The model can request a search, calculation, code execution, or an action in another application. Software enforces permissions, performs the action, and returns the result. Tool use alone does not create an ongoing agent loop.
Level 04
The model requests an action
Each line names the failure that justifies moving to a higher level.
The next action depends on what the last one returned, so the model has to choose again and decide when to stop.
The code has to be run, read and rewritten until it works, with the model deciding when it is done.
The tools are connected and what is missing is everything around the model: the loop, the permissions, the caps and the sandbox.
One action is not enough: the task needs a sequence of reads and actions, which is what every real computer-use run does.
Each one needs this level and no higher, and says why.
Routes an incoming ticket, searches the documentation for an answer, calls a tool when an action is needed, and hands off to a person when it is unsure.
Turns a plain-language description of work done into a structured log entry, saved with a tool call and linked to the equipment it concerns through a small knowledge graph.
The model drafts commands from the manual for that instrument; code checks every one against the documented command set, runs the script on the simulated instrument, and feeds the errors back for another pass. A person bench-checks before it drives real hardware, and every set point goes through a code-side envelope.
Starts where the dashboard stopped: limits, yield and Cpk are already charted and did not answer the question. The model writes analysis code that runs in a sandbox over the CSV, and a person reads the code as well as the answer. Includes the trap of a column in millivolts under a header that says volts.
Names listed 09/19/2026. 223 of 223 registry entries have been checked against the maker's own page; the registry marks the rest as unchecked.
Open problems at this level, what people are trying, and the source each rests on. Read 09/19/2026. This block ages faster than the rest of the page, and nothing in it predicts which approach wins.
A tool server is reviewed once, when you connect to it. The text it returns days later goes straight into the model's context with no equivalent check, so an instruction hidden in a tool result is read as though you had written it.
What people are trying
Fully detecting injected instructions in free-text responses is an open problem, but schema validation catches the obvious cases.
Where it bites: Model Context Protocol
A model driving a mouse reads the screen to pick its next click, and anything on that screen can carry instructions of its own. The makers who ship classifiers against this say in their own documentation that the model sometimes follows them anyway.
What people are trying
In some circumstances, Claude will follow commands found in content even when they conflict with your instructions.
Where it bites: Computer and browser use
The model picks the tool and fills in its arguments, and an argument can be a plausible invention rather than something it actually had. One wrong identifier looks exactly like a right one to the code that runs the call.
What people are trying
Occasionally, an agent might hallucinate or even fail to grasp how to use a tool.
Where it bites: Function calling
Nothing forces the sandbox running model-written code to be separated from the credentials that supervise the agent around it. Whether that boundary exists depends on how somebody assembled the system, and the platform cannot enforce it.
What people are trying
Running the harness inside the sandbox can be convenient for prototypes, but it puts orchestration and model-directed execution in the same compute boundary.
an extension to run one specific shell command fails to properly prevent other shell commands from being executed.
Where it bites: Code execution
Pages at this level last reviewed 09/19/2026. Pages unreviewed for 90 days are flagged for another pass. Markdown version of this page