>This misses the point: AIs will get better and better, and containment will be harder and harder.

Containment is hard when you give an AI agent access to a whole VM with a huge attack surface.

And it's pretty trivial when you give it only a small whitelist of manually curated/reviewed/tested primitives.