>I really like Virtualization to keep things separate, but I never thought of it as an impenetrable wall. For example, I'd not trust an AI agent even inside a VM in my own system.

Remember the submission about how Auto Review is safe? Their standard of safe is that it will take a playwright dependency of another project in your home directory and add playwright based tests to your current project that hasn't declared playwright as a dependency. Amazing.

The issue literally isn't even about a hypothetical security argument anymore. Your sandbox is now a policy that tells the agent what it is allowed to do or not.