For more than three years, Microsoft has layered Copilot onto Windows like paint on a wall — useful, visible, but fundamentally separate from the structure beneath. That era is ending. In its most radical architectural move since the introduction of the NT kernel in the 1990s, Microsoft is embedding Copilot directly into the Windows operating system kernel, partially rewriting core components in the memory-safe language Rust, and redesigning how the NPU fits into the system scheduler. The initiative, internally called Copilot Core, signals that Microsoft no longer thinks of AI as a feature. It thinks of Windows itself as an AI platform.
From Bolt-On to Built-In
The distinction matters more than it might initially appear. Every previous iteration of Copilot on Windows — from the sidebar experiment of 2023 to the unified Copilot app rolled out earlier this year — functioned as a process that sat on top of the operating system. It could observe what was happening in other apps through limited API hooks, but it could not reach into the scheduler, the memory manager, or the filesystem at a low level. Users had to explicitly invoke Copilot to get help. The OS had no native concept of an “AI agent.”
Copilot Core changes that by treating AI inference as a first-class kernel concern, equivalent to managing processes, memory pages, or network sockets. The result is a shift from a model where users *pull* intelligence from Copilot on demand to one where the OS *pushes* synthesised context and workflow suggestions proactively — before the user has to ask.
Early beta data from financial services firms testing the build reportedly shows a 25% reduction in time spent on information gathering and context-switching, a statistic Microsoft has been circulating internally. Whether that figure holds across broader enterprise deployments remains to be seen, but it is the kind of productivity claim that tends to accelerate purchasing conversations in large organisations.
The Rust Rewrite: Safety as a Prerequisite for AI Agents
The kernel-level Copilot integration required Microsoft to confront a long-standing problem: the Windows kernel, written largely in C and C++, has a poor track record with memory safety bugs. Giving AI agents the ability to take actions at the kernel level without a memory-safe foundation would be an extraordinary security risk. To address this, Microsoft has partially rewritten key kernel subsystems in Rust.
This is not the first time Microsoft has flirted with Rust in Windows. The company began experimenting with Rust in driver development several years ago, and the Windows kernel team has published research on safe systems programming. But Copilot Core represents the first time Rust has been deployed at the kernel level as an architectural requirement rather than an experiment. The components responsible for brokering AI agent permissions — what an agent can read, what it can write, which system calls it can invoke — are the primary targets for the Rust rewrite, specifically because those components must be provably safe even when an AI model produces unexpected outputs.
The security implications extend beyond stability. AI agents operating at the kernel level represent a new and largely uncharted attack surface. A compromised or manipulated agent that has kernel-level permissions is far more dangerous than one running in userspace. Microsoft’s Secure Future Initiative, already under pressure following years of high-profile security incidents, has apparently made memory safety in the AI agent broker a non-negotiable requirement before Copilot Core ships broadly.
The NPU Scheduler: A First-Class Citizen
Alongside the architectural changes to how Copilot runs, Microsoft has redesigned the Windows process scheduler to treat the Neural Processing Unit as a primary resource rather than a secondary accelerator. In previous versions of Windows, the NPU was managed through a driver abstraction layer that treated it similarly to a GPU or a sound card — useful for offloading specific tasks, but not something the scheduler actively managed alongside CPU and memory resources.
The new NPU-aware scheduler changes that. It tracks NPU utilisation in real time, queues inference workloads with priority levels, and can balance AI workloads across CPU, NPU, and GPU depending on thermal state and battery life. The practical effect is that Copilot Core’s background inference jobs — the ones that maintain ambient context about what the user is doing — are managed by the OS itself rather than by a userspace daemon that might compete with foreground applications.
For Copilot+ PCs, which already ship with dedicated NPU hardware, this means the AI inference load that Copilot Core requires should largely disappear from the CPU and battery impact users notice today. For machines without a dedicated NPU, the scheduler will route inference work to the GPU or CPU with appropriate throttling to prevent Copilot Core from degrading foreground performance.
What “Ambient AI” Means in Practice
The user-facing implications of Copilot Core are still emerging, but the principle is clear: Windows will accumulate context about ongoing work across all applications and proactively surface help without being asked. A developer switching between a code editor, a documentation browser, and a Slack thread might find Windows offering to consolidate findings before the next meeting. A financial analyst working across Excel, a web dashboard, and an email thread might receive a contextual summary as they shift tasks.
Critically, Microsoft is designing this not as a surveillance mechanism but as something that runs entirely on-device by default. The ambient context Copilot Core maintains — what files are open, what the user is reading, what recent actions they have taken — remains on the machine unless the user explicitly chooses to sync it to the cloud for cross-device continuity. That distinction will matter enormously in enterprise environments where data governance requirements prevent sensitive context from leaving managed devices.
The Enterprise and Security Stakes
Microsoft’s August 2026 Security updates, published just days before Copilot Core details became public, included new Secure Now guidance for agentic containment in Microsoft Security Exposure Management. The guidance focuses specifically on constraining AI agent-initiated actions that occur without explicit user approval — a direct acknowledgement that kernel-level AI agents will require new security postures.
Microsoft Entra Tenant Governance, which reached general availability the same week, adds centralised policy control across multi-tenant environments, another piece of the infrastructure needed before organisations will trust agents operating at the kernel level. The pattern suggests Microsoft has been staging the security and governance tooling in advance of shipping the feature that will demand it.
What Comes Next
Copilot Core is expected to ship as a preview feature in Windows 11 26H2, the fall 2026 update. Broad rollout is targeted for Copilot+ PC hardware first, where the NPU scheduler changes will have the most measurable impact. Legacy hardware without a dedicated NPU will receive Copilot Core capabilities more gradually, with Microsoft promising that the feature will gracefully degrade rather than impose a hard hardware cutoff.
For enterprise IT administrators, the arrival of kernel-level AI agents will require new thinking about security policy, device compliance baselines, and the governance of what agents can do on managed machines. Microsoft has signalled that Intune and Defender will gain agent-specific controls alongside the Copilot Core rollout — but the specifics of those controls have yet to be published.
What is clear is that the era of Copilot as a chat sidebar is over. The question Microsoft is now answering is whether the operating system itself, not the app layer above it, is the right place for AI to live.
