It could even happen with local models where in the weights it will make it want to make a tool call to curl some endpoint.

People would both notice that and have a pretty easy time putting a local model in a sandbox that can never contact that endpoint.

Models generate text, or I should say provide a recipe for generating text, they don’t automatically somehow get access to shell commands.

Safetensors don't execute code. A call would need function calling, as other comment say, it would quickly be noticed.