Built-in Capabilities

Before building custom tools, know the powers models bring in the box: code execution, live web access, computer use, file systems — each a superpower with a sharp edge.

▶ Watch this reel

What you'll learn

Code execution
Web search & fetch
Computer & browser use
File system access

Remember this

Sandboxed code execution gives agents precision — no network, allow-listed reads, resource limits, ephemeral disk
Search + fetch close the freshness gap; synthesize with as-of dates and source triage
Computer/browser use is the no-API last resort — slow, brittle, and guarded by dedicated accounts + human confirmation; file tools live behind path-scoping

Code execution sandbox

Model writes code → sandbox runs → stdout/artifacts as observations.
Sandbox: no network, allow-listed reads, CPU/mem/time limits, ephemeral disk.
Working dir per session; truncate outputs; artifacts stored + linkable.

Web search & fetch

search: landscape; fetch: clean-text page → observation.
Discipline: source triage, as-of dates, truncation (summary-first), ToS.

Computer / browser use

For systems with NO API. Screenshots→actions (computer) or DOM (browser).
Slow, brittle; dedicated accounts, least privilege, human-confirm irreversibles.

File system tools

Workspace pattern: resolve()+prefix check, ext allow-list, read caps.
Composes with sandbox → full agent workshop (write/run/read/iterate).

Code: Capability stack: what to enable, in order of caution

# Enable in this order — each step adds power AND guardrail work:

# 1 · SANDBOXED CODE EXECUTION   (start here)
#    e2b / daytona / local container
#    no-net, read-only mounts, 30s timeout, 512MB RAM

# 2 · FILE TOOLS on a workspace  (add when artifacts matter)
#    path-scope (slide 4), ext allow-list, size caps

# 3 · WEB SEARCH + FETCH         (add for freshness)
#    search API w/ quota · fetch w/ truncation + ToS care

# 4 · BROWSER/COMPUTER USE       (last resort, most guarded)
#    dedicated account · human-confirm irreversibles · step budgets

# Anti-pattern: enabling 2-4 BEFORE 1's sandbox exists.
# Generated code + unrestricted files = exfiltration path.