The Agent doesn't answer — it builds the UI to answer with
Most AI chat products give you text back, maybe a code block. We wanted Kopai's agents to answer the way a good analyst would — with the actual chart, table, or calculator, not a paragraph describing one.
So when an agent decides a visual beats prose, it writes real render-able code and it renders live in the chat — inline, not a separate canvas. It runs in a sandboxed iframe with a null origin, so the generated code can't touch your cookies or session, even though it's fully interactive. It also picks up your theme automatically, light or dark, so it never looks bolted on.
It's not one generic "chart mode" either — the agent recognizes what you're actually asking for and reaches for the right shape: an interactive widget, a chart, a diagram, a UI mockup, or generative art, and builds accordingly.
Ask your agent to "compare these three plans" or "show me how OAuth works" and watch what it reaches for instead of text.
What's the most useless "wall of text" answer you've gotten from an AI tool that should've just been a table or a chart?
Replies
Dial
the worst offender for me is anything involving pricing tiers - i've asked coding assistants to compare plan limits across providers and gotten four paragraphs of prose restating numbers i then had to re-read three times to line up mentally. that's exactly a table.
question on the sandboxing though - once the agent renders a chart from a data pull, and i ask a follow-up like "now show only Q4", does it re-run the whole generation step and re-render a new iframe, or is there some live binding back to the underlying data so it can patch the existing one? asking because if it's regenerate-from-scratch every time, that's a lot of tokens spent for what should be a filter operation.
Kopai
@galdayan you are correct. As of right now, its a new iframe that will be generated from scratch, following the general conversational tree structure of User message - AI Output. You are right, a fresh spin up is a lot of more tokens than it "ideally" should be, and over token optimization efforts is something we are looking forward to, including prompt caching. Something we have made sure is, all of these interfaces are extremely lightweight and functional, and are backed by tight guidelines, so it avoids chances of token explosion or the general AI slop interfaces.
Dial
@swapnanil_ray worth flagging: prompt caching helps the cost of re-reading the same conversation prefix, but it doesn't change that you're still regenerating a whole new artifact for what's structurally a filter, not a new question. those are two separate problems wearing one label. might be worth a cheaper "patch" path for the narrow case of same-shape-different-slice requests, kept separate from full regen for anything that actually changes the visualization type.
Kopai
@galdayan completely agree! Honestly this gives us a potential thinking point — the patch route is something we have for our artifacts already in place. It's seems worth exploring the same for gen-ui.
Dial
that allowlist approach is the right call, blocking cookies but leaving the door open for an arbitrary fetch would've been a real gap. good to see it locked down to CDN hosts only rather than trusting the generated code's judgment about where it's allowed to talk to.
Mine is expense category breakdowns, every finance AI I've tried gives me "Category A is 40%, Category B is 25%..." in prose when it's obviously a pie chart. Question on the sandboxing, separate from Gal's: null origin stops the generated code from reading your cookies or session, but does it also stop it from making its own outbound network calls, or just from reading what's already there? A chart component that can still fetch on its own is a different kind of leak than the one being sandboxed against.
Kopai
@raffay_sajjad good catch splitting those apart, they're genuinely different guarantees. Null origin's job is the session/cookie side, it stops the generated code from reading anything tied to your identity on the page. Outbound calls are a separate control: the iframe can hit the network, but only against a fixed allowlist, mostly CDN hosts for the chart/rendering packages it needs to build the visual. Anything outside that list gets blocked, so it can't quietly ship your data to some third-party endpoint it decided to fetch from.