The main risk is not that the agent breaks out of their sandbox, although it's an infitesimal possibility (that increases to certainty if you increase the token budget to 100M$ and use subagents to spend it all at once).

The main risk (for you, mere human without a 100M$ budget) is that it downloads a compromised package or vulnerability, or that it runs a stray rm -rf or some stupid stuff. A user provides reasonable protection, you don't NEED a vm (and even then that can be escaped).