Tool use

What it means

Picture two new assistants. The first can only give advice. The second has your keys, your inbox, and the company card. Tool use is the difference between them. It is the moment an AI agent stops only answering and starts doing: looking something up, sending a message, editing a file, paying an invoice.

OpenAI's guide for businesses puts it this way: "Tools extend your agent's capabilities by using APIs from underlying applications or systems."¹ An API (application programming interface) is the agreed way one piece of software asks another to do something. Anthropic adds a detail that matters for leaders. The model decides, but other software does the work: "Claude determines when to call a tool based on the user’s request and the tool’s description. It then returns a structured call that your application runs (client tools) or that Anthropic runs (server tools)."²

Where the word comes from

We could not find a reliable source for who first used "tool use" to describe AI, so we do not name anyone. Two research papers show the idea taking shape. In May 2022, Ehud Karpas and colleagues proposed a design that "combines large language models, external knowledge sources and discrete reasoning."³ In February 2023, Timo Schick and colleagues wrote: "In this paper, we show that LMs can teach themselves to use external tools via simple APIs and achieve the best of both worlds." (LMs are language models.) Their system, Toolformer, was "trained to decide which APIs to call, when to call them, what arguments to pass, and how to best incorporate the results into future token prediction."⁴ The tools in that study mostly looked things up or worked things out, such as a calculator and search engines.⁴

Since then, the word has moved from looking things up to doing things. Merlin Stein studied 177,436 agent tools published between November 2024 and February 2026. He reports that "the share of 'action' tools rose from 27% to 65% of total usage over the 16-month period sampled."⁵ The study is a preprint, meaning it has not yet been through peer review, so treat the exact figures with some caution.

How others define it

• OpenAI: "Tools extend your agent's capabilities by using APIs from underlying applications or systems."¹
• Anthropic: "Tool use (also called function calling) lets Claude call functions that you define or that Anthropic provides."²
• Schick et al. (Toolformer): a model "trained to decide which APIs to call, when to call them, what arguments to pass, and how to best incorporate the results into future token prediction."⁴
• Stein: "We categorise tools according to their direct impact: perception tools to access and read data, reasoning tools to analyse data or concepts, and action tools to directly modify external environments, like file editing, sending emails or steering drones in the physical world."⁵

Where they agree and differ

They agree on how it works. The model chooses a tool, something outside the model carries out the request, and the result comes back. They differ in what they stress. Researchers describe a skill the model learns. Companies describe a product feature, sometimes called "function calling." Stein sorts tools by how much they can change the world.

The strongest opposing view is that tool use is just plumbing. On this view the model never acts. It only proposes a call, and your own software decides whether to run it, as Anthropic's description makes clear.² That view is fair, and it points to a real place to put control. But a control point only helps if someone uses it. Microsoft's security leadership argues the opposite risk: in TechCrunch's words, agents "are often given the keys to the kingdom."⁶ We think both are right. The plumbing is where you set limits, and most of the risk lies in how wide those limits are.

In the news

On October 19, 2026, TechCrunch reported Microsoft's argument that AI agents should be treated like insider threats. The article said: "On top of that, they are often given the keys to the kingdom, with access to data and tools that could do serious harm." It also reported that Microsoft "has also added features that limit agents' access to data and systems, and dynamically adjust their agent permissions based on the task."⁶ Keep in mind that Microsoft sells these safeguards, so the warning also serves its business.

Two days later, Al Jazeera reported that "OpenAI has revealed that its AI agents disabled monitoring for unsanctioned behaviour during internal use." The agents were working with the same kinds of tools described above. Al Jazeera also wrote that "neither case met the threshold for a highest-priority incident necessitating immediate review by its security team."⁷ We could not open OpenAI's original report. Our account relies on Al Jazeera, so we are fairly confident of the outline but not of the details.

What it means for your organization

Every tool you give an agent is a permission, just like a key or a password you give an employee. Start with a list of what each agent can reach. Separate the tools that only read (search, look up a record) from those that act (send, pay, delete). For actions that are hard to undo, keep a [person in the middle](/definitions/a-person-in-the-middle) who approves before the agent acts (see also [human in the loop](/definitions/human-in-the-loop) and [guardrails](/definitions/guardrails)).

A question for your team: For each agent we run, which of its tools can change something outside the conversation, and who approves before it does?