The colloquial term for that is honeypot. A honeypot system must be attractive for the attacker, but otherwise constrained so that it does not help the attacker in his nefarious schemes. This is a rather delicate balance. For instance, a honeypot to trap spammers must look as if it could serve as relay for tons of spam, but preferably not allow much spam (or any) to actually be sent.
Virtual machines are a method to make several systems share the same hardware, and yet be (nominally) isolated from each other. Escaping from the VM is normally impossible, unless the VM engine has a security hole, and existing VM engines do have security holes, so hosting a honeypot in a VM is somewhat risky. It is understandable that, for a honeypot, you want something cheap (it will not contribute much to your business, after all), and a VM is usually cheaper than a physical server. But it is really safer to use a physical machine as honeypot, with good network separation (explicit firewalls, no VLAN...). On the other hand, a VM can be snapshot, which is very convenient for post mortem analysis.
The main point of a honeypot is to serve as an observation deck to learn what kind of attacks are in vogue. Companies who write botnet detection systems run honeypots to have botnets to observe under controlled conditions.