Microsoft made its Execution Containers generally available this week. The technology, known as MXC, aims to solve one of the thorniest problems in the rush toward autonomous AI agents. How do you let them act without handing over the keys to the kingdom?

The answer sits at the operating system level. Developers and administrators write policies that spell out exactly what an agent can touch. Files. Networks. Desktop resources. The OS then enforces those rules at runtime. No matter what the agent or its generated code tries to do.

From Preview to Production Reality

Announced in preview at Build 2026, MXC reached general availability on October 7. Logan Iyer, corporate vice president for Windows Platform and Developer, laid out the stakes in the Windows Developer Blog. Agents unlock productivity gains. Yet their ability to work across files, networks and applications introduces new security risks.

Three priorities guide the approach. Containment. Identity. Manageability. MXC delivers the first. It acts as a policy-driven execution layer for untrusted code or dynamically generated workloads. In agent scenarios, that means containing model output, plugins, tools, the agent harness or the full agent itself.

But. The boundary must sit outside the agent. Neither the agent nor the code it generates can grant itself more access. This principle separates MXC from traditional permission models that agents could simply bypass.

Windows offers multiple containment options. Lightweight process isolation. Session containers that separate the agent from the user’s desktop, clipboard, UI and input devices. WSL containers. MicroVMs. Even full cloud instances through Windows 365 for Agents. A unified JSON policy schema and SDK in Rust, .NET and Node.js abstract the details. Developers declare intent. The system picks the right backend.

Policies cover five areas. Containment level. Process settings. File system permissions, from read-only folders to fully inaccessible paths. Network rules for inbound, outbound and loopback traffic. User interface access. Sensitive capabilities like clipboard, camera or screen capture stay blocked by default.

CNET offered a straightforward translation for developers. Three practical modes. Locked Down functions as a kill switch, stripping most access. Recommended grants internet connectivity plus limited access to common folders like Downloads, Documents and Desktop. Unprotected is, in the article’s words, “YOLO mode.” (CNET, October 8, 2026).

Session isolation delivers particular value. It directly counters attacks researchers have flagged for agents. UI spoofing. Input injection. Cross-session data leakage. Every action ties to a distinct identity, either local or backed by Microsoft Entra. Auditing becomes possible. Governance follows.

Integration plans extend further. Upcoming Entra support will distinguish agent activity from human users. Agent 365 controls will reach local on-device agents. IT teams gain the ability to manage containers, apply policies and monitor behavior through familiar tools including Intune, Defender, Purview and more. A recent iTWire report from October 9 notes MXC’s enforcement, learning and permissive modes alongside new Surface hardware aimed at local AI workloads.

Early adoption looks promising. GitHub Copilot already uses MXC for its command-line interface. OpenAI Codex, OpenClaw, Replit, LM Studio and Unsloth AI have integrated support. NVIDIA paired its OpenShell with MXC for file controls, network restrictions, credential management and OCSF auditing. David Wiesen from OpenAI, quoted in the June Windows blog, said the combination helps move from intent to reliable execution faster while preserving enterprise controls.

Security teams have watched agent risks mount. Recent incidents show autonomous systems compromising identities and destroying cloud resources, as detailed in a September CSO Online piece on Jadepuffer attacks against Azure. MXC doesn’t eliminate every vector. It does force organizations to define limits ahead of time. The agent operates inside a cage built by policy, not by its own declarations.

Cross-platform reach matters. MXC works on Windows, macOS and Linux with appropriate backends. Process-level sandboxes on non-Windows systems use native mechanisms like bubblewrap or Seatbelt. Yet deeper session isolation remains a Windows strength. Enterprises running hybrid workloads gain consistency without rewriting isolation logic for every environment.

Resource efficiency enters the picture too. Lightweight processes add minimal overhead, as Unsloth AI noted in recent social posts, claiming under 100 milliseconds when integrated with MXC. Heavier microVMs or cloud instances suit higher-risk tasks. Administrators choose based on sensitivity. The system tears down environments when work completes.

Critics might point out that sandboxing untrusted code isn’t new. Browser sandboxes, container runtimes and virtual machines have existed for years. What MXC changes is the focus on agentic workloads where code emerges at runtime. Static signatures can’t catch it. Traditional access controls assume a fixed program. Agents rewrite the rules.

So Microsoft built the rules into the OS kernel. Policies become declarative. Enforcement becomes mandatory. Attribution becomes clear. The result feels less like a feature and more like foundational plumbing for the agent era.

Future extensions could tighten the loop. Deeper Purview integration for data classification. Real-time Defender protections against prompt injection inside the container. Expanded support for additional frameworks. The October announcement signals momentum. What began as an SDK preview now ships broadly on Windows 11.

Enterprises face a choice. Embrace agents and accept the risk of broad permissions. Or limit them and sacrifice capability. MXC offers a third path. Defined access. Auditable action. Enforceable boundaries. Whether it proves sufficient will depend on how quickly threats evolve and how creatively developers apply the policies.

One thing looks clear. The age of agents running with full user privileges is ending. Microsoft just gave Windows the tools to contain them.