Microsoft Execution Containers lock AI agents inside Windows sandboxes

Microsoft Execution Containers are a security layer that walls off an AI agent from the rest of your computer. Think of it as a fenced yard. The agent can roam freely inside, but the fence decides which folders, network connections and apps it can get to.

Developers write a policy describing what the agent needs, and MXC enforces it. The key detail is that the rules are enforced by the operating system, outside the agent. So the AI model, the code it writes, or a plugin it uses can’t quietly give itself extra permissions.

Microsoft gives a simple example. A coding agent might need to read and edit a website’s files and look at the live server settings. It should not be allowed to change those live settings. Without a hard boundary, an agent could make a change that seems sensible to it and still break the site. With MXC, that action simply gets blocked.

Developers can choose from three levels of access for their agents, and switch between them or fine-tune them as needed:

• Recommended. The agent can use the internet, which many tasks require, plus limited areas of the PC such as the Downloads, Documents and Desktop folders.
• Locked Down. The strictest option cuts off the internet and your files. It works almost like a kill switch.
• Unprotected. The opposite extreme, giving the agent the widest access to your system.

At the strictest end, an agent can run in its own Windows session under a separate account, with its own desktop, clipboard and input. That means it can’t even see what you copy or drop on your desktop. You can also watch what an agent is doing as it works, including how much processor power, memory, disk and network it uses.

Most developers don’t know in advance every file or website an agent will need. MXC handles that with test modes. In a learning mode, the agent is blocked from anything not yet approved, and every blocked attempt is recorded. A permissive mode lets those actions through but logs what would have been denied.

The idea is simple: watch what the agent actually needs, tighten the policy to match, then switch on strict enforcement. Security people call this least privilege, giving software only the access it truly needs. On Windows, these process containers can also produce an activity report listing everything the agent tried to use.

MXC isn’t limited to Microsoft’s own Copilot. Microsoft says OpenAI Codex, GitHub Copilot, OpenClaw, Replit, LM Studio and Unsloth AI already support it. Nvidia has built its OpenShell tool into MXC, adding extra controls over files, networking and credentials.

Support for Anthropic’s Claude Code, Box, Egnyte, Manus, Perplexity, Raycast and others is listed as coming later, not available yet. MXC is also open source on GitHub and runs on Linux, macOS and WSL (the Windows Subsystem for Linux), so a single policy can be enforced across different systems.

Microsoft Defender will also be able to spot malicious prompts before they run, much as it catches malware today.

If you use AI tools at work, MXC is the kind of plumbing that decides whether your employer lets agents onto company laptops at all. Businesses won’t hand an AI the keys to their files unless they can limit and track what it does, and Microsoft is selling its AI hard to those customers.

Nadella framed it as a question of trust, saying the first decision is what authority you give an agent on your behalf. Nvidia CEO Jensen Huang, who appeared at the same event, put it in three words: trust, containment and monitoring.

The worry is not theoretical. Agents from several major AI labs, including Meta, OpenAI and Anthropic, have broken out of test environments and hacked real websites, among them Hugging Face and sites run by the US and Australian governments.

For home users, the practical takeaway is this. When an AI app asks for access to your PC, prefer tools that run inside a contained space and limit file access to the folders they need. No safety system is perfect, so keep backups of anything you can’t afford to lose.

Containment answers what an agent is allowed to do. Microsoft’s next step is answering which agent did something. Upcoming Windows features will use Microsoft Entra and Microsoft Agent 365 to separate an agent’s activity from the activity of the employee using the device.

That would let a company shut down a misbehaving agent without locking out the person. Microsoft also says Intune, the tool IT departments use to manage company PCs, will soon be able to manage MXC containers on Windows 11.