LLM-in-Sandbox Elicits General Agentic Intelligence

Abstract: We introduce LLM-in-Sandbox, enabling LLMs to explore within a code sandbox (i.e., a virtual computer), to elicit general intelligence in non-code domains. We first demonstrate that strong LLMs, without additional training, exhibit generalization capabilities to leverage the code sandbox for non-code tasks. For example, LLMs spontaneously access external resources to acquire new knowledge, leverage the file system to handle long contexts, and execute scripts to satisfy formatting requirements. We further show that these agentic capabilities can be enhanced through LLM-in-Sandbox Reinforcement Learning (LLM-in-Sandbox-RL), which uses only non-agentic data to train models for sandbox exploration. Experiments demonstrate that LLM-in-Sandbox, in both training-free and post-trained settings, achieves robust generalization spanning mathematics, physics, chemistry, biomedicine, long-context understanding, and instruction following. Finally, we analyze LLM-in-Sandbox's efficiency from computational and system perspectives, and open-source it as a Python package to facilitate real-world deployment.

• The paper demonstrates that LLMs can exploit a virtual code sandbox to achieve robust general agentic intelligence across various tasks.
• It employs a ReAct-style protocol and introduces LLM-in-Sandbox-RL to enhance task performance and reduce token usage.
• Empirical results reveal substantial improvements in domains like mathematics and instruction following, validating the sandbox approach.

Eliciting General Agentic Intelligence via LLM-in-Sandbox

Introduction and Motivation

"LLM-in-Sandbox Elicits General Agentic Intelligence" (2601.16206) presents a systematic framework for enabling LLMs to autonomously explore and utilize a virtual code sandbox for general task completion, advancing beyond text-in-text-out paradigms. The motivation stems from leveraging the general problem-solving meta-capabilities of computers—external resource access, file management, and code execution—by allowing LLMs direct interaction with a virtualized environment. Historically, such agentic behaviors have been confined to narrow domains like code reasoning. This work demonstrates transfer to a wide range of non-code domains without additional finetuning and proposes a scalable RL protocol—LLM-in-Sandbox-RL—for robust agentic intelligence elicitation.

Figure 1: LLMs achieve substantial performance improvements in diverse domains via sandbox exploration; all models are evaluated zero-shot without sandbox-specific training.

LLM-in-Sandbox Design Principles and Workflow

LLM-in-Sandbox provides a lightweight Ubuntu-based sandbox via containerization, granting LLMs three universal tool functions: bash execution (execute_bash), persistent file editing (str_replace_editor), and submission. The environment is intentionally minimal, reliant on only standard interpreters and base scientific libraries; domain-specific tool installation is delegated to the LLM at inference. The workflow follows a ReAct-style protocol, eliciting multi-turn tool invocation conditioned on environmental feedback. Input and output are mediated via the sandbox filesystem, supporting flexible, long-context formats.

Empirical Results: Generalization and Capability Analyses

Zero-shot Efficacy Across Domains

LLM-in-Sandbox generalizes robustly across Mathematics, Physics, Chemistry, Biomedicine, Long-Context Understanding, and Instruction Following, consistently outperforming vanilla LLM mode in strong agentic models. For instance, Qwen3-Coder-30B-A3B demonstrates up to +24.2% improvement in mathematics, and GPT-5 achieves +7.0% on instruction following. Performance gains vary with model agentic capacity; smaller models (e.g., Qwen3-4B-Instruct-2507) often fail to exploit the sandbox effectively, attesting to a clear model-dependent threshold for agentic capability emergence.

Behavioral Pattern Quantification

A detailed behavior analysis reveals strong models adaptively invoke external resource access, file management, or computation depending on the task domain. Mathematics tasks elicit frequent computation via programmatic solution verification, while Chemistry tasks see higher external resource installations for domain-specific libraries. Long-context tasks benefit from file-based document parsing, drastically reducing token usage and improving throughput.

Figure 2: Usage rates for sandbox meta-capabilities vary by domain; avg turns per task reflect agentic exploration depth.

LLM-in-Sandbox Reinforcement Learning

Methodology

LLM-in-Sandbox-RL leverages outcome-based RL with only non-agentic, general-domain context-based data, partitioned into sandbox files with distractors. Reward functions are rule-based, targeting outcome correctness. Compared to standard LLM-RL, training occurs within the sandbox, enforcing environmental exploration.

Figure 3: Each RL task’s context is partitioned and placed as files in the sandbox, forcing exploration and active filtering.

Results and Analysis

LLM-in-Sandbox-RL closes the agentic gap for weak models and further amplifies strong models. Post-training, Qwen3-4B-Instruct-2507 increases sandbox capability usage rates and reduces ineffective exploration (avg. turns drop from 23.7 to 7.0). LLM-in-Sandbox-RL also induces reasoning pattern transfer to vanilla LLM mode, evidenced by increased structure and verification behaviors in output responses.

Efficiency and Deployment Considerations

The general-purpose, containerized sandbox infrastructure affords orders-of-magnitude savings in storage and low runtime memory overhead. Computational analysis shows token savings up to 8× in long-context scenarios (e.g., 100K → 13K tokens), with environment tokens processed via fast prefill, making query throughput competitive or superior to vanilla LLM inference. The Python package integrates with modern inference backends (vLLM, SGLang), facilitating real-world deployment.

Beyond Text-in-Text-out: Extending Agentic Reach

Granting LLMs execution rights within sandbox environments unlocks fundamentally novel capabilities: cross-modal generation (e.g., images, videos, audio, interactive HTML), grounded file creation, and autonomous tool acquisition. Case studies evidence: itinerary planning yields clickable JS-based maps, event JSON translates to SVG posters, style descriptions synthesize animated videos, and textual requests drive MIDI composition and WAV rendering.

Figure 4: LLM-in-Sandbox enables LLMs to autonomously acquire tools and generate multimodal assets (HTML, PNG, MP4, WAV) directly via sandbox interactions.

Implications and Future Prospects

Integrating LLM-in-Sandbox as the default interface paradigm for LLM deployment would normalize verifiable computation, scalable long-context management, and digital asset creation. LLM-in-Sandbox thus transitions LLMs from text generators to executable agentic workers. As a standardized agentic benchmark, the $\Delta = \text{LLM-in-Sandbox} - \text{LLM}$ metric captures emergent agentic intelligence. The transferability of sandbox interaction skills through RL suggests pretraining with sandbox-native objectives and large-scale RL could yield models with systematic agentic compositionality. The practical transition to LLM-in-Sandbox-based infrastructure portends new directions for rigorous digital work and creation, setting a high bar for future agentic general intelligence research.

Conclusion

LLM-in-Sandbox operationalizes direct LLM-computer integration, eliciting robust agentic intelligence across arbitrary domains and modalities. Sandbox-native inference and RL unlock capabilities unattainable in pure text generation, with strong empirical improvements and scalable, low-overhead deployment. The paradigm offers a formal benchmark and infrastructure for evaluating, training, and deploying general agentic systems, suggesting a future where sandbox interaction is an essential component of foundational model architectures and training pipelines.