Ask Claude to calculate the standard deviation of a column in a spreadsheet, and it doesn’t reason through the arithmetic in plain text. It writes a few lines of Python, runs them, and reads back the result. That write-run-read loop is the entire premise of Anthropic’s code execution tool [1]. The sandbox behind it is smaller, and stranger, than most engineers assume before they read the spec.
In this article:
Every code execution request runs inside a dedicated container: Linux-based, x86_64 architecture, with Python 3.11 installed [1]. That’s the whole machine. One CPU core, 5 GiB of RAM, and 5 GiB of disk for the workspace [1]. For a pandas job against anything beyond a modest CSV, that’s a real ceiling, not a formality.
Internet access is switched off entirely. Anthropic’s docs put it plainly: no outbound network requests are allowed, and the container is fully isolated from the host system and from other containers [1]. File access stays limited to the workspace directory, scoped to the request the same way the Files API scopes uploads [1].
That isolation is worth comparing against the pattern in Coordinator-subagent orchestration patterns in the Claude Agent SDK, where subagents routinely need to reach real services on the user’s behalf. The code execution sandbox is the opposite case. It exists for computation Claude can finish entirely on its own, with zero trust placed in anything outside the box.
Because there’s no network path out, Claude can’t download or install additional packages at runtime. Only what’s preinstalled is available [1]. The list covers the expected data-science stack: pandas, numpy, scipy, scikit-learn, and statsmodels for analysis, matplotlib and seaborn for plotting. It also covers the file formats people actually email each other, including openpyxl, pyarrow, pypdf, pdfplumber, python-docx, and python-pptx [1]. Rounding it out are sympy for symbolic math and a short list of CLI tools: unzip, 7zip, ripgrep, fd, and sqlite [1].
If a workload needs something outside that list, there’s no in-session workaround, and the tool documentation doesn’t offer one either [1]. A team that needs a specific scientific library, or a package with native bindings the sandbox doesn’t ship, is better served standing up its own sandboxed runtime. That’s a different problem than the one addressed in MCP tool design: why your agent keeps calling the wrong tool, which is about giving an agent the right surface to act on, not the right library to import. Here, the surface is fixed before the conversation even starts.
Containers don’t disappear the moment a request finishes. After about five minutes of inactivity, a container checkpoints, and a later request that references its ID restores it instead of starting cold [1]. That’s long enough to span a short back-and-forth without re-paying setup cost on every turn.
The outer limit is 30 days from creation. After that, the container and anything in it, including uploaded files, intermediate artifacts, and outputs, are gone, and a request against an expired container ID returns an error rather than silently creating a new one [1]. Reconnecting to a live container is a one-line change:
response2 = client.messages.create( container=response1.container.id, model="claude-opus-5-5", max_tokens=4096, messages=[{"role": "user", "content": "Read the number from '/tmp/number.txt' and calculate its square"}], tools=[{"type": "code_execution_20250825", "name": "code_execution"}],)
Anthropic’s own example shows the pattern: pass the previous container’s ID back in, and files written earlier in the session are still there [1]. Skip that step after a _turn response, and whatever Claude wrote to disk in the first half of the turn is lost [1].
Code execution is free when it’s paired with the web search or web fetch tools, as long as those are version web_search_20260209, web_fetch_20260209, or later [1]. Outside that pairing, it's billed separately from tokens, by execution time, with a five-minute minimum per container [1].
Each organization gets 1,550 free hours of execution time per month. Past that, Anthropic charges $0.05 per hour, per container [1]. For a workload that spins up a fresh container per request instead of reusing one, that five-minute minimum adds up faster than the headline rate suggests, the same kind of arithmetic covered more generally in Why Your Agent Loop Costs More Than Its Model Price Tag for tool calls across an agent loop.
The tool ships in three current versions. code_execution_20250825 covers bash commands and file operations. code_execution_20260120 adds REPL state persistence and the ability to call other tools programmatically from inside the sandbox, a capability that needs a current web search or web fetch version paired alongside it [1]. A newer version, code_execution_20260521, runs the identical sandbox but documents a 90-second wall-clock limit per Python cell specifically for that programmatic calling [1].
Not every model gets the full feature set. Claude Haiku 4.5 accepts the newer tool versions in a request, but programmatic tool calling and REPL persistence don’t activate on it: it falls back to behaving like the original 20250825 version [1]. That's a concrete case where picking the right tool version isn't enough on its own, the model matters too, a tradeoff that rhymes with the session-state tradeoffs mapped out in The Three Layers of Memory in the Claude Agent SDK. The reliable way to check what a given model actually supports is to read capabilities.server_tools.code_execution.supported from the Models API response for that model, rather than assume parity across the lineup [1].
None of this makes the sandbox a general-purpose compute platform. It’s a narrow, disposable, well-fenced box for the kind of work Claude used to fake by reasoning through arithmetic in plain text. For anything that needs a live API call, a long-running job, or a package outside the preload list, that’s a sign to reach for infrastructure built for it, not to push harder against this one’s walls.
If you enjoyed the article and wish to show your support, make sure to:
What Claude’s Code Execution Tool Actually Gives You was originally published in Towards AI on Medium, where people are continuing the conversation by highlighting and responding to this story.