“An off-the-shelf VM is not enough to contain a modern, cyber-capable AI agent”