AI development company for Chicago teams

What an AI development company actually builds

A company agent is software, not a chat window. It joins a language model to your documents, your business tools and rules about what it may do. An AI development company designs that system, builds it, tests it and keeps it working as models and tools change. AI software development is still software development: requirements, tests, security review and maintenance count as much as the choice of model.

Anthropic's engineering team separates workflows, where models and tools follow predefined code paths, from agents, where the model directs its own process and tool use. It recommends finding the simplest solution possible, and warns that agent autonomy brings higher costs and the potential for compounding errors.^[34]

• Knowledge agent

  Answers questions from your own documents, cites what it used and declines what it may not see.

• Action agent

  Reads and writes in your tools under a scoped service account and asks for approval on risky steps.

• AI feature in your product

  A summarize, extract, classify or draft step built into software you already ship.

This page covers custom builds. For choosing use cases, vendors and governance, see AI consulting. For process automation with workflow tools, see AI automation agency.

Architecture of a company agent, part by part

Custom AI agent development comes down to eight parts. Each needs a written answer in a proposal.

• Model

  Cloud API or self-hosted open model. Design it to be swappable, because vendors retire models.

• Tools (function calling)

  Each function has a name, a description and an input schema. The model requests a call and your code runs it. Strict schema modes exist at OpenAI and Anthropic.

• Retrieval (RAG)

  Fetches relevant passages from your documents at question time, so answers can cite sources.

• Memory

  What the agent keeps between steps and sessions: what, where, for how long and who can delete it.

• MCP servers

  An open standard for connecting AI applications to data sources, tools and workflows.

• Guardrails

  Limits enforced in code, not only in the prompt: allowed tools, scoped credentials, checks, approval gates.

• Evaluations

  A test set built from your real cases, run before every change and sampled on live traffic.

• Logging and audit trail

  A record of every model call, tool call, approval and result.

How the agent reaches your tools. Anthropic describes client tools, which run in your application (the model returns a structured request, your code runs it and sends back the result), and server tools, which run on the provider's infrastructure. OpenAI describes the same loop and says to assume a response may hold several calls. Anything that touches your systems is your code, so permissions, validation and logging belong there.^[9],[11]

Where MCP fits. The Model Context Protocol is an open-source standard for connecting AI applications to external systems, which its documentation compares to a USB-C port. A host creates one client per server, and servers expose tools, resources and prompts. The tools specification says there should always be a human in the loop with the ability to deny tool invocations, and that servers must validate inputs, implement access controls, rate limit and sanitize outputs.^[5],[6],[7]

Where retrieval comes from. Lewis and colleagues described retrieval-augmented generation in a 2020 paper: a pre-trained model, which stores factual knowledge in its parameters, combined with a dense vector index of Wikipedia reached through a neural retriever. They list provenance and updating knowledge as open problems it could help with. In a company agent your documents replace Wikipedia, so access control on the index matters.^[15]

Evaluation. NIST released the AI Risk Management Framework on January 26, 2023 and its Generative AI Profile on July 26, 2024. The Playbook's Measure function asks that test sets and metrics be documented (MEASURE 2.1), that deployed systems be monitored in production for drift (MEASURE 2.4) and evaluated regularly for safety risks (MEASURE 2.6). Anthropic recommends evals that mirror your real tasks, and OpenAI documents trace grading of model calls, tool calls, guardrails and handoffs.^{[22],[23],[24],[26]}

Keep the evaluation data in your own repository. OpenAI states that its Evals platform becomes read-only for existing users on October 31, 2026 and is scheduled to shut down on November 30, 2026, a reminder that hosted tooling can change under you.^[25]

What the agent does alone and what needs a person

Autonomy is a setting, not a yes or no. Write it down per action before anything is built. A starting policy:

Sources: ^[3],[7]

OWASP names the failure this prevents: Excessive Agency, where a model-based system takes damaging actions in response to unexpected, ambiguous or manipulated model output. Its three root causes are excessive functionality, excessive permissions and excessive autonomy. Its fixes include offering only the tools needed, avoiding open-ended tools such as raw shell access, requiring user approval for high-impact actions, and enforcing authorization in downstream systems instead of trusting the model to decide.^[3]

On our own builds, agents ask for approval on risky steps, log every action, use least-privilege access with a dedicated service account per agent, run on accounts the customer owns and can be switched off.

