[spiorf]

What he means is that while the models tags code as code, for the model itself this is just relationship between tokens,like the code open and close tags,same as parenthesis, commas, uppercase or verbs and conjunctions...

What you say is achievable only if another system external to the model takes some tagged model output, makes computations or lookups, and feeds the results back to the model in the form of text input.

Then it's game on for the model to trigger some form of code execution through this external system and escape the jail...