Code Execution
Code execution means that an AI system actually runs program lines it has written itself and reads off the result, instead of merely formulating an answer. This makes calculations, tables, and charts more reliable — but the executed code can also be dangerous if it doesn't run in isolation.
A program is a list of instructions that a computer works through step by step. Code execution means: these instructions are actually carried out and produce a result. In chat programs like ChatGPT, this refers to a special case. The program writes itself a small piece of code, has it run on a computer, and reads off the result. It then uses this result for its answer. The difference from a normal answer is significant: instead of writing down a plausible number, the machine actually calculates the number.
Why guessed numbers aren’t enough
Language models are trained to generate the most probable next chunk of text at each step. So they write text that sounds coherent. This works well for language, but often not for mathematics. A multiplication of two seven-digit numbers may look correct in the answer, but is frequently wrong. There is no instance within the model that verifies the result.
Code execution closes exactly this gap. The computer itself is error-free when it comes to numbers, provided the code is correct. So the model no longer has to calculate — it only has to write down the correct calculation. This task suits it much better. The same applies to tasks with many steps, such as sorting a long list.
A second advantage is verifiability. The executed code is usually visible within the answer. Anyone who wants to can check line by line how the result came about. With a purely textual answer, by contrast, the path remains invisible. This is one of the reasons why experts prefer code execution for analyses.
The isolated playground
Technically, the code almost never runs directly on the provider’s own machine. It runs in a sandbox. This is an artificially separated area, a small computer within the computer. The code cannot escape this environment. It is not allowed to touch other data, and often not access the internet either.
The process is always the same. The model formulates a short program, usually in the Python language. The sandbox executes it and returns whatever came out of it. This can be a number, a table, or an error message. In case of an error, the model attempts a corrected version. This loop sometimes runs for several rounds until the result fits.
The isolation is not a mere formality but the core of the security. A user could cleverly craft an instruction to get the model to write malicious code. Without a sandbox, this code could delete files or steal foreign data. That is why such environments are deleted and rebuilt after a short time. A common misconception, by the way, is that the model executes the code on the user’s own laptop — that only happens with special developer tools.
From data analyst mode to programming agent
In everyday life, one often encounters code execution without ever reading the term. If you upload a table into a chatbot and ask for the average, a small program is created in the background. Charts are generated this way too. Depending on the product, providers call the feature Code Interpreter, Data Analysis, or Advanced Data Analysis.
Programming tools like Claude Code, Cursor, or GitHub Copilot go significantly further. They not only write code but also run tests and read the error messages. Such systems are called agents because they independently carry out multiple steps in succession. Code execution is the capability that makes the whole thing possible in the first place.
In business news, the term appears from two directions. On one hand, it is seen as a driver of demand for data centers, since every execution costs computing time. On the other hand, it is a security topic, for instance in the rules of the EU AI Act for high-risk applications. Anyone reading about AI agents therefore almost always reads about code execution too.