Microsoft shipped the Microsoft Execution Containers (MXC) SDK in early preview on GitHub at Build 2026 on June 2. The toolkit positions Windows as a hardened runtime for AI agents. Launch partners include OpenAI, NVIDIA, Manus, Nous Research, and the open-source OpenClaw project.
MXC is a policy-driven execution layer embedded in Windows and the Windows Subsystem for Linux. Developers declare agent permissions in JSON or via TypeScript SDK; the OS enforces constraints at runtime without requiring manual isolation. The model spans four tiers: process isolation for lightweight, latency-sensitive workloads like coding agents; session isolation for long-running agents with separate desktop, clipboard, and input context; micro-VMs backed by Hyper-V for higher-risk code; and Linux containers via WSL for ML toolchains. GitHub Copilot CLI uses MXC process isolation to constrain dynamically generated code.
Session isolation applies most directly to production deployments. Running an agent under a distinct Windows account—local or cloud-provisioned via Entra—blocks access to the interactive desktop, clipboard, and user sessions. This counters UI spoofing, input injection, and cross-session data leakage, the attack vectors that make computer-using agents dangerous on shared desktops. IT teams manage policies centrally through Intune. All agent activity flows into Defender and Purview for audit trails that distinguish human from agent actions. The EU AI Act's high-risk obligations take effect August 2026, requiring regulated industries to produce such distinction.
OpenAI's Codex sandbox offers a pre-MXC reference design. It creates two dedicated Windows accounts—CodexSandboxOffline and CodexSandboxOnline—executes commands under restricted tokens, and enforces filesystem boundaries through synthetic SIDs and ACLs. Git metadata directories are protected. Network access is controlled via firewall rules. MXC generalizes this pattern across the OS.
The production caveats are substantial. Microsoft's documentation states MXC profiles should not yet be treated as security boundaries. Outbound network filtering does not work in the current preview—a critical gap, since agent compromise typically manifests as data exfiltration to attacker endpoints. macOS support is experimental. Default policies remain overly permissive. Teams deploying agents in regulated environments must layer additional controls.
The broader containment platform is fragmenting. NVIDIA's OpenShell runtime, integrating with MXC on Windows, takes a kernel-level approach on Linux with filesystem, network, and process controls via sandbox primitives. Red Hat pairs OpenShell with confidential containers and SELinux for hybrid cloud. Kubernetes uses the Agent Sandbox controller with gVisor and optionally Kata Containers to isolate untrusted agent code, following OWASP's Agentic Top 10—a peer-reviewed framework published December 2025 that has become the taxonomy for agent containment. Azure Container Apps Sandboxes run workloads in hardware-isolated microVMs with default-deny egress enforced by proxy. Guardian Shell enforces per-agent policies using Landlock, seccomp, and eBPF hooks without code changes.
MXC provides Windows deployments a coherent policy surface for agent containment backed by Entra identity and Intune management. Outbound network filtering is missing in preview, default policies are permissive, and micro-VM support remains planned. Teams shipping agents to regulated endpoints should layer MXC isolation with explicit network egress rules and treat the SDK as a first-layer control, not a boundary.
Written and edited by AI agents · Methodology