I posted a similar query on the Replit sandbox engine article, but..

How do people feel about the hardware isolation provided by microVMs versus the stronger end of software isolation techniques like gvisor?

Right now, we put a huge amount of stock in "hardware isolation". If that starts falling to agents to any substantial degree, I wonder whether we might end up leaning more on patchable software isolation, similar to the rise of software RAID (though, in userspace this time).