I think it's pretty much unassailable to say that cloud computing as we know it depends on the concept of the robustness of virtual machines. Where one can depend on the security of VMs they allow workloads from multiple customers of a cloud provider to securely run on shared hardware, while also guaranteeing that if the security of something inside one customer's VM is compromised the host OS & firmware of the provider's server won't be affected. If you're Amazon, Microsoft, Google, IBM, or really any cloud provider of any size making sure VM isolation of each customer's stuff remains uncompromised is vital to your operations and to customers continuing to trust your service offerings.
However, as we know VMs are not escape-proof. Security vulnerabilities have been periodically found in every major virtual machine technology that I can think of.VENOM for Xen VMs is probably the most famous of these, but Hyper V, VMware products, and so on have also been afflicted by vulnerabilities. Of course, these known flaws can and are patched by providers. But there undoubtedly other flaws out there, waiting to be discovered and (potentially) exploited by attackers. In fact, one would assume that well-resourced attackers--meaning ones capable of developing new vulnerabilities & exploits in-house or buying valuable ones grey/dark markets--would have very strong incentive to devoting good amounts of time/effort/money to finding or buying novel ones that allow breaking out of the VMs used by major cloud providers. Especially given the ever increasing role that cloud computing plays in the tech infrastructure of so many companies & organizations that are, in turn, all potentially juicy targets (for varying reasons) to sophisticated attackers.
So, how do Amazon, Microsoft, etc. guard against the threat that a sophisticated attacker (whether state-sponsored APTs, high-end organized crime, or whatever) can develop for buy novel VM escape exploits and use them against the provider's infrastructure and customers? The one obvious measure that sticks out to me is running customized host-based intrusion detection systems on all cloud servers to try to catch VM escape events as/when they happen, but as we all know by now HIDS are hardly fool-proof. What other measures could/do cloud providers take to detect, prevent, or mitigate the danger of VM containment breaches?