Why isn't this surprising? One of the early lessons, most web devs receive that functions like eval are dangerous because they allow arbitrary code execution. If you disregarding the huge financial incentives pushing for programming agents to run partially unsupervised on a dev machine on a limited selection of files, isn't it clear that something like this would happen eventually and will likely be a recurring issue?