I'm not entirely sure what Cowork means by “sandboxed VM” right now. Relay simply has access to the folder you've defined for the project.