Yes by their definition the current AI agents are running in VM already. e.g. MCP host could prompt the user for executing something and we can also have rules like in claude code to automatically allow some pattern of command.