Microsoft Execution Containers reach GA for AI agents

Microsoft takes its agent sandbox to general availability

Microsoft said on 7 October 2026 that Microsoft Execution Containers (MXC) is now generally available, in a Windows Developer Blog post by Logan Iyer, the company's corporate vice president for Windows Platform and Developer. MXC is an open source sandbox that runs an AI agent's untrusted code, such as model output, plugins or tools, inside a boundary the agent cannot widen itself. Microsoft first showed the project at its Build conference in April 2026 and kept the code open on GitHub for months before this week's GA announcement.

Microsoft Execution Containers (MXC) is a policy-driven execution layer that runs an AI agent's untrusted code, such as model-generated output, plugins or tools, inside an OS-enforced sandbox on Windows, macOS or Linux. Developers declare which files and network destinations a workload may use, and MXC enforces that boundary independently of the agent itself.

What changed

• MXC reached general availability on 7 October 2026. The MIT-licensed code has sat on GitHub at microsoft/mxc since Build 2026, and the project tagged its first stable SDK release, v1.0.0, on the same day as the GA announcement.

• The SDK ships for Rust, .NET and Node, published as mxc-sdk on crates.io, Microsoft.Mxc.Sdk on NuGet and @microsoft/mxc-sdk on npm. A developer adds the SDK to an app, then specifies a container type, a set of containment rules and the workload command; MXC picks the matching backend and launches the workload inside it.

• Four containment backends map to the host operating system: process container (Windows 11, macOS and Linux, via AppContainer, Seatbelt or Bubblewrap), session container (Windows 11 only, an OS-isolated session with its own desktop, clipboard, UI and input boundaries), WSL container (Windows 11 only, for Linux-first toolchains) and MicroVM (Windows 11 and Linux, marked experimental, with hardware-backed isolation).

  

• A policy covers five areas: the containment type, process settings, filesystem access, network access and UI access. MXC runs in one of three modes: Enforcement blocks anything outside the policy, Learning blocks a denied attempt and records it in a JSON activity report, and Permissive records a denial but lets the workload continue, which Microsoft recommends for authoring a new policy before switching it to Enforcement.

• Windows 365 support for MXC is generally available too, so the same containment policy runs an agent on a local device or on a Cloud PC.

• GitHub Copilot, OpenClaw, OpenAI Codex, Replit, LM Studio and Unsloth AI already integrate MXC. Microsoft lists Claude Code, Box, Egnyte, Heidi Health, Hermes Agent by Nous Research, Manus, Perplexity, Raycast and Simular as adding support next. NVIDIA built its OpenShell agent on MXC and layered in its own controls for inference-service access, network rules, credential management and OCSF audit logging for enterprise deployments.

  

Why it matters for agent builders

MXC targets the exact failure mode that shows up when an agent gets more authority than a task needs. Microsoft's own example: a coding agent asked to update a website needs read and write access to the repository and its development tools, and may need to read the production server configuration to understand how the app deploys, but it should not be able to change that configuration. Without a boundary enforced outside the agent, the model can decide that editing the server config is the fastest way to finish the task, and nothing stops it.

For MCP server and skill builders, this maps directly onto tool execution. A tool call, a sampled completion or a server's own generated code can run inside a sandbox the agent cannot widen itself, so a compromised or confused tool call stays inside the file and network limits set when the workload was built rather than whatever the model decides at runtime. Because the policy sits outside the agent's control by design, an overly narrow policy is the failure developers will hit first; Learning and Permissive modes exist so a team can run the real workload once, read the resulting access-denied report, and grant only what it actually used.

What to watch

Two pieces Microsoft describes as coming are not shipped yet. Intune management policy, which IT administrators would use to apply or override an MXC process container's rules across an organization, is not available at GA; Microsoft says only that it is coming soon, with no date given. The planned Microsoft Entra agent identity feature, meant to let security teams tell an agent's actions apart from the signed-in user's inside Microsoft Agent 365, is also still unreleased. Until both land, MXC secures what a single agent can touch on one machine, but an organization still cannot fully attribute or govern a fleet of agents running across many devices.

Key takeaways

• Microsoft Execution Containers (MXC) reached general availability on 7 October 2026, after being open source on GitHub since Build 2026 in April.
• MXC offers four containment backends (process container, session container, WSL container and MicroVM) and three operating modes (Enforcement, Learning and Permissive).
• GitHub Copilot, OpenClaw, OpenAI Codex, Replit, LM Studio and Unsloth AI integrate MXC today; Claude Code, Manus, Perplexity and others are listed as coming.
• Organization-wide controls, Intune policy for MXC containers and Microsoft Entra agent identity, are not yet shipped.
• The SDK is available for Rust, .NET and Node, with its first stable release, v1.0.0, tagged on 7 October 2026.

FAQ

What is Microsoft Execution Containers (MXC)?

MXC is an open source, policy-driven sandbox that runs an AI agent's untrusted code, such as model output, plugins or tools, inside an OS-enforced boundary on Windows, macOS or Linux. Developers declare which files and network destinations a workload may use, and MXC enforces that boundary at runtime regardless of what the agent or its generated code decides to do.

Which AI agents and tools support MXC today?

GitHub Copilot, OpenClaw, OpenAI Codex, Replit, LM Studio and Unsloth AI already integrate MXC, and NVIDIA built its OpenShell agent on it. Microsoft says Claude Code, Box, Egnyte, Heidi Health, Hermes Agent by Nous Research, Manus, Perplexity, Raycast and Simular are adding support next.

Is MXC free and open source?

Yes. The MXC code is MIT-licensed and hosted at github.com/microsoft/mxc, where it has been publicly available since Microsoft first showed the project at its Build conference in April 2026. The SDKs are free packages on crates.io, NuGet and npm.

Source: Windows Developer Blog

Discussion: Hacker News

Developers comparing sandboxing options against an MCP server's own permission model can browse the MCP servers directory on aiagentslisting.com.