Mikyo King wants teams to stop handing agents a catalog of tools and give them a sandbox instead, he told AI Engineer while walking through Arize AI's shift to what it calls code mode.
King, who heads the open source group at Arize AI, demoed the change inside Arize Phoenix, the company's observability platform. Instead of stuffing dozens of tools into the context window and calling them one by one, the agent searches for only the tools it needs and executes them inside a programming environment. The affected systems are Phoenix agents, MCP servers and CLI harnesses that now run Bash, Python and SQL in sandboxes. The attacker requirement moves from remote tool misuse to local code execution, which means isolation, egress controls and secrets handling become the boundary.
That swap is about context, cost and control. King argued traditional tool calling creates bloat, where every tool definition and every paginated output accumulates in the context window, drives up turns and forces compaction. Code mode, he said, offers progressive disclosure of tools, composability across sequential and parallel calls, and token efficiency because the model returns only what is needed. He pointed to emergent behavior as the payoff, including the agent writing its own tool to strip personally identifiable information instead of leaking card numbers into context while trying to do it with chat alone.
The efficiency is not free.
King listed the tradeoffs teams inherit when they adopt sandboxes. Hosted sandboxes need CPU, memory and lifecycle management, and they do not always boot cleanly. Networking is the sharpest edge, since web access can be useful but untrusted. Secrets vaulting matters when code runs inside the sandbox, especially if a fast decision library like JAX is invoked and its credentials could bleed back into context. Permissions tend to be overbroad, correct for five steps and wrong on the sixth, or broken when calls are composed. Operationally, debugging shifts from single tool calls to debugging generated code, parameter accuracy becomes code correctness, and tool discovery now requires a handshake. When MCP and harness-level code mode stack, teams face double serialization as JSON leaves one sandbox to be parsed into another. Arize Phoenix, which Arize describes as the leading open source platform for AI observability and evaluation for tracing, evaluation and experiments, is where the company dogfoods these changes.
To measure whether it was worth it, King said Arize runs agents through its Harbor framework, which executes tasks repeatedly in sandboxes with network access off and scores them with Harbor verifiers on a pass or fail. He cited pre and post code mode results in that harness where tokens fell 43%, cost fell 31% and latency stayed roughly flat despite sandbox overhead. He framed that as evidence the approach works across surfaces from Claude Code style workflows to MCP and the CLI, and as a trajectory plus eval signal the team uses to hill climb behavior when a new tool temporarily hurts efficiency.
King was specific on what code mode unlocks today and vague on how teams should lock it down at scale. He did not detail a standard for secrets handoff, scoped permissions across composed calls, or recovery when a long code block fails mid execution and cannot resume. He also flagged that frontier models handle code mode well while smaller, cheaper models may not, that JavaScript is fluent but weak for deterministic math, and that getting multimodal bytes like images out without dumping binaries into context requires a signed handoff that is still awkward. The open question he left hanging is not whether sandboxes beat tool sprawl, but which guardrails make them safe to run in production without erasing the savings.
