Your sandbox guards what the agent does. Not what it's told to believe.
Connecting an MCP server splits agent safety into two problems. The sandbox solves one of them. The other one, where a returned value quietly becomes an instruction, is entirely on you.
