A worker agent that writes and runs code in a sandbox — not a chatbot that searches your files. Understand the model before you trust the math.
AI in SharePoint behaves like a co-worker who can read files, write code, and produce output — not like a chatbot that answers from memory. When you hand it a prompt, it discovers files, decides on a workflow, executes that workflow in steps, and writes the result back to the library as a real file.
This is much closer to Claude Code or a co-work agent than it is to a chat experience. The agent starts a job knowing nothing about your data, then unpacks, discovers, writes code, and executes — all internally — to deliver the artifact you asked for.
Copilot is a Retrieval-Augmented Generation (RAG) system: it does a search, pulls some chunks of content, and asks the LLM to reason over what it found. That works for chat-style answers but breaks down on big numeric work — the LLM ends up estimating, sampling, or saying "based on what I saw."
This split is why Copilot agents do not run inside SharePoint the same way. Copilot agents are RAG agents that customize search and grounding. AI in SharePoint is a different product class entirely — a worker agent that gets work done by writing and executing code, not by predicting answers.
Every line of code AI in SharePoint writes runs inside a secure sandbox. The sandbox is the trust boundary: data flows in, the agent writes code, the code runs against that data, and only the resulting artifact (an HTML file, a JSON blob, an image) flows out.
This is why you cannot hand AI in SharePoint a script to run — that constraint is a security feature, not a limitation. The agent generates code dynamically inside the sandbox; users never inject code. Anthropic's Skills allow user-provided code; AI in SharePoint deliberately does not.
Under the hood, AI in SharePoint runs a chain of tool calls. The model picks the right tool, hands it parameters, and uses the result to decide what to call next. A typical job: find files → read files → run code in sandbox → generate HTML → create file.
The "read files" step looks familiar if you know Unix — it is essentially cat, returning the content of files. The "run code" step is where pandas-style analytics happen. The "create file" step is what writes the final report back into the document library.