Reminds me a bit of Steve Yegge's latest [^1]. He gives an LLM full control over his editor (Emacs) by allowing it to call eval (as I understand it). He doesn't talk about which guardrails (if any) he put on this.
I love his insights, but I'm not creating an account to see them.