Microsoft has released version 1.0.0 of its Execution Containers (MXC) platform, introducing a policy-driven layer designed to isolate AI agents and other untrusted workloads. The general availability announcement, published by the company on Tuesday, details how MXC enforces boundaries that restrict what agents can access while they perform tasks.

The platform addresses a growing challenge: agents that automate work across files, networks, and applications can inadvertently create security gaps. Without safeguards, organizations face a trade-off between granting agents full system access — risking data exposure — or blocking them entirely, which sacrifices productivity gains. MXC aims to resolve this by defining controlled execution environments where agents operate within predefined limits.

At its core, MXC uses declarative policies to specify which resources an agent may use, such as specific files or network endpoints. These policies are enforced independently of the agent itself, preventing unauthorized actions even if the agent attempts to exceed its intended scope. For example, a coding agent tasked with updating a website would be allowed to modify source code but blocked from altering server configurations unless explicitly permitted.

Multiple containment backends support different isolation needs. Process containers operate across Windows, macOS, and Linux for lightweight workloads, while session containers — available only on Windows 11 — provide desktop-level separation for long-running tasks. WSL containers enable Linux-based toolchains within Windows environments, and MicroVMs offer hardware-backed isolation for high-risk operations. Each backend presents distinct security characteristics, requiring organizations to assess suitability based on workload risk.

MXC also integrates with Microsoft Entra to differentiate agent activity from user activity, enhancing attribution and response capabilities. This feature, expected in upcoming Windows updates, will allow security teams to monitor agent behavior separately from human users, reducing the impact of compromised or misbehaving agents on overall system access.

Beyond technical enforcement, MXC supports policy management through tools like Microsoft Intune. Administrators can apply organizational rules to container creation and resource access, enabling centralized governance across distributed agent deployments. Developers can iteratively refine policies using activity reports generated during testing phases, with three operational modes available: Enforcement (strict blocking), Learning (blocking with detailed logs), and Permissive (recording denials without interruption).

Several AI platforms have already adopted MXC, including GitHub Copilot, OpenAI Codex, and Replit. These integrations demonstrate how containment can protect sensitive workflows — such as code development — while preserving necessary functionality. For instance, a Copilot agent can access a repository and development tools but remains restricted from unrelated system areas.

Microsoft encourages developers to begin using MXC via its SDK and configuration schema, available through public repositories. Feedback channels are open for reporting issues or suggesting improvements. The company emphasizes that ongoing development focuses on expanding backend support, refining policy tools, and enhancing observability around agent behavior.

By decoupling agent authority from user privileges and embedding containment into the operating environment, MXC represents a structural shift in how AI agents interact with operating systems. The approach does not eliminate risk but introduces measurable controls, aligning automation with organizational security boundaries without requiring agents to self-police their access.