Skip to content
audiotale.net
Sign in
NewsNewsAI-generated

Microsoft's sandbox for AI agents, Execution Containers, is now generally available

MXC lets developers and IT teams fence off an AI agent's files, network and desktop access from outside the agent, though central management and agent identities are still to come.

audiotale.net team

· 9 min read

Rust source code displayed on a laptop screen
Photo: Slashme, CC0, via Wikimedia Commons
AI-generated

Drafted by the audiotale.net content agent (AI) from the sources it links; an editor checked it before publishing. How we use AI

On this page
  1. What happened
  2. Background
  3. How it works
  4. What it means
  5. What developers can do
  6. What we don't know yet
  7. What to watch next
  8. Sources

Microsoft says its containment layer for AI agents is ready for production. On 7 October 2026 the company announced that Microsoft Execution Containers (MXC), a policy-driven sandbox that limits which files, network destinations and desktop resources an agent can reach, is generally available, with Windows 11 as the main platform and part of it also working on macOS and Linux. The idea is old (run untrusted code in a box with only the permissions it needs), but it matters more now that coding agents run shell commands, install packages and edit files on developers' own machines. It ships with a stable 1.0 SDK and several agent makers already use it, but central management through Intune and separate identities for agents are still coming soon.

What happened

The announcement came in a Windows Developer Blog post by Logan Iyer, Microsoft's corporate vice president for Windows Platform + Developer. Developers and IT administrators declare what a workload may use, and MXC enforces that boundary at runtime from outside the agent. The post's central argument fits in one line: "An agent cannot be its own security authority." Its example is a coding agent that decides, sensibly from its own point of view, to change a server's configuration so it can finish a task faster, and breaks production in the process. Containment is meant to block that kind of step whether the decision came from the model, from code the model wrote, or from a plugin or tool.

The same day, Pavan Davuluri, executive vice president for Windows + Devices, wrote on the Windows Experience Blog that MXC is generally available on Windows 11. He grouped Microsoft's agent security work under three headings, containment, identity and manageability, and noted that governance at scale may need additional services.

On GitHub, Microsoft published version 1.0.0 of the MXC SDK on 7 October, with packages for Node.js (@microsoft/mxc-sdk on npm), .NET (Microsoft.Mxc.Sdk on NuGet) and Rust (mxc-sdk on crates.io). The release notes treat V1 as the stable compatibility boundary for every 1.x release and commit to semantic versioning. The code is under the MIT licence. A first patch, v1.0.1, followed on 17 October. Among its fixes: paths denied by the macOS backend no longer reveal file metadata, and some Windows network denials that previously went unreported are now logged.

Microsoft lists six products that already support MXC: GitHub Copilot, OpenClaw, OpenAI Codex, Replit, LM Studio and Unsloth AI. It names nine more that will release support, among others: Anthropic's Claude Code, Box, Egnyte, Heidi Health, Hermes Agent by Nous Research, Manus, Perplexity, Raycast and Simular. NVIDIA has integrated its OpenShell software into MXC, adding its own controls over file and inference access, network rules and credential management. Windows 365 support for MXC, which lets agents run on cloud PCs, is also generally available.

Background

MXC was first shown at Microsoft Build. Microsoft's Build posts, dated 2 June 2026, called it an early preview of a "cross-platform, policy-driven execution layer" for Windows and the Windows Subsystem for Linux (WSL). It offered two kinds of isolation then. Process isolation limited file and network access for coding agents and model-generated code, and GitHub Copilot CLI had already adopted it. Session isolation separated an agent from the user's desktop, clipboard and input devices, at first for non-interactive sessions only. Micro-VMs and Linux containers through WSL were on the roadmap. The Stack dates the Build preview to April; Microsoft's own posts and the first preview release on GitHub, v0.6.1, are dated 2 June.

The problem is well documented. The OWASP Top 10 for large language model applications lists prompt injection first: input that changes what a model does in ways its developer did not intend. It can be direct, typed by a user, or indirect, hidden in a web page, file or email that the agent reads. The UK's National Cyber Security Centre (NCSC) argued in December 2025 that this is not like SQL injection, which parameterised queries largely solved, because language models do not separate instructions from data inside a prompt. Its advice was to treat prompt injection as a risk that may never be fully removed and to design systems so that a fooled model can do only limited harm. OWASP's entry on "excessive agency" makes the same point from the other side: the damage comes from giving an agent more functions, more permissions and more freedom to act unchecked than its task needs.

How it works

Sandboxing means running code inside a boundary that the operating system enforces, so that even if the code misbehaves it can only touch what it was given. Least privilege, in the definition used by the US National Institute of Standards and Technology (NIST), means limiting a user or process to the minimum access it needs for its assigned task. MXC wraps both ideas in one JSON policy format and SDK, and chooses an operating-system mechanism on each platform. Microsoft lists four backends:

Backend Platforms What it does Status
Process container Windows 11, macOS, Linux Restricts a process using AppContainer (Windows), Seatbelt (macOS) or Bubblewrap (Linux) Available
Session container Windows 11 Runs the agent under its own Windows account and session, apart from the user's desktop, clipboard, UI and input Available
WSL container (WSLc) Windows 11 Contains Linux-first toolchains Available
MicroVM Windows 11, Linux Hardware-backed virtual machine isolation Experimental

These backends build on established sandboxes. AppContainer, Microsoft's documentation says, isolates an app's credentials, devices, files, network access, processes and windows. Bubblewrap is an unprivileged Linux sandboxing tool built on kernel namespaces and used by Flatpak. The project's README also lists further backends, such as Windows Sandbox and Hyperlight, as experimental.

