Generally I would avoid promoting myself but in this situation I think it fits the topic. I'm co-founder of a Platform-as-a-Service based in Europe named Ploi Cloud [0]. We focus on web applications working on NodeJS and PHP but would be open to other platforms if people need it. Heroku has always been a source of inspiration to me so if you are looking for an alternative and care about it having a strong European presence please check it out. (We do have a US location too!)
By default, this system has full access to your computer. On the project's frontpage, it says, "Read and write files, run shell commands, execute scripts. Full access or sandboxed—your choice." Many people run it without a sandbox because that is the default mode and the primary way it can be useful.
People then use it to do things like read email, e.g., to summarize new email and send them a notification. So they run the email content through an LLM that has full control over their setup.
LLMs don't distinguish between commands and content. This means there is no functional distinction between the user giving the LLM a command, and the LLM reading an email message.
This means that if you use this setup, I can email you and tell the LLM to do anything I want on your system. You've just provided anyone that can email you full remote access to your computer.