A Guest-to-Host VM Escape PoC Made Me Rethink What 'Isolated' Actually Means

We'd been running untrusted customer code in VMs for about a year with a line in our security docs...