reading it to buy a 3 dollar API license, and in a sandbox 4 of the 26 models Zscaler tested paid.

Get Paolo Perrone’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

That page attacks one step of the loop. A run can break at 5 of its steps, and each step has a guard you can build. The query and the answer belong to the model, the results to the search tool, the page's text to the fetch tool, and the stop to your code:

The loop breaks at 5 of its steps, and your code adds a guard at each.

1. The query. The model searches the wrong words. In a 2026 pandas bug, pandas calls NumPy, NumPy raises "window shape cannot be larger than input array shape", and a search for that line finds NumPy's pages. The guard is to give the model the whole error, traceback included, so the query names the library that made the call.
2. The results. A page that only looks right ranks first. In my search on Brave's results page on 30 October 2026, pull requests that never merged took 2 of the top 4 places for one Pydantic error. The guard is your code checking what the answer cites, such as whether a cited pull request merged.
3. The page's text. A page can give the agent an order, as Zscaler's planted page did. The guard treats page text as data: the loop gives the model no tool that can pay, delete or send, so an order on a page has little to act with. A planted page can also ask the model to fetch an address carrying your user's details. The loop above lets fetch open any address, so add a check that it opens only pages the search returned. AI agent guardrails sit around every tool call for the same reason.
4. The answer. Sometimes the model reads a fact newer than its training and still answers from training. In a 2026 study, gpt-oss-120B still repeated its training 19.1% of the time when handed a true passage about a fact that changed in 2025. In that study, today's date and the model's training cutoff in the prompt brought that rate to 15.2%. The guard is an answer that must cite a page this run read, plus today's date and the model's training cutoff in the prompt. The loop above sends the date.
5. The stop. A loop with no cap often keeps searching, and the Claude Agent SDK sets no cap by default. A loop also searches when the model already knows: in one 2025 study, the model trained in the Search-R1 paper could have answered without searching in 27.7% of its search steps. The guard is your own cap, 8 calls in the loop above, which bounds the bill.

Where Your Users' Questions Go

Those guards protect the answer, and the queries still leave your code. If a user types a customer's name into your agent, that name goes to a search company inside the query. Every query the model writes goes to a search company that answers from its own index or another's. Few companies crawl the whole web: Google, Microsoft with Bing, Brave, Exa and Perplexity. Many other search APIs buy results from one of them, or scrape another engine's results page.

A scraper adds a company: SerpApi sells Google's results by scraping them, so a query sent to it reaches 2 companies. A model provider without its own index buys its results from a company that has one. Claude's search tool is an example: in March 2025 Simon Willison matched the citations of one Claude web search to Brave's results for the same query. Your model provider sees every query in every setup, because its model writes them. Beyond the provider, a query reaches 1 company through a search API that owns its index, 2 through a scraper and 1 through a built-in tool.

The index owner also reads every query. Brave stores the queries sent to the Brave Search API as long as 90 days, to bill and to troubleshoot, and offers Enterprise customers zero retention.

Beyond your model provider, how many companies read your agent's queries depends on who owns the index behind its search tool.

The loop above sends its queries to Brave's LLM Context endpoint, the version of the Brave Search API built for agents. Brave answers every query from its own index and passes none on to another search engine. So the search API you pick decides who reads your users' words.

The One Thing to Remember

Agentic search is a decision repeated after every model call: search again, open a page or answer. That decision often reaches answers no single page holds, and it is also what you pay for and what a planted page can redirect. So run your hardest question through the loop above with CAP = 2 and with CAP = 8, then compare the answers and the token counts it prints.

The AI Engineer takes apart one production AI problem twice a week, with the code to run it on yours. Subscribe to The AI Engineer. And if this saved you time, 50 claps push it to more engineers on Medium.

Where to Next?

• 📖 Go deeper: What is a Reranker?, for when your loop finds the right page too far down the results.
• 🔗 Go simpler: What is RAG?, for when one search over your own documents is all you need.
• 🔀 Related: How OpenAI Codex Works, for when you want to see a coding agent's whole loop, end to end.

Next in this series: one error followed through the loop, from its traceback to the release that fixes it.

FAQ

What is agentic search? It is a model running its own searches in a loop and choosing each next move: another search, a page to open or the answer. Coding agents, deep research tools and chat assistants all run it. The loop ends when the model stops calling tools and answers, or when its cap runs out.

How is agentic search different from RAG? Basic RAG searches once with the user's words and answers from the top results. Agentic search hands the model the choice to search again, so it can reject results that only look right, at the price of more tokens. Both can run over your own documents or the web.

How does an AI agent search the web? It calls a search tool. The model writes a tool call with a query, and your code or the provider's servers send it to a search API that answers from its web index. The results go back to the model, and a fetch tool downloads a full page when the results are not enough.

Is agentic search the same as deep research? Deep research is usually agentic search at its longest. OpenAI's documentation treats deep research as agentic search run across hundreds of sources. Exa and Perplexity each treat "agentic search" and "deep research" as one product, so read each vendor's definition before you compare their tools.

How do I stop an agent's search loop from running forever? Count model calls in your own loop and stop at a number you chose; the loop in this issue stops at 8. The defaults differ: OpenAI's Agents SDK caps a run at 10 turns, its own name for model calls, and the Claude Agent SDK sets no cap by default.

When should I use agentic search instead of one search? Use the loop when the answer needs more than one page, or when the first results only look right, and test that your model answers better with it. Keep one search for questions a single page answers, because every extra search adds a model call that re-sends the whole conversation. One search can first rewrite the query and rerank the results. It often matches the loop when one passage holds the answer and the documents are a fixed set.

Sources

1. Measuring and Narrowing the Compositionality Gap in Language Models, arXiv (October 2022)
2. Web search tool, Anthropic (November 2026)
3. Boris Cherny on X, X (February 2026)
4. Deep research, OpenAI (November 2026)
5. ChatGPT's new default model GPT-5.6: more retrieval, LinkedIn (August 2026)
6. Web search, OpenAI (October 2026)
7. BrowseComp-Plus, arXiv (August 2025)
8. Search-R1: Training LLMs to Reason and Leverage Search Engines with Reinforcement Learning, arXiv (March 2025)
9. Web search benchmark, OpenBenchmarks (October 2026)
10. Pricing, Anthropic (November 2026)
11. Is Agentic RAG worth it? An experimental comparison of RAG approaches, arXiv (January 2026)
12. Indirect prompt injection: web content targets AI agents, Zscaler (July 2026)
13. Agent loop, Anthropic (November 2026)
14. When Facts Change: Temporal Knowledge Conflict Resolution in LLMs, ACL Anthology (July 2026)
15. Search Wisely: Mitigating Sub-optimal Agentic Searches By Reducing Uncertainty, ACL Anthology (November 2025)
16. Why we're taking legal action against SerpApi, Google (December 2025)
17. Anthropic uses Brave for web search, Simon Willison (March 2025)
18. Search API privacy notice, Brave (August 2026)
19. Brave Search API, Brave (November 2026)
20. Run configuration, OpenAI Agents SDK (November 2026)