Pull to refresh
Logo
What Changed
Following Why Sign Up
Microsoft makes execution containers for AI agents generally available

Microsoft makes execution containers for AI agents generally available

New Capabilities

Microsoft adds task-level permissions and human approval to its OS-level containment layer for AI agents

October 19th, 2026: Microsoft introduces Dynamic Permissions for AI agents

Overview

Updated Oct 20

Microsoft's Execution Containers (MXC) have been generally available on Windows 11 since October 7. The layer limits which files and networks an AI agent can reach, and Windows enforces those limits while the agent runs.

On October 19, Microsoft announced Dynamic Permissions, an organization-wide policy meant to stop an agent from getting authority its user does not have. The company also said a risky agent action can require human approval. Intune policy for MXC containers and Entra identity separation remain listed as coming soon, with no date.

Why it matters

Enterprises can delegate sensitive work to agents without handing them the full authority of the signed-in employee.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

137B
Parameters in MAI Code 1.1 Flash
Coding model running locally on PCs; 6.8 billion active parameters in 3-bit precision.
7
AI agents supporting MXC at launch
Codex, GitHub Copilot, OpenClaw, Replit, LM Studio, OpenShell, and Unsloth AI.
4
Containment backends
Process, session, WSL, and experimental microVM isolation on Windows 11.
256K
Local context window
Tokens of context supported locally by MAI Code 1.1 Flash.

Voices

Curated perspectives — historical figures and your fellow readers.

Sign up to generate historical perspectives on this story.

Log in Sign Up

People Involved

Logan Iyer
Logan Iyer
Corporate vice president for Windows Platform and Developer at Microsoft
Leading the MXC general availability launch

Organizations Involved

Microsoft
Microsoft
Technology company
Released MXC generally available on Windows 11; announced Dynamic Permissions for agents on October 19

Makes Windows 11, the MXC containment system, and the MAI Code local model; on October 19 it announced Dynamic Permissions for AI agents.
OpenAI
OpenAI
Artificial intelligence company
Codex agent supports MXC at general availability

Its Codex coding agent runs inside MXC containers at launch.
Anthropic
Anthropic
AI company
Plans Claude Code MXC support

Its Claude Code agent will add MXC support, according to Microsoft.

Timeline

2026 October 2026

6 events Latest: October 19th, 2026 · 3 weeks ago
Tap a bar to jump to that date

  1. Microsoft introduces Dynamic Permissions for AI agents

    Latest Security

    Microsoft said organization-wide policy sets an outer boundary so an agent cannot obtain authority its user lacks. The company also said a risky agent action can require human approval.

  2. MXC GitHub code still marked 'early preview' with permissiveness warning

    Guidance

    Microsoft's public microsoft/mxc repository remained labeled "early preview" as of October 9 and warns that current policies can be too permissive, advising against treating MXC as a security boundary. The warning stands apart from MXC's GA status on Windows 11.

  3. MXC generally available on Windows 11

    Product Release

    Containment layer for AI agents goes live on Windows 11 with process, session, WSL, and experimental microVM backends. Codex, GitHub Copilot, and five other agents added support.

  4. MAI Code 1.1 Flash and RTX Spark PCs announced

    Product Release

    Microsoft said MAI Code 1.1 Flash runs locally in 3-bit precision and opened pre-orders for Surface and NVIDIA RTX Spark systems.

  5. GitHub enables local sandboxing for Copilot

    Product Release

    GitHub switched on local sandboxing for Copilot CLI, the Copilot app, and VS Code on the same day MXC went GA, using MXC process containers.

  6. MXC and WSL 3 unveiled at Microsoft Build

    Announcement

    Microsoft previewed Execution Containers and the WSL 3 update for developers at its annual conference.

Scenarios

1

Intune management for MXC ships, cementing enterprise rollout

Likely Resolves by Q1 2027

Discussed by: Microsoft's Windows developer and experience blogs

Microsoft says Intune policy for MXC process containers will be available 'soon,' giving IT control over how Windows evaluates container creation requests and which boundaries get enforced. If that ships alongside Agent 365 local controls and Entra identity separation, MXC becomes the managed default for enterprise agents on Windows.

2

Claude Code and listed partners ship MXC support

Possible Resolves by End of 2027

Discussed by: Windows Experience Blog list of upcoming adopters

Nine agents were named as coming to MXC, led by Anthropic's Claude Code, with Box, Egnyte, Manus, Perplexity, and Raycast among the others. If even the marquee names ship production support, the containment layer gains cross-vendor traction rather than staying Microsoft-only.

3

Rivals launch competing agent containment standards

Uncertain Resolves by End of 2027

Discussed by: Industry observers tracking agent sandboxing

MXC's process backend works on macOS and Linux, but its flagship session, WSL, and microVM backends are Windows-only. If Apple or Google ships its own agent policy framework, the containment market fragments instead of consolidating on Microsoft's JSON schema.

4

MXC default policies stay too permissive for security teams

Possible Resolves by End of 2026

Discussed by: Made With Models review of the public MXC repository

The public microsoft/mxc repository warns current policies can be too permissive and shouldn't be treated as a security boundary. If Microsoft's default policy schema doesn't tighten, enterprises may treat MXC as an access-control convenience rather than a hard boundary, which would slow adoption for the most sensitive workloads.

5

Dynamic Permissions becomes the enforced ceiling on agent authority

Possible Resolves by Jan 31, 2027

Discussed by: Microsoft Security Blog

Microsoft said organization-wide policy sets an outer boundary and prevents an agent from obtaining authority its user does not have. The announcement did not give a ship date or say how the control will be enforced across Agent 365.

Historical Context

3 moments from history that rhyme with this story — and how they unfolded.

September 2008

Chrome's sandbox (2008)

Google launched Chrome with every tab, plugin, and renderer running inside a restricted OS sandbox, so a compromised web page couldn't read the rest of the machine.

Then

Chrome's isolation model set a new security baseline for browsers.

Now

Every major browser adopted sandboxing; it became the default way to run untrusted third-party code.

Why this matters now

MXC applies the same principle to AI-generated code: run untrusted workloads behind OS-enforced boundaries instead of trusting them.

July 2008

iOS App Sandbox (2008)

Apple required every third-party iPhone app to run in its own sandbox with declared entitlements describing what it could access.

Then

Developers declared capabilities up front and the OS enforced them.

Now

The pattern of declared permissions plus platform enforcement became standard in mobile and desktop OSes.

Why this matters now

MXC is a direct descendant: developers declare which resources an agent may use, and the OS enforces that boundary.

March 2013

Docker (2013)

Docker popularized OS-level containers, letting developers package and run applications in isolated user-space environments with a standard toolchain.

Then

Containerization became the default way to ship and scale cloud software.

Now

The tooling normalized the idea of isolating workloads, but left policy definition to operators.

Why this matters now

MXC reuses container isolation but adds a policy layer written for AI agents, declaring resource boundaries in JSON rather than packaging entire applications.

Sources

(16)
+10
Windows Experience Blog Neowin Aivio News GitHub The D*AI*LY Brief IT Connect Tech Made With Models eSecurity Planet Technspire SC World CRN Microsoft Security Blog The Official Microsoft Blog SiliconANGLE Storyboard18 Windows Developer Blog