Ask for a calculation or a lookup and watch the request turn into a checked tool call, including the ones the sandbox refuses to run.
When an assistant can run code on your behalf, the dangerous part is not the answer, it is everything between the request and the call. The arguments arrive as text and may be the wrong type. The tool name may not exist. The expression may be an attempt to open a file, import a module or run an exponent big enough to pin a processor for a week.
Type a request and this page shows the whole path. Which of the four tools was picked, the exact description and parameter list that tool publishes, the arguments as they were drafted, what they looked like after being checked and converted, and then the sandbox: allowlist, time budget, retries, output size cap, and the one line of result the assistant would actually see.
At the bottom, a fixed set of hostile inputs runs on every request so you can watch them get turned down and read the reason for each one.