While I never had it happen, it could give you wrong command line switches that do damage. For example, when I asked how I could list volumes attached to an AWS instance, it gave me a "modify-volume" command instead of "describe-volume" command. Thankfully, I caught that before I cut and paste it.
You can ask it for source now with browser integration. Previously the browser extension was a separate model with gpt3.5 which was pretty bad, now it's just integrated into gp4. It works a million times better and it's great that it doesn't break the flow of the conversation.