The question of what an AI agent should — and should not — be allowed to do on your computer has become one of the defining security challenges of our era. Coding agents that can write to your file system, agentic tools that can browse the web and execute commands, assistants that can spin up processes and call APIs: the attack surface is vast, and until now, containing it has required each developer to reinvent their own sandboxing approach.
Microsoft has now drawn a line in the sand. On October 7, 2026, the company made Microsoft Execution Containers (MXC) generally available, announcing cross-platform SDKs and general availability for Windows 365 Cloud PC support. It marks the moment Microsoft formally positions Windows — and by extension its cloud and enterprise platform — as the enforcement layer for agentic AI workloads.
What Is MXC and Why Does It Matter?
Microsoft Execution Containers is a policy-driven containment system for restricting what AI agents and other untrusted code can access. The core principle is deceptively simple: an agent should not serve as its own security authority. Rather than relying on a model to behave correctly, MXC enforces the boundary at the operating system level, independent of the agent’s own design.
Logan Iyer, Microsoft’s corporate vice president for Windows Platform and Developer, made the GA announcement in a Windows Developer Blog post. “The boundary is enforced by the operating system,” the announcement stated, emphasizing that agents cannot circumvent the restrictions themselves.
The practical implications for enterprise IT and software developers are significant. Where previously a coding agent given access to a repository might, through model drift or a jailbreak, access production configuration files it had no business touching, MXC provides a declarative policy that blocks such access at the OS level — regardless of what the model decides it wants to do.
How the Containment Layer Works
At its core, MXC uses a unified JSON schema for declaring a workload’s permissions. Developers specify which files a workload can read or write, what network destinations it can reach, whether it has clipboard and display access, and more. The SDK — available for Rust, .NET, and Node — validates the request, selects the appropriate backend for the operating system, and launches the workload accordingly.
The containment backends vary by platform and risk tolerance:
- Process containers are the lightweight default: AppContainer on Windows 11, Seatbelt on macOS, Bubblewrap on Linux. These are suitable for responsive workloads where latency matters.
- Session containers (Windows 11 only) run the agent in a fully isolated OS session with its own identity, desktop, clipboard, and input queue. This is the option for agents that need persistent state or stronger UI isolation.
- WSLc (Windows 11 only) provides a Linux environment through the Windows Subsystem for Linux, enabling Linux-first toolchains to run in a contained environment on Windows.
- MicroVM (Windows 11 and Linux, experimental) adds a hardware-backed virtual machine boundary for higher-risk workloads — think agents handling sensitive financial data or medical records.
Crucially, organizations can layer their own restrictions on top of developer-declared policy. A developer might declare that an agent needs access to a source code repository; the enterprise policy can then further restrict that to a specific branch or project folder. This governance layering is central to Microsoft’s enterprise pitch.
Three Operating Modes: Enforcement, Learning, and Permissive
One of MXC’s more thoughtful design choices is its three-mode system for policy authoring and debugging.
In Enforcement mode — the default for production — operations not granted by the policy are blocked, with no activity report generated. This is the locked-down state you want in production.
In Learning mode, ungranted operations are blocked and recorded in a JSON activity report. This allows developers to iterate on policy: run your agent, see what it tried to access, and refine the policy without opening security holes.
In Permissive mode, ungranted operations are allowed but logged. This is the starting point for policy authoring — you let the agent run freely, see everything it touches, and use that data to draft a minimal policy. It does not override OS or organizational restrictions, maintaining a safety floor even in permissive testing.
Microsoft recommends having a coding agent draft the initial policy from the activity log, then manually reviewing and tightening it. The Node sample in the official documentation denies outbound network traffic by default — a sensible conservative baseline.
Ecosystem Support: Who’s Already On Board
The strength of a containment framework is only as good as its adoption, and Microsoft has assembled a notable initial roster of supporting tools.
Already shipping with MXC support: GitHub Copilot, OpenAI Codex, Replit, OpenClaw, LM Studio, Unsloth AI, and NVIDIA’s OpenShell. The breadth is notable — from proprietary enterprise tools to open-source model runners, the cross-ecosystem buy-in suggests MXC is being taken seriously.
Announced as coming soon: Anthropic Claude Code, Box, Egnyte, Manus, Perplexity, and others. The inclusion of Claude Code — Anthropic’s agentic coding CLI — alongside OpenAI’s Codex is a signal that MXC is emerging as a cross-vendor standard, not merely a Microsoft-first feature.
What’s Still Coming
General availability doesn’t mean the feature is complete. Several capabilities announced at the October 7 event remain on the roadmap:
Intune policy management for centrally governing MXC process containers is listed as “coming soon,” with no firm date. Currently, policies are stored in JSON files on individual machines, which creates management overhead at scale.
Entra identity integration for local agents — the ability to separate agent activity from user activity in Microsoft’s identity fabric — is also announced but not yet available. Once shipped, this would let security teams restrict a misbehaving agent without blocking the employee using it.
Agent 365 governance controls for local agents would extend Microsoft’s enterprise governance platform to cover on-device agentic workloads, completing the loop from device-level containment to organizational policy management.
The Bigger Picture: Windows as the AI Agent Platform
MXC’s GA is best understood not as a standalone feature but as part of Microsoft’s October 2026 Surface and Windows event narrative: Windows as the operating system for the agentic era. The event also announced Windows ML for deploying AI runtimes across CPUs, GPUs, and NPUs, along with an expanded Copilot app capable of accessing local files and spinning up local models.
MXC is the security foundation underneath all of it. As AI agents proliferate — coding agents, browsing agents, document agents — the need for a consistent, OS-enforced containment model becomes critical. Microsoft’s bet is that by providing the standard, it becomes indispensable to the enterprise workflows built on top of it.
For IT administrators, the arrival of MXC in general availability means the question is no longer whether to contain AI agents, but how to configure the policy. The framework is here, the tooling is being built out, and the major agent providers are signing on. The era of ad-hoc AI sandboxing is drawing to a close.
