I don't know what to Google ('lisp evaluator security' wasn't fruitful) but I'd love to see research on the subject.
Jonathan Rees's 1995 paper "A Security Kernel Based on the Lambda Calculus" was enlightening. Not only was it capability-based security in Scheme -- but capabilities are lambdas!
However, high-security language runtimes have a history of being subverted anyway.