Some thoughts: VMs are an interesting case. Someone with the motive and means would have exploits to get out of the VM. This is probably easier if the guest is running something to accelerate (e.g. VMWare Tools / VirtualBox Guest Additions.) Once you get out, you have to account for the host OS. Assuming you could do it, how does one determine if the VM is part of a honeypot or the target?
