Code mode is not a sandbox
This post distinguishes code mode, where the model writes a short Python program calling your tools as functions via a single run_code tool, from a sandbox, which is an isolated environment where code runs. It describes three places a sandbox boundary can go (the whole agent, only the tools, or only the model-written code) and how Pydantic AI workspaces let you move that boundary without rewriting tools. It also covers Monty, a Rust-written Python interpreter that runs run_code next to the agent with no filesystem, network, or environment variables.
Why it matters: Useful for teams deciding where to place isolation boundaries when combining code mode with sandboxed tool execution.