If you mean no to the first bit, that's reassuring. play.golang.org is something of a special case as it tries to run code in a sandbox. I'd be more interested in exploits which attack web server processes or db drivers with malicious input as those are more likely to actually be used in the wild.