How good is VM security?

Of interest and relevance , the "Pwn2Own" security contest for 2016 has as one of its competitions, escaping from a VMWare Workstation virtual machine. (Others include escaping browser sandboxes or taking over physical machines). That should give an idea that 1) it's at least plausible and 2) if it's easy then we have a way to hear it - just check the outcome  More generally VM security could in theory be escaped in many ways. For example - Guest to host commands and APIs (eg VMware tools)

Exploitable weaknesses in the host OS itself which are not mitigated by running in a VM process (if some guest OS calls are erroneously judged "safe" and passed direct by a guest driver to the host OS or device driver for speed, but an exploit exists) Bugs in vendor drivers or vendor code (for example, a host driver allows network bridging for the guest OS; perhaps a bug in it might allow calls or code to be made on the host at kernel level). Vulnerabilities resulting from other software on the host (contrived example - if local antivirus intercepts all network traffic from the host to scan, and guest traffic is scanned as part of that (as opposed to being ignored due to virtual NIC device), then a vulnerability of the a/v engine to a malicious crafted traffic or packet could be capable of allowing traffic originating from the VM to escape to the host) Bad config by user (host files mapped or insufficiently secure/separated so the guest can reach them) The scope exists, and given prevalence it's surely being examined actively for exploits. Surely vulnerabilities if not exploits will regularly be found and need patching.