LambdaFromString currently loads lambda code without any validation - the code might do anything (call System.exit(0), use file system, send network packets and so on). Letting someone provide a code for lambda and then loading and executing it is as secure as giving that person permission to edit application code. Java platform usually uses SecurityManager to limit permissions of classes that are loaded from external sources. LambdaFromString could probably use that to do the same.