It can only ever write text

Ask a model what a share price is right now.

Without a search tool, the model must work from its training and the text it has been given. It may admit uncertainty, but it can also produce a plausible number that it has not checked. Retrieval-augmented generation addresses this by supplying relevant external material before the answer is written.

The obvious fix is to hand it the answer in its prompt. But that only works when you already know what to fetch. Nobody knows in advance which page settles an arbitrary question.

So let the model say what to fetch.

Words that something else obeys

Nothing needs to change inside the model. It writes text, as always. What changes is that the program around it — the harness — agrees that text of one particular shape is not prose to show the user, but an instruction to carry out.

That is the entire invention. A tool call is just a string the model produced, which the harness recognised, executed, and pasted the result of back into the prompt.

Three things follow immediately

The world arrives as text. The retriever’s answer becomes more prompt. That is the only channel there is — which is why it can be so useful, and, in chapter seven, so dangerous.

One request becomes many calls. The model wrote a command, then later wrote an answer: two forward passes for one question. Hard tasks take dozens. Cost and latency now scale with how much work the task is, not how long the reply is.

Somebody decides what happens next. After a result comes back, does it call again or stop? That control sits in the harness — a design decision, not something the model does.

Go deeper: WebGPT, and why the shape of the loop matters

WebGPT (2021) put a model in a text browser with commands like search, click, quote and scroll. Two details set the pattern everything since has followed.

The harness imposed a structure: browse and collect quotations first, then answer using only what was collected. The model was not free to do anything in any order — a deliberate choice, and a different choice would have produced different behaviour from the same weights.

And it was trained for this, not just prompted: people demonstrated the task, the model was fine-tuned on those demonstrations, then improved against a reward model trained on human comparisons — the pipeline from post-training, pointed at browsing.

A model that can act is a model whose mistakes now happen out in the world. The next question is what it should think before it does anything.

Sources · 2

Full bibliography →