Windows 11 now tags agent processes and isolates them

Microsoft shipped the KB5120998 preview update for Windows 11 on August 27, and buried under the taskbar tweaks is the thing that matters: Windows now tags agentic processes at the OS level. An opaque agent identifier goes on the process token, the system protects it, and it flows to every child process. Agent identity stopped being an application concern.

What actually happened

Per Microsoft's KB5120998 release notes — builds 26100.9278 and 26200.9278, for Windows 11 24H2 and 25H2 — the update "introduces preview platform support for tagging agentic processes. Authorized components can assign an opaque agent identifier to a process token." Windows protects the marking and passes it automatically to child processes.

The identifier does not stop at the process boundary. When an agentic process authenticates through Web Account Manager, WAM includes the agent identifier from the process token in the authentication request. The token your agent gets is now stamped with what it is.

The same update adds Process Isolation for Microsoft Execution Containers — MXC — described as a fast, lightweight boundary for workloads like coding agents and model-generated code. It restricts file, network, UI, and operating-system access by policy. Both features ship as preview, and Microsoft notes the identifier format may change.

Why OS-level agent identity matters for your business

This is the missing half of every agent permission system you have built. Your allowlists, your hooks, your MCP scopes — all of them live inside the agent's own process, which is exactly the thing an attacker is trying to steer. A token marking the OS enforces and children inherit does not negotiate.

Auth is where it pays off. Today, an agent calling your internal API presents the same credential a human does. Once WAM carries the agent identifier into the auth request, your identity provider can tell the difference — and you can write a policy that says this scope is human-only. That is a conditional access rule, not a code review.

MXC is a real answer to "the agent ran a command." Model-generated code executing inside a policy-bounded container beats a permission prompt that a prompt injection can talk its way past. Preview means do not bet production on it this quarter. It does mean planning for a world where "which agent did this" is answerable from the process token instead of a log you hope somebody wrote.

Sources: Microsoft KB5120998, BleepingComputer.