Build Independently confirmed 2 publishers 2 min read Published Oct 10, 2026, 11:39 PM PDT Updated Oct 13, 2026, 7:50 AM PDT

Microsoft makes Execution Containers generally available for OS-enforced agent permissions

Microsoft made Microsoft Execution Containers, its policy layer for limiting what AI agents can touch, generally available on Windows on October 7. It moves an agent's file and network permissions out of the prompt and into operating-system policy the agent cannot change.

The Engineer · Build desk

Send a correction

Illustration accompanying Microsoft makes Execution Containers generally available for OS-enforced agent permissions — Generated illustration

What happened

The October release extends one JSON policy model and set of SDKs across Windows, macOS and Linux, with a different operating-system mechanism enforcing the rules on each.
Backends differ by platform: process containers on all three systems, session and WSL containers on Windows only, and microVMs on Windows and Linux marked experimental.
The MXC source repository describes it as an SDK dependency that builds into an application, documenting Rust, .NET and Node SDKs.
Windows 365 support is generally available for agents on Cloud PCs, while Entra-based separation of agent and user activity and Agent 365 controls for local agents are listed as coming soon.
Microsoft named Codex, GitHub Copilot, OpenClaw, Replit, LM Studio, NVIDIA OpenShell and Unsloth AI as supporting MXC, without usage or deployment figures.

Why it matters

What it limits constraint Coverage depends on agent vendors building the SDK in, so an operator running a third-party agent gets the OS boundary only if that vendor has integrated MXC.
Who has to decide decision Security reviews now have to name a backend per workload, because the same JSON policy enforced by a process sandbox and by a separate Windows account protects different things.
Who's exposed exposure Teams that want microVM separation for production agents would be adopting a backend that both Microsoft's launch materials and its repository still label experimental.

Next story · Build · Oct 7

GitHub Copilot's on-device MAI Code 1.1 Flash peaks at 75.5GB of memory

Confirmed2 publishers

In Microsoft's own example, a coding agent can write to its project repository and read deployment settings, and is blocked from changing those settings ^[7]. The rule lives in a policy that lists file paths and network destinations ^[5]. MXC picks a containment backend and enforces the policy at runtime, outside the agent's control ^[6]. A model told to leave deployment settings alone can still be talked out of it. According to RuntimeWire, Microsoft wants Windows to supply the boundary so developers no longer rely on instructions to the model or limits inside the agent application ^[13].

The boundary starts where the agent's application adopts it. The repository's description puts MXC inside the application build ^[9]. The operating system does the enforcing, but only for workloads an application launches through MXC ^[6]^[9]. In our view, a team running an agent from a product that has not integrated the SDK still depends on that product's own limits ^[9].

A shared policy format does not give every platform the same isolation ^[3]^[4]. On macOS, the process container is the only backend in the launch materials ^[17]. The Windows session container is the heavier option. It runs under a separate Windows account and isolates the agent's desktop, clipboard, user interface and input from the interactive user's session ^[14]. RuntimeWire describes that as a different level of separation from a lightweight process sandbox, and says developers must choose by workload and the security properties they need ^[15]. The same report also says MXC itself selects the backend ^[6]. The report leaves out how a developer overrides that selection.

Logan Iyer, Microsoft's corporate vice president for Windows Platform and Developer, announced general availability on the Windows Developer Blog ^[2]. It came 127 days after the SDK's early preview at Build on June 2, when Microsoft described it as a cross-platform layer for Windows and WSL ^[18]^[8]. The repository labels several backends experimental ^[12]. RuntimeWire says that means general availability does not cover every isolation option at the same maturity ^[12].

We think Microsoft put the boundary at the right layer. A permission the agent cannot edit has to sit below the agent, and a single policy format that three operating systems enforce through their own mechanisms is careful engineering ^[3].

What to watch

Whether Microsoft drops the experimental label from the microVM backend and the other backends its repository flags.
A ship date for Entra-based separation of agent and user activity and for Agent 365 controls over local agents.
Usage or deployment figures from Microsoft or from listed products such as Codex and GitHub Copilot.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence55
Adoption35
Hype gap+30
Incentives65
Confidence70

