given that claude has found vm escapes, you might consider going one step further and just getting a claude only laptop