Microsoft Execution Containers (MXC)

OS-level containment for AI agents on Windows, letting admins define and enforce at runtime which files and networks an agent can access.

Microsoft · Security and safety tooling · security

Published in Feed

Overview

Microsoft announced general availability of Microsoft Execution Containers (MXC) at its Windows AI and Surface event in San Francisco on October 7, 2026. MXC is OS-level infrastructure that lets agents run safely and persistently in the background under operating system control, with organizations defining which files and networks an agent can access and those policies enforced at runtime. It ships with multiple containment backends, including process containers available across Windows 11, macOS, and Linux, plus Windows-exclusive options such as session containers, WSL containers, and MicroVMs.

This is a sourced directory entry. Features and capabilities are reported in the linked sources; this entry does not document independent Aymorphic testing.

Key features

  • Runtime-enforced policies for agent file and network access
  • Multiple containment backends: process containers (Windows 11, macOS, Linux)
  • Windows-exclusive backends: session containers, WSL containers, MicroVMs
  • Designed for agents running persistently in the background under OS control
  • Partner support planned from OpenAI, Anthropic, and Nvidia

Use cases

  • Sandboxing autonomous coding or desktop agents on enterprise Windows fleets
  • Enforcing least-privilege file/network access for background AI agents
  • Running untrusted or third-party agents with OS-level containment instead of app-level trust

Pricing

Included as OS-level Windows 11 infrastructure; no separate fee disclosed at GA.

Pricing reflects the source record and may change. Confirm current terms with the provider.

Dates and sources

Released
7 Oct 2026
Record updated
10 Oct 2026
Record last checked
10 Oct 2026

Explore the Feed

Other entries filed under security and safety tooling; inclusion does not imply equivalent features.

  • DefenseClaw Edge Connector

    Cisco's open-source DefenseClaw gains an Edge Connector that allows or blocks AI agent tool calls directly on IoT and robot hardware.

  • Lakera Guard 2.0

    Lakera's real-time guardrail API for LLM apps, updated with multi-agent protection and a new benchmark for detecting indirect prompt injection in tool outputs.

  • Fleming-1

    Sierra's model that listens to a live phone call and scores whether the caller is an AI agent rather than a human.

Browse the Feed