AI agents are moving from answering questions to completing real work: reading files, using tools, accessing networks, writing code, and taking actions across applications. That capability creates a major security challenge—how do organizations let agents be useful without giving them unrestricted access to a user’s PC or enterprise data?
Microsoft’s answer is Microsoft Execution Containers (MXC). MXC provides policy-driven containment for AI agents, model-generated code, plugins, and other untrusted workloads.
What MXC does
MXC lets developers and IT teams define precisely what an AI agent can access, including selected files, folders, and network destinations. Those permissions are enforced by the operating system, rather than relying on the agent to follow instructions or manage its own safety boundaries.
In practical terms, an organization could allow a coding agent to read a designated project folder and access approved development endpoints, while blocking access to personal documents, unrelated systems, or sensitive network resources.
Why enforcement matters
The important distinction is that MXC policies sit outside the agent’s control. An agent cannot simply expand its own permissions, even if it is executing dynamically generated code or interacting with third-party tools.
This is especially important because agents often process untrusted inputs—web content, documents, emails, code repositories, or user prompts. A malicious instruction could otherwise attempt to misuse an agent’s legitimate access to files, credentials, applications, or network services.
Three containment options
MXC supports different execution models based on the workload and the level of isolation required.
- Process container — Available on Windows 11, macOS, and Linux. Designed for lightweight isolation of coding agents, model-generated code, plugins, and tool execution.
- Session container — Available on Windows 11. Built for long-running agents that need desktop access, with the agent running in a separate Windows account and session to isolate its desktop, clipboard, UI, and input activity from the user.
- WSL container — Available on Windows 11. Intended for Linux-based agent toolchains, development environments, and workflows that depend on the Linux package ecosystem.
- Windows 365 for Agents — Runs an AI agent in an Intune-managed Cloud PC, keeping agent activity separate from the user’s local device.
Process containers use AppContainer on Windows, Seatbelt on macOS, and Bubblewrap on Linux. Session containers provide stronger isolation for agents that require broader desktop access.
Policy modes for enterprises
MXC is designed to support a gradual, least-privilege approach to agent deployment.
- Enforcement mode — Actively blocks access outside the approved boundary.
- Learning mode — Observes the resources an agent attempts to use, helping teams build accurate policies.
- Permissive mode — Supports evaluation and monitoring while teams assess agent behavior.
On Windows, process containers can also generate an agent activity report that shows which resources a workload tried to access. This gives security teams useful evidence for creating least-privilege policies.
Part of a broader agent-security stack
MXC is not a standalone security product. Microsoft positions it within a broader governance and security ecosystem that includes Microsoft Security, Agent 365, Microsoft Defender, Microsoft Entra, Intune, and Microsoft Purview.
Together, these services are intended to help organizations manage agent identity, permissions, monitoring, data protection, and enterprise policy enforcement.
Ecosystem support
Microsoft says MXC is already supported by several agent platforms and developer tools, including OpenAI Codex, GitHub Copilot, OpenClaw, Replit, LM Studio, NVIDIA OpenShell, and Unsloth AI.
For developers, this means MXC can be incorporated into existing agent workflows rather than treated as a separate, bolt-on security layer. For enterprises, it provides a way to adopt agentic AI with clearer operational controls.
The bigger picture
MXC reflects an important shift in enterprise AI: the question is no longer only whether an AI model is capable, but whether the agent using it can be safely constrained. As agents become more autonomous, security must move from prompt-level safeguards to enforceable operating-system boundaries.
Microsoft Execution Containers represent that shift. They give organizations a practical way to grant agents only the access they need—while retaining control over what those agents can do.
References
- Microsoft Execution Containers: Policy-driven containment for AI agents — Windows Developer Blog
- Building Windows for hybrid intelligence — Windows Experience Blog
- NVIDIA, Microsoft Kick Off a New Beginning for Windows PCs With RTX Spark and AI Agents — NVIDIA Blog
- Build 2026: Furthering Windows as the trusted platform for development — Windows Developer Blog
Hashtags
#Microsoft #Windows11 #AIAgents #AgenticAI #AISecurity #Cybersecurity #EnterpriseAI #DeveloperTools #MicrosoftExecutionContainers #MXC #HybridIntelligence