Windows 11 Execution Containers, or MXC, are a built-in way to fence AI agents inside strict rules about which files, apps and network connections they can touch. Microsoft announced the push at its October 7 Windows and Surface event, and it matters because agents can now act on your PC, not just chat.
Think of it as a locked room for an agent. The agent can work inside the room, but it can’t wander into your Documents folder unless the rules allow it.
Here are the facts worth knowing first:
- MXC is an SDK plus policy system built into Windows 11 and WSL, open-sourced under the MIT license.
- It was first shown at Build on June 2, 2026, and was announced at the October 7 event, per Gadget Pilipinas.
- Developers and IT admins set the rules. Regular users don’t switch it on.
- GitHub Copilot, OpenAI Codex, OpenClaw, Replit and LM Studio already support it.
The short version: you won’t see a toggle, but the AI apps you install may soon run inside one of these boxes.
Why Windows 11 Execution Containers exist
AI agents are different from old apps. They read files, run commands and browse the web on your behalf, and they can be tricked by a malicious web page or document. That’s called prompt injection, and we covered one defense in our look at Nvidia’s NXDirection.
MXC takes a different approach. Instead of hoping the agent behaves, Windows enforces limits from outside. As Pureinfotech puts it, the policy sits outside the agent, so the agent can’t give itself more permissions.
That matters after incidents like the ones in our piece on OpenAI’s rogue agent cases. A sandbox limits the damage when something goes wrong.
What an agent can and can’t do inside a container
A developer or admin writes a policy covering four areas: files, network, processes and desktop access. Files can be read-only or read/write, and network traffic can be limited by destination.
There are also three modes. Enforcement blocks anything outside the policy. Learning blocks it and logs it. Permissive allows it but records what would have been blocked, which helps developers tune their rules.
In a demo reported by VentureBeat, the OpenClaw agent running inside MXC couldn’t delete the developer’s desktop files. That’s exactly the point.
The four container types, side by side
Microsoft offers a range of isolation levels so the strength of the box matches the risk of the job:
| Container type | What it does | Best for |
|---|---|---|
| Process container | Lightweight isolation using AppContainer on Windows 11 | Everyday coding agents |
| Session container | Runs the agent in its own Windows session, with separate desktop, clipboard and input | Agents that click and type |
| WSL container | Isolates Linux-based agent tools using WSL | Linux-first developer tools |
| MicroVM (experimental) | Hardware-enforced isolation | Higher-risk workloads |
Stronger isolation usually means more setup. A simple coding helper rarely needs a micro-VM, while an agent that controls a full desktop probably does.
Which AI apps support MXC today
Support depends on each app’s developer. Reports list GitHub Copilot, OpenAI Codex, OpenClaw, Replit, LM Studio, Nvidia OpenShell and Unsloth AI as already integrated.
Announced but not dated: Anthropic’s Claude Code, Perplexity, Raycast, Box, Manus and Nous Research’s Hermes agent. If an app isn’t on the list, don’t assume it’s sandboxed.
Companies get extra control through Agent 365, Microsoft Entra and Intune. Each agent gets its own identity, so an admin can cut off a hijacked agent without locking out the person using it.
What MXC does not fix
Microsoft itself describes containment as one layer, not a cure-all. A badly written policy can leave gaps, and an overly strict one can stop an agent from finishing its task.
Also note that sources differ on how finished the feature is. Some reports call it generally available, while VentureBeat’s June coverage described an early preview. Microsoft hasn’t published specific Windows 11 build numbers in the reports we found, so check the official docs before relying on it in production.
Frequently Asked Questions
What are Windows 11 Execution Containers?
They are an OS-level sandbox for AI agents. Windows enforces rules about files, network and processes from outside the agent itself.
Do I need to turn MXC on?
No. Developers and admins configure it, and it runs behind the scenes inside supporting AI apps.
Is MXC the same as Windows Sandbox?
No. Windows Sandbox is a throwaway desktop for you to test software. MXC is a policy framework built for agents and other untrusted workloads.
Does it make AI agents completely safe?
No. It reduces the damage an agent can do, but it relies on the app supporting MXC and on a well-written policy.
Which Windows version do I need?
Microsoft hasn’t given clear build numbers in the coverage we found. Process, session, WSL and micro-VM options are Windows 11 features, and the micro-VM option is still experimental.
My take: this is the most practical Windows security move for the AI era so far, and it’s smart that it lives in the OS instead of inside each app. But it only helps if apps adopt it. Until your favorite agent is on the supported list, give it access to a test folder, not your whole drive. If you’re moving to a new PC soon, our Windows 11 cloud rebuild guide is a handy companion for starting clean.
Leave a Reply