That's currently how I model my usage of LLMs in code. A smart veeeery junior engineer that needs to be kept on a veeeeery short leash.
Overall, it would be nice to make it safer. I don't think switching to non-Lua format would make it safer, because it is intended to serialize functions too, which can have arbitrary code even if everything else would be stored as data. Maybe it is possible to make a function like `ldump.safe_load` restricting `load`'s environment, so it wouldn't have access to debug/os/io modules.
Running arbitrary code was such a problem that I just completely ruled it out for bitser. Instead of serializing functions, you can register safe functions as resources. This doesn't solve the upvalue problem, though.
> In 2023, the hottest year ever recorded, preliminary findings https://arxiv.org/pdf/2407.12447 by an international team of researchers show the amount of carbon absorbed by land has temporarily collapsed. The final result was that forest, plants and soil – as a net category – absorbed almost no carbon.
> “We’re seeing cracks in the resilience of the Earth’s systems. We’re seeing massive cracks on land – terrestrial ecosystems are losing their carbon store and carbon uptake capacity, but the oceans are also showing signs of instability,” Johan Rockström, director of the Potsdam Institute for Climate Impact Research, told an event at New York Climate Week in September.
> “Nature has so far balanced our abuse. This is coming to an end,” he said.
https://www.theguardian.com/environment/2024/oct/14/nature-c...
Update, answered in detail here: https://news.ycombinator.com/item?id=42016231