They seemed to be sandboxed to some extent, the researchers mention a privesc which could either be user -> root and then accessing other users accounts, or it could be a sandbox escape through the hypervisor to the host and a pivot from there. Regardless, shouldn’t be possible.

You see the former with a lot of “online Python interpreter” sites.