Microsoft Execution Containers GA: sandbox your AI agents

Most small teams run coding agents with the same access as the person at the keyboard. Every file, every saved login, the whole network. Today Microsoft made the alternative official: Microsoft Execution Containers (MXC) is generally available on Windows 11. An agent declares what it needs, the OS enforces the boundary, and the agent cannot widen it. We covered the preview in August. Now it ships.

What actually happened

At its San Francisco event with NVIDIA on October 7, Microsoft announced MXC general availability next to new RTX Spark PCs. TechCrunch reports Satya Nadella said the feature will reach all Windows 11 users and works for any developer's agent, not only Microsoft's.

The Windows Developer Blog has the details:

• Four containment types. Process containers run on Windows 11, macOS, and Linux (AppContainer, Seatbelt, and Bubblewrap under the hood). Session containers give an agent its own Windows account, desktop, clipboard, and input; they are Windows 11 only. There are also WSL containers and experimental MicroVMs.
• Policy lives outside the agent. Developers define file system, network, process, and UI rules in a JSON schema through the MXC SDK. Microsoft says the policy "remains outside the agent workload's control." Generated code cannot grant itself more access.
• Supported now: OpenAI Codex, GitHub Copilot, OpenClaw, Replit, LM Studio, and Unsloth AI. NVIDIA integrated OpenShell.
• Coming: Anthropic Claude Code, Box, Egnyte, Manus, Perplexity, Raycast, and others.
• Not here yet: Intune management of process containers and Entra separation of agent activity from user activity are both "soon."

The SDK, schema, and samples are on GitHub.

Why it matters for your business

An agent with your access is a liability. A coding agent that reads a poisoned README or a malicious package can do anything you can do. A container that allows only the project folder and three domains limits the damage to that folder.

Make it a buying question. Before your team adopts an agent tool, ask if it supports MXC. Six major agents already do. A vendor with no plan to support it is telling you something.

Do not wait for Intune. The fleet-wide controls are not ready. On a five-person team, you can still pick tools that support MXC now and keep agents off the machines that hold payroll and banking logins.

If you build agents, write the policy now. If your internal tools or client agents run on Windows, define the folders and endpoints they actually need. That list is useful documentation even before you enforce it.

Sources: Windows Developer Blog, TechCrunch.