Microsoft Execution Containers Are Now Available for Windows AI Agents

Microsoft has made Microsoft Execution Containers, or MXC, generally available, giving AI developers a new way to restrict what autonomous agents can read, change and access on a computer. The announcement came on October 7, 2026, as Microsoft outlined a broader push to make Windows a platform for local and cloud-based AI agents.

The practical idea is simple: a coding agent should be able to work inside a project without automatically gaining permission to browse unrelated personal documents, change server settings or connect to every network destination.

Read Microsoft's official MXC announcement.

Why AI Agents Need Their Own Security Boundaries

Traditional desktop applications usually operate within a user's permissions. An autonomous AI agent can be different. It may write and execute code, call external tools, read files, interact with services and keep working across multiple steps without someone approving each individual action.

That creates a problem when the agent encounters malicious instructions, makes a mistake or interprets a task too broadly. A request to update a website should not become permission to edit unrelated credentials or production infrastructure.

MXC addresses this through policy-driven containment. Developers describe the files, directories, network destinations and other resources a workload needs. The containment layer then enforces those limits outside the model's control, so generated code or the agent itself cannot simply declare additional permissions.

Microsoft frames its wider agent security strategy around containment, identity and manageability. MXC is the containment component available now; some of the broader identity and enterprise management integrations are still being introduced.

How Microsoft Execution Containers Work

MXC offers multiple containment backends rather than one universal sandbox. Microsoft describes process containers for lightweight tasks across Windows 11, macOS and Linux. Windows-specific options include session containers that separate an agent's desktop and input from the user's active session, plus Windows Subsystem for Linux containers for Linux-oriented toolchains. A microVM option is experimental.

Developers can use a common JSON configuration and SDK while selecting an isolation approach appropriate for the risk and workload. That matters because an interactive coding assistant may need fast file access, while a long-running agent handling sensitive documents may need stronger separation.

The policy can grant read access to a configuration file while allowing writes only inside the project folder, for example. If the agent tries to modify the protected configuration, the sandbox is designed to deny that operation.

No sandbox makes unsafe behavior impossible. Security still depends on correct policies, the selected backend, the application integrating MXC and keeping software updated. Experimental isolation backends should not be presented as equivalent to mature production controls.

What Is Available Today, and What Is Still Coming?

Microsoft says MXC is generally available, and its Windows announcement names GitHub Copilot, OpenAI Codex, OpenClaw, Replit, LM Studio, NVIDIA OpenShell and Unsloth AI among integrations already supporting it.

That does not mean every existing installation of those applications immediately exposes the same MXC options, or that users should assume all agent actions are contained by default. Feature availability and configuration depend on the product, version and how the agent is launched.

Microsoft separately lists Claude Code, Hermes Agent, Perplexity, Raycast and several other products as planning support. Those future integrations should not be confused with software that is already using MXC.

The company also says Intune management policies for MXC process containers are coming soon. Agent-specific attribution through Microsoft Entra and Agent 365 is part of the roadmap, not a guarantee that every identity feature is already available to every customer.

See Microsoft's Windows platform overview.

Enforcement, Learning and Permissive Modes

One useful detail for developers is that MXC supports different ways to build and test a policy.

Enforcement mode blocks access that has not been granted. Learning mode also blocks that access but records attempted operations in an activity report, helping developers discover missing permissions. Permissive mode records what would have been denied while allowing the operation to proceed, which is useful during policy design but should not be mistaken for a protective enforcement mode.

A careful deployment would first identify the agent's legitimate needs, test the policy with representative tasks, inspect blocked accesses and then run production workloads with enforcement enabled. Granting an agent unrestricted access just to silence errors defeats the point of containment.

Microsoft has published the MXC project and its configuration documentation for developers who want to examine the available controls and integration options.

Explore the official MXC repository and its configuration schema.

What This Means for Windows PC Owners

For everyday users, MXC is more of a security foundation than a new app to install. It could make coding assistants and personal automation tools safer as those products adopt the framework, but users should still check an application's actual permission settings and avoid granting unnecessary access to sensitive folders or accounts.

For developers, it provides a concrete approach to the principle of least privilege: give the agent only the resources needed for the task, and enforce that rule independently of the AI model's instructions.

The announcement is separate from Microsoft's other October news about RTX Spark hardware and hybrid AI. You do not need a new premium AI laptop just to understand the security problem MXC addresses. The key question is whether the agent software you use supports a properly configured containment backend.

The bigger shift is that Windows is beginning to treat autonomous agents as workloads that require explicit boundaries, not just another process running with the user's full authority.

Read the detailed Windows Developer Blog explanation.