It can’t actually spawn shell commands (yet.) But some idiot will make it do that, and that will be a fun code injection when it happens, watching the mainstream media try to explain it.