Tagged sandboxing · show all articles
Inside a language model's context window, a tool description, a tool result and a resource all read the same as an instruction — which means a compromised or malicious MCP server can write the agent's next action itself.
Claude stops when the work looks done. Turning that into more than a feeling takes four separate mechanisms: a check with a real oracle, a hook that cannot be argued with, a sandbox bounding the damage, and a human gate outside the loop.
Codex is best understood as a changing stack of models, tools, execution boundaries, state, and review mechanisms—not as a single code-generating model.
Reliable delegation begins before the prompt: repositories need explicit contracts, reproducible environments, bounded authority, discriminating checks, and reviewable evidence.