How to isolate autonomous AI agents using lightweight VMs to prevent prompt injection and credential exfiltration