Ambient AI agents: How software that waits for events does work without being asked

An ambient agent is an AI program that watches a stream of events, such as new emails, chat messages or bug reports, and starts work on its own when something calls for it. It does not wait for a person to open a chat window and type a prompt. It still asks for a human when a decision needs one.

The idea is also called a proactive agent. It is the design behind a prototype DeepSeek released this month, covered in our news story on the DeepSeek super agent.

A colleague who reads the inbox, not a chatbot you must prompt

Picture an assistant who sits in your team’s chat. Someone posts that the login page crashes. The assistant reads it, checks the code, and a while later replies with a proposed fix for you to approve. Nobody told it to start. The message itself was the trigger.

A chat assistant works the other way. You open it, describe the task, wait, then repeat for the next task. LangChain argued in January 2025 that this adds overhead to every job, and that a person can only run one conversation at a time. An ambient agent removes the starting step and can handle several tasks at once.

Events in, work items out, humans only when needed

Most ambient agents share four parts.

• An event stream. The agent subscribes to a source: email, a chat channel, a code host such as GitHub.
• A filter. Most events need nothing. The agent, or a set of rules, decides which ones count as work.
• A worker. Each accepted event becomes a task, handled in its own session so tasks do not mix.
• A way to reach people. The agent reports back in the place the request came from, and flags only what needs a human.

LangChain names three ways an ambient agent engages a person. Notify: it flags something important but takes no action. Question: it asks for missing information instead of guessing. Review: it proposes an action, such as an email draft, and a person approves, edits or rejects it. LangChain also built an “Agent Inbox”, a queue that lists every open item waiting on a human, modeled on an email inbox and a support ticket system.

Where the idea came from

LangChain, the company behind the LangGraph agent framework, introduced the term “ambient agents” in a January 14, 2025 blog post. Its definition: ambient agents “listen to an event stream and act on it accordingly, potentially acting on multiple events at a time.” The company released an email assistant that drafts replies for review, plus an open-source reference version.

LangChain was careful to add that ambient does not mean fully autonomous. In its words, “we do not think that ambient agents are necessarily completely autonomous.” The design question it highlights is when and how the agent engages a human.

How DeepSeek’s prototype applies it

According to its README, DeepSeek’s dsh-superagent-prototype is built for one GitHub repository. It listens to GitHub activity and, optionally, Feishu messages. When an allowed person asks for something, it opens a work item, works in its own agent session and directory, and replies where the request came from, for example with a pull request. A web panel lists items that need a person.

The README states the goal as taking “as little human attention as possible” while giving as much value as possible. The agent acts when asked or when a rule the team wrote allows it. DeepSeek labels the code a research prototype and says it is not production-ready.

Its authorization document describes how the gate works. The host, not the message text, enforces who may start work. A listed person addressing the agent is an explicit request. Anything the agent infers on its own is a candidate that must be assessed. The accept setting has three modes: off, observe (the default, which only records what it would have accepted) and auto. Proactive acceptance also needs at least one matching rule, and a person’s stop withdraws the permission.

Trade-offs: More help, more ways to go wrong

A tool that acts on events has a bigger attack surface than one you prompt. Anyone who can put text in front of the agent, such as a commenter on an issue, may try to steer it. That is why DeepSeek’s design separates reading a message from being authorized by it: messages can inform a decision but cannot change permissions. The same worry applies to all agents that read untrusted content.

There are also practical limits.

• Noise and false triggers. An agent that acts on a misread message wastes time or creates clutter.
• Attention cost. If every item lands in the human queue, the saved effort disappears.
• Hard to compare. DeepSeek’s README names no supported models and reports no benchmarks, so output quality against tools like Claude Code or Codex is unknown.

What to watch next

Three questions will decide whether the approach spreads. First, whether permission systems like observe-then-auto modes become standard, letting teams test an agent’s judgment before it acts. Second, whether review queues such as LangChain’s Agent Inbox or DeepSeek’s panel prove usable at scale. Third, whether proactive agents move beyond one repository to whole teams, where the rules for who may trigger what become much harder to write.

For now, ambient agents are a design pattern more than a product. The common thread is simple: the event is the prompt, and the human is asked only when the agent needs one.