While I never had it happen, it could give you wrong command line switches that do damage. For example, when I asked how I could list volumes attached to an AWS instance, it gave me a "modify-volume" command instead of "describe-volume" command. Thankfully, I caught that before I cut and paste it.
You can ask it for source now with browser integration. Previously the browser extension was a separate model with gpt3.5 which was pretty bad, now it's just integrated into gp4. It works a million times better and it's great that it doesn't break the flow of the conversation.
I had an emailed a question that I didn't really know where to go with, so I asked Copilot to answer the email factually. Sent that email with a note of ai origin, but it was close enough and got us into right track