An interesting technical claim to sandbox a process in such a way that it has free access to display drivers and hardware modules (tpm's) but not the host system, network or hard drive.

I would like to see a security audit on that claim.