Skip to content

Microsoft Execution Containers reach general availability

MXC lets Windows apps sandbox what an AI agent can touch at runtime (files, network, UI) with support already shipping in GitHub Copilot and OpenAI Codex.

Source: Windows Developer Blog

Microsoft announced on 7 October that Microsoft Execution Containers (MXC) are now generally available, alongside support in Windows 365. MXC is a policy-driven layer for containing untrusted or model-generated code: a developer declares which files, network destinations and UI surfaces an agent can touch, and MXC enforces that at runtime, outside the agent’s own control.

There are four containment backends. Process containers run on Windows 11, macOS and Linux. Session containers, Windows 11 only, give an agent its own isolated desktop, clipboard and input. WSL containers run a Linux environment under Windows 11. An experimental MicroVM backend adds hardware-backed virtualization on Windows and Linux. Policies can run in Enforcement, Learning, or Permissive mode, the last two useful for working out what an agent actually needs before locking it down.

GitHub Copilot, OpenAI Codex, Replit, LM Studio and Nvidia’s OpenShell already support MXC; Anthropic’s Claude Code, Box, Perplexity and others have announced support is coming. Microsoft says Entra and Intune integration is next.

Why it matters: if you ship or operate a coding agent on Windows, this is a standard containment layer to build against instead of rolling your own sandboxing per agent. The isolation modes map directly onto that classic agent-safety question — what can this thing actually reach — rather than leaving it to the agent’s own judgement.

Share

Related reading

ML for Web Devs

Machine learning for web developers: the only mental model you need

You do not need calculus to work with models. You need one idea, that a model is a function you fit instead of write, and the rest follows from things you already know.

ML for Web Devs

What an embedding actually is

An embedding is a list of numbers that puts similar things near each other. That one sentence is enough to build search, recommendations and retrieval. Here is how.

ML for Web Devs

Tokens, context windows, and why your bill is what it is

The unit of billing for language models is not the request or the word. Once you understand tokens and how a context window fills up, the invoice stops being a surprise.

More from The Wire

All briefs

Anthropic cuts distillation attacks on Claude by up to 99%

New safeguards, including a reasoning classifier and stricter account limits, now block most attempts to copy Claude by training on its output. Blocked requests in high-confidence cases are billed, and some integrations may need updating.

via Anthropic