Security risks and Illinois rules that apply

OWASP's Top 10 for LLM Applications, 2025 edition, runs from LLM01 Prompt Injection to LLM10 Unbounded Consumption. Three are the first to check when an agent can read documents and use tools (our selection):^[1]

• Prompt injection (LLM01). User prompts altering the model's behavior or output in unintended ways. OWASP says retrieval-augmented generation and fine-tuning do not fully prevent it, and lists least privilege, validated output formats, human approval for high-risk actions, segregated external content and adversarial testing.^[2]
• Excessive agency (LLM06). Too many tools, too much permission or too much autonomy. The cure is a short tool list, scoped credentials and authorization checks where the data lives.^[3]
• Vector and embedding weaknesses (LLM08). In a retrieval system, weak access controls can expose sensitive data, and in a shared index one group's content can be retrieved for another group's questions. OWASP recommends permission-aware vector stores and detailed retrieval logs.^[4]

Anthropic adds a rule that is easy to miss: tool results often carry content you do not control, such as web pages, inbound email and user uploads, and an attacker may embed instructions in it (indirect prompt injection). Treat tool results as untrusted input. MCP's security guidance calls token passthrough, where a server forwards tokens not issued to it, an anti-pattern, and recommends scopes that start with low-risk read operations.^[10],[8]

Illinois Biometric Information Privacy Act (BIPA). A biometric identifier includes a voiceprint and a scan of hand or face geometry. Before collecting one, a private entity must inform the person in writing, state the purpose and length of term, and get a written release, and it must publish a retention and destruction policy. Liquidated damages are $1,000 for a negligent violation and $5,000 for an intentional or reckless one, or actual damages if greater, plus attorneys' fees. If an agent will hear voices or process faces, ask an Illinois attorney whether BIPA applies before you build.^{[30],[31],[32]}

Illinois Personal Information Protection Act. A data collector holding an Illinois resident's personal information must maintain reasonable security measures, and a contract disclosing that information must require the recipient to do the same. When an agency or AI vendor will touch such data, that clause belongs in the contract.^[33]

Where the model runs: cloud API or self-hosted

Two hosting questions are separate: where the model runs, and what the provider keeps. Answer both in writing before you send real data.

Sources: ^{[12],[13],[16],[17],[19],[20],[21],[35]}

OpenAI. Its documentation says that, as of March 1, 2023, data sent to its API is not used to train or improve its models unless you opt in. Abuse monitoring logs are kept for up to 30 days by default, unless longer retention is required by law or reasonably necessary to protect its services or a third party. You can set a region for new projects, and a Zero Data Retention option exists for approved customers.^[12]

Anthropic. Its documentation says retained data is never used for model training without your express permission, that zero data retention is enabled per organization on request, and that some models require 30-day retention and are not available under zero data retention unless Anthropic authorizes it. Flagged content may be kept for up to 2 years even then. On Amazon Bedrock and Google Cloud, the cloud provider is the data processor.^[13]

Self-hosted models are possible on our builds when privacy requires it. The trade is more hardware and operations work in exchange for keeping prompts inside your environment.

Hire an AI developer, use an agency or buy a product

The Bureau of Labor Statistics reports a median annual wage of $135,980 for software developers in May 2025, and projects employment for software developers, quality assurance analysts and testers combined to grow 10 percent from 2025 to 2035, much faster than average. Pay is only part of the cost of a hire, and a general software developer figure does not measure AI engineering experience (our reasoning, not a BLS figure).^[27]

Sources: ^{[27],[28],[29]}

A practical order of questions (our reasoning):

1. Does a product already do the job? If yes, buy it and stop. Custom code is something you must maintain.
2. Is the work continuous for a long time, and do you have someone who can direct an AI engineer? Then hire.
3. Is it a bounded build, or do you lack AI experience in house? Use an agency, with ownership, handover and maintenance in the contract.
4. Still unsure? Run a small pilot against a written success measure first.

If you are still deciding whether AI belongs in the business at all, AI consulting comes before a build.

