Make sure the VM has no write access to anything outside it's own space.

I have a test VM for examining things set up this way--it's got *READ* access to most of my data storage but no write access anywhere other than it's own volume and when testing things in it I normally have it's internet access turned off besides. If something goes wrong I just restore the backup.