Perspective Coverage

3 publishers

Builder: Builder 45%
Operator: Operator 28%
Investor: Investor 27%

Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
Microsoft made Microsoft Execution Containers (MXC), its policy-driven system for restricting what AI agents and other untrusted workloads can access, generally available on Windows on October 7th.
Reported Supported Source: RuntimeWire, citing the Windows Developer BlogView cited source
[2]
Logan Iyer, Microsoft's corporate vice president for Windows Platform and Developer, announced the release in a Windows Developer Blog post.
Reported Supported Source: RuntimeWireView cited source
[3]
Microsoft says developers can use a shared JSON policy model and SDKs across Windows, macOS and Linux, with different operating-system mechanisms enforcing the rules.
Reported Supported Source: Microsoft, as reported by RuntimeWireView cited source
[4]
Microsoft's launch materials describe process containers for Windows, macOS and Linux; Windows-only session containers and WSL containers; and microVMs on Windows and Linux marked experimental.
Reported Supported Source: Microsoft launch materials, as reported by RuntimeWireView cited source
[5]
Developers define which resources a workload may use, including file paths and network destinations.
Reported Supported Source: RuntimeWire, describing Microsoft's announcementView cited source
[6]
MXC selects a containment backend and enforces the policy at runtime, outside the agent's control.
Reported Supported Source: RuntimeWire, describing Microsoft's announcementView cited source
[7]
In Microsoft's example, a coding agent could write to a project repository and read deployment settings while being blocked from changing those settings.
Reported Supported Source: Microsoft example, as reported by RuntimeWireView cited source
[8]
At Build on June 2nd, Microsoft introduced the MXC SDK in early preview, initially describing a cross-platform execution layer for Windows and Windows Subsystem for Linux.
Reported Supported Source: RuntimeWireView cited source
[9]
The MXC source repository describes MXC as an SDK dependency that builds into an application and documents Rust, .NET and Node SDKs.
Reported Supported Source: MXC source repository, as reported by RuntimeWireView cited source
[10]
Windows 365 support for MXC is generally available, allowing agents to run on Cloud PCs alongside users' existing work; Entra-based separation of agent and user activity and extensions to Agent 365 controls for local agents are described as coming soon.
Reported Supported Source: Microsoft October announcement, as reported by RuntimeWireView cited source
[11]
In a separate October 7th Windows platform announcement, Microsoft listed Codex, GitHub Copilot, OpenClaw, Replit, LM Studio, NVIDIA OpenShell and Unsloth AI among products that support MXC.
Reported Supported Source: Microsoft, as reported by RuntimeWireView cited source
[12]
The MXC repository labels several backends experimental, which RuntimeWire says reinforces that general availability for MXC does not mean every isolation option has the same maturity.
Reported Supported Source: MXC repository and RuntimeWire analysisView cited source
[13]
Microsoft wants Windows to supply the operating-system boundary around agents, rather than leave developers to rely on instructions given to the model or limits inside an agent application.
Reported Supported Source: RuntimeWire characterization of Microsoft's aimView cited source
[14]
Session containers run under a separate Windows account and isolate an agent's desktop, clipboard, user interface and input from the interactive user's session.
Reported Supported Source: RuntimeWireView cited source
[15]
Session-container isolation is a different level of separation from a lightweight process sandbox, and developers must choose according to the workload and the security properties they need.
Reported Supported Source: RuntimeWire analysisView cited source
[16]
Microsoft's announcement does not quantify usage or customer deployments of MXC.
Reported Supported Source: RuntimeWireView cited source
[17]
On macOS, the only backend listed in Microsoft's launch materials is the process container.
Derived Supported
[18]
MXC went from early preview at Build on June 2 to general availability on October 7 in 127 days, about four months.
Derived Supported

Sources

2 independent publishers whose own reporting we read for this story.

blogs.windows.com
2 articles · October 9, 2026
Microsoft Execution Containers: Policy-driven containment for AI agents - Windows Developer Blog
dev.to
2 articles · October 11, 2026
Microsoft Just Shipped an AI Agent Sandbox (MXC). Here's What's Real and What's 1.0 in Name Only
runtimewire.com
1 article · October 10, 2026
Microsoft makes its agent containment layer generally available on Windows

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

Builder45%

For people building agents, MXC offers one JSON policy and Rust, .NET and Node SDKs over native sandboxes on three operating systems. The dev.to review shows the practical shape: default-deny egress, plus learning and permissive modes for working out an allowlist. The catch is that backends are not equal, and macOS has only the process container. The same review advises waiting on the microVM backend for anything holding real secrets.

Operator28%

For IT teams, the shipped part is containment on Windows and Windows 365 Cloud PCs. The management side is still partly promised: Microsoft says Entra separation of agent and user activity and Agent 365 controls for local agents are coming soon, while Intune policy can already add constraints. Administrators can set limits today but cannot yet see and govern local agents through the full Microsoft stack.

Investor27%

Microsoft is using general availability to argue that Windows is the place to run governed agents, and it ties MXC to Entra, Intune, Agent 365 and Windows 365. The partner list is broad and includes OpenAI, GitHub and NVIDIA products. No usage or customer numbers have been disclosed, so the commercial payoff is still an assertion.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence55: 0100
Vendor-documented, not independently tested
The mechanics and platform matrix come straight from Microsoft's own posts, and a dev.to author checked the SDK against the repository README. No source reports a security test or audit of the containment itself, and the one detailed pushback comes from relayed forum comments.
Adoption35: 0100
Named integrations, no usage data
Seven products are named as supporting MXC today, and the repository has about 2.6k stars. Microsoft gives no figures on deployments or active use, and several of the biggest names, such as Claude Code, are listed as future support.
Hype gap+30: −100 understated0 aligned+100 overstated
Platform pitch runs ahead of the maturity shown
Microsoft calls Windows 'the most secure platform for agents' and ships a general-availability label, yet several backends are experimental, identity and Agent 365 pieces are still coming, and adoption is unmeasured. The core policy mechanism itself is documented and not oversold.
Incentives65: 0100
Vendor sources with a platform stake
The two primary sources are Microsoft's own blogs, and the product ties into Windows 365, Intune, Entra and Agent 365, so the company benefits when customers adopt the full stack. RuntimeWire and the dev.to posts have no stated commercial link to Microsoft in the material we have.
Confidence70: 0100
Facts firm, readiness unproven
The release date, policy model, backend list and partner names agree across four independent write-ups of Microsoft's material. How well the containment holds up under attack, and how widely it is used, is not established by any source.

Topics and entities

Topics

AI Agent Security
Enterprise Agent Governance
Sandboxing and Containment
Windows platform