@alcinnz @freakazoid @grainloom There are probably VMs, though I'd recommend looking at http://mumble.net/~jar/pubs/secureos/secureos.html which isn't quite on the VM level, more about how it applies on the language level. (Maybe you also meant Agoric's current work?)
However, as for a VM that *can be* ocap secure even wired between instances, look at the wasm-gc spec (aka WASM Managed Objects or less interestingly WASM w/ Garbage Collection)