“only safe way to run agents if there’s any risk of attracting the attention of an adversarial attack is with a sandbox”