Microsoft Execution Containers (MXC) is a Windows security layer that boxes in AI agents, so they can only touch the files, apps and network connections you or your IT admin allow. If you plan to let an AI agent run on your PC, this is the safety net Microsoft is building underneath it.
Microsoft first showed MXC at Build on June 2, 2026, then pushed it further in an October 7 announcement. Here is what it does and what it means for you.
Here are the facts worth knowing first.
- MXC is a policy-based sandbox built into Windows 11 and WSL, not an app you download.
- Developers add it through an SDK; admins can layer extra limits with management policies.
- GitHub Copilot, OpenAI Codex, OpenClaw, Replit and LM Studio already support it, per Pureinfotech.
- Windows 365 Cloud PCs get generally available MXC support; MicroVM isolation is still experimental.
Think of it as a seatbelt, not a force field. It limits the damage a misbehaving agent can do.
Why Windows needed an AI agent sandbox
AI agents don’t just chat. They open files, run commands and click through apps for you. That is useful until one misreads an instruction and deletes the wrong folder.
Until now, most agents ran with whatever permissions your account already had. That is a lot of trust to hand over to software that can be tricked by a hidden instruction on a web page.
In a demo covered by VentureBeat, a Microsoft developer told the OpenClaw agent to wipe his desktop files while it ran inside MXC. The sandbox blocked the deletion. That is the whole idea in one example.
How Microsoft Execution Containers actually work
The key detail is where the rules live. The policy sits outside the agent, so the agent can’t give itself more permissions, even if it is tricked into trying.
A developer or admin lists what the workload needs: which folders it can read, whether it can reach the internet, which processes it can start, and whether it can see your desktop. Windows then enforces that list while the agent runs.
There are also three policy modes, which help developers tune the rules without breaking their app.
- Enforcement: blocks anything outside the policy.
- Learning: records what the agent tried to do and was blocked from doing.
- Permissive: logs what would have been blocked, but lets it happen.
Learning and permissive modes mean a developer can start loose and tighten up step by step.
Four levels of isolation, from light to heavy
Not every agent needs the same cage. MXC offers several containment types, and the right one depends on how risky the job is.
| Containment type | What it does | Where it runs |
|---|---|---|
| Process container | Locks one process down using AppContainer | Windows 11 (also macOS, Linux) |
| Session container | Runs the agent in a separate Windows session, away from your desktop and clipboard | Windows 11 |
| WSL container | Contains Linux-based agent tools | Windows 11 with WSL |
| MicroVM | Hardware-enforced isolation, still experimental | Windows 11 and Linux |
Session isolation is the interesting one. It keeps an agent away from your screen, keyboard input and clipboard, which helps stop it from spying on or faking what you see.
What MXC means for you on Windows 11
Here is the honest part: you probably won’t see an MXC switch in Settings. Protection depends on whether the AI apps you use have adopted it.
So when you pick an agent, check whether it supports MXC. Anthropic’s Claude Code, Perplexity, Manus, Box and Raycast are listed as coming soon, according to Pureinfotech. Support from any given app can change, so check its release notes.
There is a trade-off too. If MXC blocks something an agent needs, the task can simply fail. That is annoying, but it is the system doing its job.
MXC also isn’t Windows Sandbox. Windows Sandbox gives you a throwaway desktop. MXC gives one app a tight boundary while you keep working normally.
It fits a wider shift too. Other tools are tackling the same trust problem from different angles, like 1Password for Agents, which covers how AI agents handle your logins. And if you want the broader Windows picture, our look at the October 2026 Windows 11 update covers what else changed.
Limits you should know about
MXC is only as strong as its rules. VentureBeat noted that writing good policies for complex company setups is a new skill nobody has fully figured out yet.
The coverage also leans heavily on Microsoft’s own briefing, with little independent testing so far. Treat the security claims as promising, not proven.
And MXC doesn’t replace good habits. An agent inside a box can still do harm with the access you do give it, like sending an email from your account.
Frequently Asked Questions
Do I need to turn on Microsoft Execution Containers?
No. You don’t normally configure it yourself. An AI app that supports MXC applies it in the background, and admins can add extra rules.
Is MXC the same as Windows Sandbox?
No. Windows Sandbox is a disposable desktop you open yourself. MXC wraps a single agent or app in a policy-enforced boundary.
Which AI agents support it today?
GitHub Copilot, OpenAI Codex, OpenClaw, Replit, LM Studio and Unsloth AI are listed as supporting MXC. More are expected to follow.
Does MXC make AI agents completely safe?
No. Microsoft pitches it as one layer next to identity and device management. A well-written policy helps, but a loose one won’t.
My take: if you are going to let an agent touch your files, pick one that runs inside MXC and keep its permissions narrow. A sandbox you never configure well is just a false sense of safety, so give each agent only the folders it truly needs.
Leave a Reply