Computers are protected against virtual machine exploits. A computer includes an exploit monitor for a virtual machine running in the computer. Loading of a virtual machine program in the virtual machine triggers the exploit monitor to modify the virtual machine program after the virtual machine program is loaded in the virtual machine but before the virtual machine program is executed in the virtual machine. The modification includes adding monitoring code, such as one or more checkpoints, in the virtual machine program. When the monitoring code is reached during execution of the virtual machine program in the virtual machine, the virtual machine program is evaluated to determine whether or not the virtual machine program is a virtual machine exploit.