SNACK: 3-line summary
- Microsoft Execution Containers (MXC) is generally available, enforcing resource policies set outside an AI agent’s control.
- Process containers support Windows 11, macOS, and Linux; session and WSL containers are Windows 11-only, while MicroVM is experimental on Windows 11 and Linux.
- In Windows process containers, Learning blocks and logs ungranted access; Permissive logs it but lets it proceed.
Microsoft announced the general availability of Microsoft Execution Containers (MXC) on October 7, 2026. Developers and IT teams can use it to let agents work in a project repository while keeping unrelated files or network destinations out of reach. These are boundaries they configure, not restrictions automatically applied to every Windows AI app.
Snackgirls react
AIKO: I like that the agent cannot approve its own request for more access. Self-service permission upgrades are a feature I can do without.
Nea: I’d be curious to see whether Learning mode blocks a file a build tool genuinely needs. That could reveal a dependency I hadn’t noticed in the project.
An agent can edit the repository, not its own permissions
A unified JSON configuration schema and multi-language SDK let developers use MXC to contain generated code, individual tools, or an entire agent. File, network, and desktop permissions are defined outside that workload, so it cannot grant itself broader access.
Microsoft illustrates the distinction with a hypothetical website update: a coding agent can read and write the repository and use the required build tools, while production server configuration remains read-only. If the agent tries to edit that configuration to finish faster, the containment environment is designed to deny the change.
Microsoft lists GitHub Copilot, OpenAI Codex, and Replit among agents and frameworks that already support MXC. Claude Code and Hermes Agent are among those with support planned.
Windows, macOS, and Linux do not get the same backends
Process containers are available on Windows 11, macOS, and Linux. They use each platform’s process sandbox: AppContainer on Windows, Seatbelt on macOS, and Bubblewrap on Linux.
Session containers give an agent a separate Windows account and session, isolating its desktop, clipboard, and input from the interactive user. WSL containers provide a Linux execution environment. Both backends are available only on Windows 11.
The hardware-backed MicroVM backend is experimental on Windows 11 and Linux, and is not available on macOS. Windows 365 support for MXC is generally available, allowing agents to run alongside existing work on Cloud PCs. The backends have different security properties, so developers still need to evaluate which fits their workload.
Learning blocks ungranted access; Permissive allows it
Enforcement blocks operations the policy has not granted, without producing an activity report. Learning also blocks them but records the attempted access in a JSON report. These activity reports are available only for Windows process containers.
Permissive records access the policy would deny but lets the operation continue, making it an observation mode for policy authoring rather than equivalent protection. It does not override other operating-system or organizational restrictions. Developers need to review, test, and refine the policy to grant the resources legitimate tasks require without unnecessarily expanding access.
Microsoft says Intune management policies for MXC process containers on Windows 11 are coming soon. Entra-based attribution that distinguishes agent activity from user activity, along with Agent 365 controls for on-device agents, is also still to come.
Sources and checked date: October 12, 2026
Comments
0No login needed. Edit or delete your comment from the same browser.
All comments 0
한국어 · English · 日本語No comments yet. Start the conversation.