Running Claude code in an isolated, temporary VM, with no access to memory is a good start. You give it your repo, prompt and you get back PRs. Claude code on web is a convenient way to do that.
given that claude has found vm escapes, you might consider going one step further and just getting a claude only laptop
loading story #50426501
loading story #50420411