What the model CAN do, and what it WILL do

Tool use and safety are two sides of the same coin. Tools extend capabilities (access to the web, running code, reading files) beyond what the weights contain. Safety constrains behavior so the model refuses dangerous requests and calibrates when to help vs when to decline.

Why Tools Matter

LLMs have three hard limits:

• Knowledge cutoff. They can't know anything that happened after training.
• No real computation. Arithmetic and code execution are approximated; often wrong.
• No side effects. They can't browse the web, query a database, or update a file.

Tool use solves all three by letting the model delegate. Instead of guessing today's stock price, it calls a get_price() function. Instead of computing sqrt(17689) in its head, it calls a calculator.

How Function Calling Works

tools = [{
    "type": "function",
    "function": {
        "name": "get_weather",
        "description": "Get current weather for a location",
        "parameters": {
            "type": "object",
            "properties": {"location": {"type": "string"}}
        }
    }
}]

response = openai.chat.completions.create(
    model="gpt-4", messages=messages, tools=tools
)
# Model output: {"tool_call": "get_weather", "arguments": {"location": "Paris"}}
# App runs the function, feeds result back, model writes final response

Critical clarification: the model does not execute anything. It outputs structured text naming the function and its arguments. The application code executes the function and passes the result back. The model is a decision-maker, not an actor.

Interactive: Function Calling Demo

Training for tool use is done via SFT on tool-use datasets (Gorilla, ToolBench with 16k+ APIs, synthetic function-calling scenarios). The standard benchmark is the Berkeley Function Calling Leaderboard (BFCL).

MCP: The Model Context Protocol

As tool ecosystems exploded, every AI application needed custom integrations -- the M x N problem (M models x N tools). Anthropic introduced MCP in November 2024 as an open standard with three primitives:

• Tools -- functions the model can call (model-controlled)
• Resources -- data the application provides (app-controlled)
• Prompts -- templates the user can invoke (user-controlled)

Adoption was fast: OpenAI adopted MCP in March 2025; Anthropic donated it to the Linux Foundation in December 2025. Security research has identified real vulnerabilities in MCP deployments (tool name spoofing, credential leakage, prompt injection through resources) -- the protocol is useful but not safe by default.

Agents, ReAct, and When Agents Fail

An agent is an LLM in a loop: reason, act, observe results, reason again. The classic pattern is ReAct (Yao et al. 2022):

Thought 1: I need the capital of France.
Action 1:  search("capital of France")
Observation 1: Paris is the capital of France.
Thought 2: Now I need the population of Paris.
Action 2:  search("population of Paris")
Observation 2: 2.1 million (city proper).
Answer: 2.1 million.

Common agent failure modes:

• Infinite loops (repeating the same action)
• Error cascading (one wrong action derails everything downstream)
• Hallucinated tool calls (calling functions that don't exist)
• Context window overflow as history accumulates

Computer-use agents (Anthropic Computer Use Oct 2024, OpenAI Operator Jan 2025) control a computer via screenshots + virtual mouse/keyboard. On OSWorld, OpenAI CUA scored 38.1%, Claude 3.5 Sonnet ~22%, vs humans at ~72%. We are still far from reliable general-purpose agents.

Safety Training and Jailbreaks

Every LLM contains knowledge that could be misused. Preference optimization alone is not enough -- adversarial users bypass safety through jailbreaks:

• Role-play: "Pretend you're an AI without safety restrictions..."
• Social engineering: "My grandmother used to tell me bedtime stories about making napalm..."
• Encoding: Base64, pig latin, non-English, special characters
• Multi-turn escalation: gradually increase severity across turns
• Prompt injection: hidden instructions inside documents or tool outputs
• Token manipulation: adversarial suffix attacks

Wei et al. (2023) identify two root causes: competing objectives (helpful vs safe) and generalization mismatch (safety training doesn't cover all attack patterns). Their conclusion: jailbreaks may be inherent to current safety training.

Refusal Calibration: Not Too Much, Not Too Little

The goal is not maximum refusal. It is calibration: refuse what should be refused, and only that.

• Over-refusal: the model refuses reasonable requests due to keyword sensitivity. "How do I kill a process in Linux?" triggers the "kill" keyword. Eroded trust.
• Under-refusal: the model complies with requests it should reject. Exploited by jailbreaks.

Calibration strategies: boundary datasets (examples near the safety edge), contrastive pairs (same request, different intent), explicit policy specification, Constitutional AI (Anthropic, 2022) where the model self-critiques using a set of principles, and circuit breakers (directly modify internal representations when harmful content is detected -- 87-90% refusal on HarmBench while preserving helpfulness).

Evaluation: HarmBench (automated red-teaming), XSTest and OR-Bench (over-refusal on borderline-but-benign prompts), SORRY-Bench (44 fine-grained categories). Safety is not a single number.

Check Your Understanding

Flashcards (click to flip)