The infra for ChatGPT need to be secure enough to run untrusted code, no? To me that’s the basic assumption. Similar to any server-less offering like Lambda.
In this case I'm mostly worried about running GPT-4 Vision over the API in the future. It will be plugged into products. Many products connect LLM to databases, calendars, or emails. Than you could use chat interface to extract that data.