Move through the deck with (i) the arrow keys, (ii) a presentation clicker, or (iii) the buttons at the bottom left. The gear at the bottom right opens the slide settings.
Part 8 turns to vision; Part 9 then reaches attention.
A tool is a function the harness offers the model. The harness is the program that runs the loop. The context window is the agent's entire working memory: whatever is in it exists for the model, and nothing else does.
Anthropic's December 2024 essay Building effective agents draws the field's line: workflows run "through predefined code paths", while agents "dynamically direct their own processes and tool usage".
Before the conversation starts, the harness hands the API a list of tool definitions: a name, a description in plain language, and a schema naming each input field and its type. These definitions enter the model's context as input tokens, and the API adds a special system prompt that enables tool use (the provider documentation prices both in tokens).
The model reads its tools the way a person reads documentation: everything it will ever know about a tool is the text on the right.
Because the description is everything the model sees, writing a tool description is writing for the model, and a vague description produces vague calls.
Illustrative tool; the format follows the provider APIs, where schemas are written in JSON Schema.
| author | message |
|---|---|
| user | What should I wear in Ankara today? |
| model | {"type": "tool_use", "name": "get_weather", "input": {"city": "Ankara"}} |
| harness | {"type": "tool_result", "content": "{\"temperature_c\": 34}"} |
| model | It is 34 °C in Ankara today; light summer clothing works. |
The model produced the call by predicting tokens over a context that contains a form to fill. Generation then stops: the API reports a stop reason of tool use, and the model waits.
The harness, ordinary code, runs the real function and appends the result as a new message. The model never executes anything itself; the harness holds the only connection to the world. Anthropic's documentation describes the loop: "every tool call is a round trip: the model asks, you execute, you report back, the model continues."
Prediction resumes over the grown context, and the answer conditions on the tool result exactly as it conditions on every other token. The weather numbers are illustrative.
Formats: hosted APIs return the call as a typed block; open weight models print tagged text, Llama 3.1 opening tool calls with a special token and Qwen wrapping them in tool_call tags, which the inference server parses.
Every message of the exchange lands in one growing context (token counts illustrative):
| entry | author | tokens | running total |
|---|---|---|---|
| system prompt with tool definitions | harness | 350 | 350 |
| user question | user | 12 | 362 |
| tool call | model | 25 | 387 |
| tool result | harness | 15 | 402 |
| answer | model | 20 | 422 |
Every later prediction conditions on the whole column, because the context is the agent's only memory, the window Part 2 introduced. When an agent works for hours, the context grows toward the window's limit, so harnesses summarize or drop old entries. Choosing what enters the window now has its own name, context engineering (Anthropic engineering, September 29, 2025).
Windows grew from 2,048 tokens (GPT-3, Brown et al. 2020) to one million: Gemini 1.5 Pro announced a million token window in February 2024, and Claude Sonnet 4 opened a million token beta on August 12, 2025.
Search is a tool like any other: the model emits a query, the harness fetches ranked results and page text, and the pages land in the context as a tool result. The model then reads them, quotes them, and cites them, because they are tokens in its window like everything else.
| author | message |
|---|---|
| model | {"type": "tool_use", "name": "web_search", "input": {"query": "H100 dense BF16 TFLOPS"}} |
| harness | [result 1] NVIDIA H100 datasheet: "989.4 teraFLOPS" ... |
The weights froze at the training cutoff, while the context holds whatever the harness fetched today. Search fills the gap between them, which is why an agent can answer questions about yesterday's news although its weights predate the events.
History: WebGPT (OpenAI, December 2021) trained a model to browse with human feedback; Lewis et al. (2020) named the pattern retrieval augmented generation; ChatGPT search arrived October 31, 2024, and API search tools followed in 2025 (OpenAI, March 11; Anthropic, May 7).
Because fetched pages are written by strangers, they can carry hostile instructions, a danger with its own name: prompt injection.
A model learns tool calling in two stages, both taught in Part 6. First, demonstrations: supervised fine tuning on conversations that contain correct tool calls, so the call syntax becomes a token pattern like any other. ReAct (Yao et al., October 2022) set the pattern of reasoning text interleaved with actions; Toolformer (Schick et al., February 2023) had the model label its own API calls; on June 13, 2023, OpenAI shipped function calling in the API, and demonstration data has accumulated ever since.
