There is a reference implementation: https://github.com/dom96/KillSwitch.

In the benchmarks the models/coding agents get a binary of the interpreter and indeed some of them do reverse engineer it. Over time this will get into their training data. But we can evolve the language and evade their training as we go.