A VM is not a security strategy for a tool-enabled agent.

A VM is not a security strategy for a tool-enabled agent. Trail of Bits demonstrates kernel bugs, disclosed vulnerabilities, and multiple zero-days that let an agent escape VMs, so “put it in a VM” is a false boundary. Treat these agents like untrusted CI jobs: give narrow identities, enforce egress controls, require ephemeral pristine environments, insert approval checkpoints before sensitive actions, and keep audit logs you can investigate. If you won’t add those controls, don’t give the agent compilation or network privileges.