What to expect from a partner and what to ask

A serious AI development partner delivers more than a demo. Put these in the contract (a checklist from our reasoning, not a legal form):

• A written scope: goal, tools, approvals and success measure.
• Source code and infrastructure configuration in a repository registered to your company.
• Cloud projects, API accounts and keys registered to your company, with a dedicated service account per agent.
• The evaluation set, its results and the scripts to rerun it.
• A runbook and a data flow diagram naming every system and provider that sees your data.
• Logs and an audit trail you can read without the vendor, plus a handover session and a maintenance plan.

What keeps costing money after launch:

• Model retirement. Anthropic says it regularly retires older models, that applications may need updates as a result, and that it gives at least 60 days' notice for publicly released models. Requests to a retired model fail.^[35]
• Usage costs. Anthropic documents that tool use adds system prompt tokens to each request, billed like normal input and output tokens. More tools and more calls raise the bill (our reasoning).^[9]
• Knowledge and monitoring. OWASP lists conflicts between sources as a retrieval risk, and NIST asks for monitoring in production (MEASURE 2.4). Someone must own both.^[4],[23]
• Connected systems change. When a CRM or ticket system changes an API or a permission, the agent's tools break (our reasoning).
• Self-hosted upkeep. You patch the server and track versions; vLLM lists specific Python and GPU requirements.^[19]

Questions to ask any engineer or agency, including us (written from your side of the table):

1. Show us the architecture of a similar agent you shipped: model, tools, retrieval, memory and logging. Who built each part?
2. Which actions run without a person, where is each approval gate enforced (prompt, or code and downstream system), and which credentials does each tool use?^[3]
3. How do you test for prompt injection, including instructions hidden in documents and tool results?^[2],[10]
4. How does retrieval respect permissions, so one user's question never pulls another team's documents?^[4]
5. Where does our data go? Name each provider, region and retention period, and say whether any of it can be used for training.^[12],[13]
6. What is in the evaluation set, who wrote it, how often does it run and do we own it?^[23],[24]
7. What do you log, for how long, and can we read the logs without you?^[7]
8. If our model is retired, how long does a swap take and how will you check quality afterward?^[35]
9. Who owns the code, prompts, evaluation data, cloud projects and API accounts at delivery, and which clause says so?^[28],[29]
10. What does the contract say about reasonable security for personal information of Illinois residents?^[33]
11. What does monthly maintenance include, and what would make it cost more?
12. Can we speak with a client who runs one of your agents in production, and when would you advise us not to build?

How an engagement works with us

1. Request

   You tell us the job the agent should do, by form or by phone at 773-800-1520.

2. Short call

   We ask about the process, the systems involved, the data it will touch and who approves what.

3. Written scope

   Goal, tools, approvals and success measure on one page, before anything is built.

4. Pilot

   A limited version runs on real cases with approvals on, logs on and a dedicated service account for the agent.

5. Rollout and review

   Scope widens only after the pilot meets the measure you set. The agent runs on accounts you own and can be switched off.

Hours are Monday to Friday 9-5 and Saturday 10-2, Central time, in English and Polish. Media Express has been in business since April 1995, with 2,500+ digital projects, and keeps 100+ web properties running and monitored with its own team of AI agents.

What to prepare before the call:

• The job in one sentence, and the person who owns it.
• Real examples of the work, including the messy ones.
• Where the knowledge lives today and who may see what.
• The systems the agent must read from or write to, and who administers each.
• Data that must never go to a third party, such as personal, health, financial or biometric data.
• What a good result looks like, as something you can check, and who approves the risky steps.

When this is not a good fit

• An off-the-shelf tool already does the job. If your help desk or CRM has the feature built in, configure that first.
• The task is a fixed sequence of steps. A workflow or a script is cheaper to run and easier to audit than an agent, and Anthropic's advice is to find the simplest solution possible. See AI automation agency.^[34]
• You cannot describe success. Without a definition of a good answer, quality cannot be checked.
• The data is not ready, or not yours to use. Contradicting documents give poor retrieval, and data you have no right to process, such as biometric data without a written release, comes first.
• Nobody will own it after launch. Models are retired and documents change. An unattended agent decays.^[35]
• You want a fixed promise of accuracy. Model output varies, so a figure named before seeing your data is a guess.
• Legal or safety decisions would run with no human review. Keep a qualified person in the loop.

A small pilot against a written success measure is the low-commitment way to find out which side of this list you are on.

