Every AI instance is just another data point that ultimately feeds back into the LLM. Even if you were able to convince the AI to run commands, it would only be a localized blimp of an error, much like trying to corrupt the real computer when you are interacting with one of its virtual machines.