I will speak on behalf the AT smart engine that is currently live on burst coin. No you cannot infect the host pc with virus using AT contracts. But for sure someone can create an AT contract that says it does x but it does y and you end up loosing money if you send coins to the AT, but at least anyone can check the code the AT is executing.