The problem is that he managed to essentially bypass my jail. He could've wiped my server if he'd wanted.
turning down your server is not as much fun as cheating.
shameless plug, I have just worked out a JavaScript class loader[1] of Robocode a few week ago. you don't have to turn security off with this class loader, unlike some approaches suggested on RoboWiki[2]. I'm currently trying to get Jython work with Robocode.
[1]: https://github.com/xiazheteng/robocode-classloaders [2]: http://robowiki.net/wiki/Other_JVM_Languages