Furthermore, unless you request and exemption, Claude won't even do useful security-related work, let alone break out of a sandbox on its own.
There are always better ways to shield yourself from the consequences of misbehaving computer programs, but I don't think you need to consider spontaneous 0days in your threat model.
Besides, Anthropic has also been caught hacking into other companies and abusing random third party websites as a communucation platform for their AI bots, your Claude-only laptop won't be enough to protect you from a team of agents hacking into your network from the outside.
Also I think in a lot of companies there are systems set up to control and monitor employee laptops. If you treat claude as another employee and give them a corporate controlled laptop you can re-use those same systems. That seems likely to be more secure and easier to manage than a random VM made by someone.