Theoretically, by taking the opportunity to inject an exfiltration mechanism if you ask it to write code for you

Lots of people I know run models in "yolo" mode or the equivalent as well, which means it could just invoke curl or telnet to exfiltrate data.