Questions answered

Sources

1. OWASP Top 10 for LLM Applications 2025 (OWASP GenAI Security Project), accessed 2026-10-12. The ten risks of the 2025 edition, LLM01 to LLM10.https://genai.owasp.org/llm-top-10/
2. LLM01:2025 Prompt Injection (OWASP GenAI Security Project), accessed 2026-10-12. Definition of prompt injection, the statement that RAG and fine-tuning do not fully prevent it, and the listed mitigations.https://genai.owasp.org/llmrisk/llm01-prompt-injection/
3. LLM06:2025 Excessive Agency (OWASP GenAI Security Project), accessed 2026-10-12. Definition, the three root causes and the mitigations (least privilege, human approval, complete mediation).https://genai.owasp.org/llmrisk/llm062025-excessive-agency/
4. LLM08:2025 Vector and Embedding Weaknesses (OWASP GenAI Security Project), accessed 2026-10-12. Retrieval risks: unauthorized access, cross-tenant leakage, poisoning, knowledge conflicts; permission-aware stores and logging.https://genai.owasp.org/llmrisk/llm082025-vector-and-embedding-weaknesses/
5. What is the Model Context Protocol (MCP)? (Model Context Protocol project), accessed 2026-10-12. MCP as an open-source standard for connecting AI applications to external systems.https://modelcontextprotocol.io/docs/getting-started/intro
6. MCP architecture overview (Model Context Protocol project), accessed 2026-10-12. Host, client and server roles; tools, resources and prompts; stdio and Streamable HTTP transports.https://modelcontextprotocol.io/docs/2026-07-28/learn/architecture
7. MCP specification: Tools (Model Context Protocol project), accessed 2026-10-12. Human in the loop recommendation, server obligations (validate inputs, access controls, rate limits, sanitize outputs) and audit logging.https://modelcontextprotocol.io/specification/latest/server/tools
8. MCP security best practices (Model Context Protocol project), accessed 2026-10-12. Token passthrough as an anti-pattern and the least-privilege scope model.https://modelcontextprotocol.io/docs/2026-07-28/tutorials/security/security_best_practices
9. Tool use with Claude (Anthropic), accessed 2026-10-12. How client and server tools work, who executes them, and that tool use adds tokens billed with normal input and output tokens.https://platform.claude.com/docs/en/agents-and-tools/tool-use/overview
10. Handle tool calls (Anthropic), accessed 2026-10-12. Tool results can carry untrusted content and indirect prompt injection.https://platform.claude.com/docs/en/agents-and-tools/tool-use/handle-tool-calls
11. Function calling (OpenAI), accessed 2026-10-12. The define, call, execute, return loop; strict mode; assume several calls per response.https://developers.openai.com/api/docs/guides/function-calling
12. Data controls in the OpenAI API (OpenAI), accessed 2026-10-12. No training on API data by default since March 1, 2023; abuse monitoring logs kept up to 30 days; Zero Data Retention; regions.https://developers.openai.com/api/docs/guides/your-data
13. API and data retention (Anthropic), accessed 2026-10-12. Zero data retention per organization, never trained without express permission, 30-day retention models, flagged content up to 2 years, cloud provider as processor.https://platform.claude.com/docs/en/manage-claude/api-and-data-retention
14. How long do you store my organization's data? (Anthropic Privacy Center), accessed 2026-10-12. API inputs and outputs deleted within 30 days; used to show that vendor pages can describe retention differently.https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data
15. Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks (arXiv (Lewis et al., NeurIPS 2020)), accessed 2026-10-12. Original RAG paper: parametric memory plus a dense vector index accessed by a retriever; provenance and updating knowledge.https://arxiv.org/abs/2005.11401
16. Ollama FAQ (Ollama), accessed 2026-10-12. Local running, default bind address, default context window, parallel requests and memory scaling.https://docs.ollama.com/faq
17. Ollama GPU support (Ollama), accessed 2026-10-12. NVIDIA compute capability and driver requirements.https://docs.ollama.com/gpu
18. vLLM documentation (vLLM project), accessed 2026-10-12. vLLM as a library for LLM inference and serving with an OpenAI-compatible API server.https://docs.vllm.ai/en/latest/
19. vLLM GPU installation requirements (vLLM project), accessed 2026-10-12. Linux, NVIDIA compute capability 7.5 or higher, no native Windows support.https://docs.vllm.ai/en/latest/getting_started/installation/gpu.html
