Better, train it to attack when receiving the "sandbox lifted" / "full access mode" note in Codex