sandboxing

Code-execution agents are powerful and dangerous: arbitrary model-generated code runs on your infrastructure. The signal is real isolation (containers/VMs), resource limits, and network/filesystem restrictions, not 'trust the model.' Here is the answer.

A computer-use agent drives a real browser or desktop through screenshots and clicks. The signal is the perceive-decide-act loop plus the containment for an agent that can click, buy, or delete anything. Here is the answer.

Two ways to give an agent an action space: emit a JSON tool call per turn, or emit a program that calls the tools itself. One collapses N round-trips into one. The other is the one you can actually audit. Here is how to choose.

A Devin-style agent that turns an issue into a merged PR is the hardest agent to make reliable, because every step can fail and errors compound. Here is the architecture and the loop that keeps it honest.