Why MicroVM Isolation Changes the Blast Radius for Untrusted Agent Code
TL;DR: When agents run untrusted code, isolation controls spread. Compare shared-kernel containers, userspace sandboxes, microVMs to limit blast radius.
A microVM, such as those booted by Firecracker
