The interesting benchmark is not merely whether each agent receives a VM. It is whether a compromised task can cross capability, credential, network, or persistence boundaries.