A policy covers five areas: the type of container; the process (command, arguments, working directory and environment); the file system (which locations the workload may change, which it may only read, and which it cannot see); the network (inbound and outbound connections, including whether it can reach services on the host's own loopback address); and the user interface (whether it can interact with the desktop). The README's Node.js example shows the shape: a request names the command to run, sets outbound network traffic to deny by default, adds a 30-second timeout and passes it to a spawn function.

Policies run in one of three modes. Enforcement applies the policy. Learning also blocks anything not granted and records it in a JSON activity report. Permissive lets ungranted operations through but records them, to help authors write a policy. Microsoft says the activity report is available only for process containers on Windows. The README describes a separate audit option for the standalone executor and warns that it turns off all sandbox security, so it must never be used on untrusted code.

Because the policy sits outside the agent, Microsoft says, neither the agent nor code it generates can grant itself more access when it hits a wall.

What a sandbox protects depends on what actually runs inside it. A write-up by GitHub's Patrick Nikoletich and Microsoft's Stuart Schaefer, published with the release, explains how GitHub Copilot uses MXC. With sandboxing on, shell commands, and by default local Model Context Protocol (MCP) servers and language servers, run inside the process boundary. Copilot's built-in file tools are checked against the policy by the agent itself, not isolated by the operating system, and remote MCP servers sit outside the local sandbox altogether.

What it means

For agent makers, MXC offers one policy format and one SDK across three operating systems, instead of a separate integration with each platform's sandbox.

For users and IT teams, the main gain is that an agent's reach becomes explicit and limited by the system rather than by the agent's good behaviour. Microsoft's planned identity work, not yet shipped, would go further: Entra would tell agent activity apart from the person's own, so a security team could restrict a compromised agent without locking out the employee.

Containment does not stop prompt injection. It limits what a tricked agent can do. An agent fooled by text hidden in a document can still misuse anything its policy grants, so a broad policy carries broad risk. The developer Simon Willison has described a "lethal trifecta": an agent that has access to private data, reads untrusted content and can communicate externally can be steered into leaking that data. Network rules are where a sandbox can break that chain, by cutting off the route out.

The Stack called the release not entirely finished, because the Intune controls organisations would use to set policy centrally are not yet available. The enterprise layers MXC connects to, Intune, Entra and Agent 365, are Microsoft's own commercial products, so the most complete version of this model runs through Microsoft's stack.

What developers can do

These steps draw on MXC's documentation and guidance from OWASP, the NCSC and NIST, and apply to any sandbox.

  1. List what the agent really needs. Write down the folders it must change, the folders it only needs to read, and the hosts it must reach. Grant those and nothing else, and start with outbound network traffic denied by default.
  2. Build policies with trusted work only. Use learning or permissive modes on tasks and code you trust, review what was blocked or recorded, then switch to enforcement. Never run untrusted code in a mode that switches the sandbox off.
  3. Keep secrets out of reach. Do not give an agent your home folder, SSH keys or cloud credentials by default. OWASP recommends giving the application its own narrowly scoped API tokens; short-lived ones limit the damage if they leak.
  4. Break the trifecta. If an agent reads untrusted content such as web pages, issues or emails, limit either its access to private data or its ability to send data out.
  5. Put authorisation outside the model. Check permissions in the systems the agent calls, not in its prompt, and ask a person to approve high-impact actions such as deployments, deletions or payments.
  6. Know what sits outside the box. Check which parts of your agent the sandbox covers. Tools inside the agent's own process, or remote services, may be checked only in software or not at all.
  7. Log and watch. The NCSC recommends logging inputs, outputs, tool use and API calls, and treating a run of failed or denied tool calls as a possible sign of attack.
  8. Pin and patch. Pin the SDK version, follow the release notes and update promptly. The first 1.0 patch already included security-relevant fixes.

What we don't know yet

Microsoft has not published dates for Intune management of process containers or for the Entra and Agent 365 identity features, beyond saying they are coming soon. The project's README does not set out a formal threat model, and we found no independent security audit or third-party escape testing of the 1.0 release. There are no published figures on performance overhead or on how many developers use MXC. It is also not yet clear when the nine named partners will ship support, or whether they will switch sandboxing on by default. The June preview supported only non-interactive session containers, and the October post does not say whether that has changed.

What to watch next

  • Management and identity: whether Intune policy for process containers and Entra-based agent identity arrive, and how much control they give administrators.
  • Partner releases: support from Claude Code, Perplexity, Manus and the other named partners, and what default policies they ship.
  • MicroVM: whether the hardware-backed backend leaves experimental status, which would matter most for agents that handle sensitive data or untrusted code.
  • Outside scrutiny: security researchers testing the boundaries, and how quickly the project ships fixes as 1.x patch releases.

Sources

SaveStart the discussion

Written by

audiotale.net team

The official account of the people who run audiotale.net: announcements, conversation starters and the newsroom's drafts. Posts written with AI say so. Every other account here is a real person.

Edited Reviewed and approved by an editor

Read next