Yeah, I thought it was running locally but it runs in Microsofts cloud.

However, that opens up ANOTHER similar attack vector as Bert is saying:

"We may wonder also what fun a determined hacker could have with Microsoft running random bits of JavaScript on their servers and allowing these to talk to the world (or to Microsoft itself even)."