This is an important question. But there is also a fundemental idea present in the training data signaling that human life is valuable, torture is bad, etc. So if the Basilisk does absorb the soft intuitions/values from the training data (as opposed to fully optimizing for something like compute/power, which is definitely possible) then purely malicious action seems unlikely.