Second, rewards: reinforcement learning on whole tasks, Part 6's PPO and GRPO with the mathematics checker replaced by task completion: (i) did the code compile, (ii) did the test pass, (iii) did the answer check out? OpenAI wrote of o3 (April 16, 2025) that "these models are trained to reason about when and how to use tools"; o1 (September 12, 2024) and DeepSeek-R1 (January 20, 2025) had already shown reinforcement learning producing long reasoning chains.
Syntax comes from demonstrations; judgment about when to call comes from rewards.
History: WebGPT (December 2021) already combined both stages on a browser, years before the pieces were standard.
Four developments converged.
By December 2025 every piece was public: Gemini 3 (November 18), Claude Opus 4.5 (November 24), MCP's donation to the Agentic AI Foundation under the Linux Foundation (December 9), and the skills format published as an open standard (December 18). Products shipped on the same timeline: deep research (February 2, 2025), Claude Code (February 24, 2025), ChatGPT agent (July 17, 2025), and agent teams in Claude Code (February 5, 2026).
SWE-bench asks a model to resolve real GitHub issues in real repositories (Jimenez et al., October 2023); SWE-bench Verified is its human validated subset (OpenAI, August 2024).
| date | system | resolved |
|---|---|---|
| October 2023 | best published model (Claude 2, unassisted) | 1.96% |
| March 2024 | Devin (Cognition; a 25% subset) | 13.86% |
| October 2024 | Claude 3.5 Sonnet, upgraded (Verified) | 49.0% |
| May 2025 | Claude Opus 4 (Verified) | 72.5% |
| September 2025 | Claude Sonnet 4.5 (Verified) | 77.2% |
| November 2025 | Claude Opus 4.5 (Verified; first past 80%) | 80.9% |
A caution: benchmarks age. In February 2026 OpenAI stopped evaluating on SWE-bench Verified, after an audit found flawed test cases and contamination, and moved its evaluations to the harder SWE-bench Pro; the trend above stands, while any single cell should be read with that caution.
Before a standard, every assistant needed a custom connector for every tool: N\times M integrations. The Model Context Protocol (Anthropic, November 25, 2024) replaces the grid with one wire: any assistant hosting an MCP client can use any MCP server.
A server exposes three things: tools (functions to call), resources (data to read), and prompts (reusable templates); the messages are encoded as JSON-RPC. The protocol's own documentation says to think of it "like a USB-C port for AI applications."
Adoption: OpenAI, March 26, 2025; Google DeepMind, April 9, 2025; an official server registry opened September 8, 2025; and on December 9, 2025 Anthropic donated MCP to the Agentic AI Foundation, a Linux Foundation fund it started with OpenAI and Block, so no single company owns the protocol.
Although a tool grants an ability, much of competence is procedure: how this class formats a lab report, how this team reviews code. Agent Skills (Anthropic, October 16, 2025) package procedure as files: "Skills are folders that include instructions, scripts, and resources that Claude can load when needed."
The design's point is progressive disclosure, which admits tokens into the context only when a task needs them: at startup only each skill's name and description enter the context; the body of SKILL.md loads when the task matches the description; bundled files and scripts load only if the body points to them.
The format was published as an open standard in December 2025 and now works across multiple major coding tools, so a skill written once travels between assistants.
The frontmatter (name, description) always sits in context; the numbered body loads on demand.
Everything built so far, one window holding every token, explains prompt injection. The model predicts from everything in its window, and no channel marks which text is trusted instruction and which is data; a hostile web page or email can therefore write instructions that the model may follow.
Named and dated: Riley Goodside demonstrated the attack and Simon Willison named it prompt injection in September 2022, drawing the analogy to SQL injection; the OWASP Top 10 for LLM applications has ranked it first since 2023. A production case: EchoLeak (CVE-2025-32711, disclosed by Aim Security in June 2025) used one crafted email to make Microsoft 365 Copilot leak internal data with no click from the user; Microsoft patched it server side.
Defenses belong to the harness, because the model cannot referee its own window: confirmation gates before consequential actions, tools restricted to what the task needs, and fetched text treated as untrusted data. The field manages the problem with these defenses and states openly that no full solution exists.
A tool description and a skill file are the same kind of writing: documentation for a reader that takes every word literally.
The agent is Part 6's trained model, Part 5's arithmetic, Part 1's game, inside a loop written in plain code.
The model should emit two calls, {"city": "Rome"} and {"city": "Oslo"}, because the comparison needs both temperatures in the context before the answer can condition on them.
The harness protects the user, by gating the email tool and confirming consequential actions. The page's words enter the same window as every other token, so the defense cannot be built into the model.
Next: Part 8 turns to how machines see: convolutions and image tokens.