What does Microsoft Execution Containers actually do for AI agents?

Why agents needed a new kind of boundary

An AI agent cannot be its own security authority. The model, the generated code, or a plugin might decide that reaching beyond the intended scope is the fastest way to finish a task. A coding agent asked to update a website could read the production server configuration to understand deployment, then decide that modifying that configuration completes the job faster — breaking the live site in the process. The action looks reasonable to the agent. It still exceeds the authority the developer meant to grant. The boundary holds.

The containment backends and what they isolate

MXC offers a spectrum of isolation levels so developers can match the backend to the workload. Only Windows supports a session container. It runs the agent in a separate OS-isolated session with its own local agent identity, isolated desktop, clipboard, UI, and input boundaries. A process container runs on Windows 11, macOS, and Linux using the platform-appropriate sandbox. On Windows it uses AppContainer. On macOS it uses Seatbelt. On Linux it uses Bubblewrap. A WSL container provides a Linux execution environment through WSL on Windows 11. A MicroVM backend, experimental on Windows 11 and Linux, adds hardware-enforced isolation with full Linux workload compatibility. Each backend has distinct security properties. Workloads should be evaluated for fit with the chosen backend. Windows 365 support for MXC is also generally available, letting developers run agents on Cloud PCs with the same isolation model.

How policy modes let you test before you enforce

Writing a least-privilege policy is hard when you do not yet know every resource an agent workload requires. MXC supports three operating modes. Enforcement mode applies the policy without an activity report — granted operations proceed, ungranted operations are blocked. Learning mode continues to enforce the boundary but blocks ungranted operations and records them in a JSON activity report so developers can reproduce containment failures and see which resources the workload attempted to access. Permissive mode allows the operation to continue while recording access the policy would have denied, useful during policy authoring because the workload completes while evidence is collected. Only on Windows can MXC process containers produce an agent activity report showing which resources a workload attempted to use. When you bring an agent into an MXC container for the first time, the policy can block capabilities the workload legitimately needs. Those denials reveal where the boundary needs adjustment.

Identity and management layers coming next

Identity helps determine which agent performed an action. Windows will soon allow Microsoft Entra to distinguish agent activity from user activity in Microsoft Agent 365. This separation lets security teams evaluate an agent's behavior and risk independently from the person using the device. If an agent becomes compromised or violates policy, security controls target the agent's access without blocking the employee's access. Intune policy will soon be available to manage MXC process containers used by MXC-integrated agents on Windows 11. These policies will give IT administrators control over how Windows evaluates container creation requests and the resource boundaries those containers enforce.

Who already uses it and where to start

NVIDIA has integrated OpenShell into MXC, adding policy controls for agent access to files and inference services. It also adds advanced network controls, credential management, and OCSF auditing for enterprises. Leading agents and frameworks already support MXC. GitHub Copilot and OpenClaw are supported. OpenAI Codex and Replit are supported. LM Studio and Unsloth AI are supported. Many others will release support. Anthropic Claude Code and Box will add support. Egnyte and Heidi Health will add support. Hermes Agent by Nous Research and Manus will add support. Perplexity and Raycast will add support. Simular will add support. For people using AI every day, these safeguards become part of the agent experience itself. GitHub Copilot, Codex, and Replit scenarios demonstrate how MXC supports a demanding developer workflow — the agent gets access to the project repository, development tools, and commands required for the task, but not to unrelated files or network destinations. You can get started today with the MXC SDK, configuration schema, documentation, and samples in the MXC repository. If you encounter unexpected behavior or have ideas for improving the experience, open an issue on GitHub.