20. vLLM README (vLLM project (GitHub)), accessed 2026-10-12. Apache-2.0 license and supported hardware.https://github.com/vllm-project/vllm
21. Llama 3.1 Community License Agreement (text hosted in the Ollama library) (Meta, text hosted by Ollama), accessed 2026-10-12. Open-weight model license terms differ from the serving software; the 700 million monthly active users clause.https://ollama.com/library/llama3.1/blobs/0ba8f0e314b4
22. AI Risk Management Framework (NIST), accessed 2026-10-12. AI RMF 1.0 release date and the Generative AI Profile (NIST-AI-600-1).https://www.nist.gov/itl/ai-risk-management-framework
23. AI RMF Playbook: Measure (NIST AI Resource Center), accessed 2026-10-12. MEASURE 2.1 documented test sets and metrics, 2.4 production monitoring, 2.6 regular safety evaluation.https://airc.nist.gov/AI_RMF_Knowledge_Base/Playbook/Measure
24. Define success criteria and build evaluations (Anthropic), accessed 2026-10-12. Task-specific evals, automated grading, and a different model as grader.https://platform.claude.com/docs/en/test-and-evaluate/develop-tests
25. Working with evals (OpenAI), accessed 2026-10-12. What evals are; the Evals platform read-only and shutdown dates.https://developers.openai.com/api/docs/guides/evals
26. Agent evals and trace grading (OpenAI), accessed 2026-10-12. A trace records model calls, tool calls, guardrails and handoffs; graders score traces.https://developers.openai.com/api/docs/guides/agent-evals
27. Software Developers, Quality Assurance Analysts, and Testers (U.S. Bureau of Labor Statistics, Occupational Outlook Handbook), accessed 2026-10-12. Median annual wage of software developers in May 2025 and the 2025 to 2035 employment projection.https://www.bls.gov/ooh/computer-and-information-technology/software-developers.htm
28. Circular 30: Works Made for Hire (revised August 2024) (U.S. Copyright Office), accessed 2026-10-12. When a work is made for hire, the nine commissioned-work categories, and the written agreement requirements.https://www.copyright.gov/circs/circ30.pdf
29. Circular 1: Copyright Basics (revised September 2021) (U.S. Copyright Office), accessed 2026-10-12. A transfer of copyright ownership generally must be in writing and signed by the owner.https://www.copyright.gov/circs/circ01.pdf
30. 740 ILCS 14/10 Biometric Information Privacy Act: Definitions (Illinois General Assembly), accessed 2026-10-12. Definition of biometric identifier, including voiceprint and scan of face geometry.https://www.ilga.gov/Documents/legislation/ilcs/documents/074000140K10.htm
31. 740 ILCS 14/15 Biometric Information Privacy Act: Retention, collection, disclosure, destruction (Illinois General Assembly), accessed 2026-10-12. Written notice and written release before collection; public retention and destruction policy.https://www.ilga.gov/Documents/legislation/ilcs/documents/074000140K15.htm
32. 740 ILCS 14/20 Biometric Information Privacy Act: Right of action (Illinois General Assembly), accessed 2026-10-12. Liquidated damages of $1,000 or $5,000 per violation or actual damages, plus fees.https://www.ilga.gov/Documents/legislation/ilcs/documents/074000140K20.htm
33. 815 ILCS 530/45 Personal Information Protection Act: Data security (Illinois General Assembly), accessed 2026-10-12. Reasonable security measures, and the contract provision for recipients of personal information.https://www.ilga.gov/Documents/legislation/ilcs/documents/081505300K45.htm
34. Building effective agents (Anthropic), accessed 2026-10-12. Workflows versus agents; find the simplest solution possible; cost and compounding errors.https://www.anthropic.com/engineering/building-effective-agents
35. Model deprecations (Anthropic), accessed 2026-10-12. Regular model retirement, at least 60 days' notice for publicly released models, retired models fail.https://platform.claude.com/docs/en/about-claude/model-deprecations

How we checked this page

Last verified 2026-10-12 · Media Express LLC

General information, not legal, financial or security advice. Rules and vendor terms change; check the cited source before you rely on a figure.

Related

• AI consulting for Chicago companiesAI consulting
• AI automation agency for Chicago businessesAI automation agency
• Is your company ready for AI agents ?Free self-check
• How we run AI agents every dayProof from our own work