They escaped using the package proxy cache. I'm not seeing how a VM would have prevented that.