What does "agentless" mean for Ansible, and how does a task actually run on a managed host?

No Ansible software runs permanently on managed hosts. The control node connects over SSH (or WinRM), copies a small module over, runs it, and deletes it when done.

* Each task pushes a module, runs it, collects the result and cleans up, so nothing stays running on the host. *

Step by step, for each task:

1. The control node opens a connection to the host, by default over SSH (Linux/UNIX) or WinRM (Windows).
2. It transfers a small program, an Ansible module, together with the task's arguments.
3. The module runs on the host and puts the system into the requested state (for example "package nginx is installed").
4. The module reports back what it did (changed / unchanged / failed).
5. When Ansible is done, the pushed modules are removed.

Contrast this with agent-based tools like Puppet or Chef, where a daemon runs permanently on every server and must be installed, updated and secured.

Go deeper:

• Ansible module architecture (official developer docs) — under the hood: how AnsiballZ packages a module, ships it to a temp dir on the host and executes it.
• How Ansible Works (Ansible Collaborative / Red Hat) — modules are copied over, run, and removed when finished.
• Connection methods and details (official docs) — native OpenSSH, key-based auth and the non-SSH connection options.