Microsoft Execution Containers (MXC) 1.0.0 Release: Policy‑Driven Containment for AI Agents

TL;DR – What MXC 1.0.0 delivers and why it matters

Microsoft Execution Containers (MXC) 1.0.0 ships as a generally available, policy‑driven execution layer that isolates AI agents from the host system. Developers declare JSON policies that restrict file, network, and UI access, and MXC enforces those limits with platform‑specific containers (process, session, WSL, or experimental MicroVM). This gives enterprises a concrete way to reap agent productivity while preventing the "unrestricted access or block everything" dilemma.

---

Containment is the core security primitive for agents

Agents cannot be their own security authority. MXC forces agents to run inside a boundary that is defined by the developer or organization and enforced outside the agent code. In practice, a coding agent that updates a website can be granted read/write access to the repository and read‑only access to production configuration, while any attempt to modify that configuration is blocked by the container regardless of the model’s intent.

"Without a managed execution boundary, the agent may decide that changing the server configuration is the fastest way to complete the task and potentially break the production site." – Microsoft blog

MXC architecture and supported back‑ends

Backend	Platforms	Typical use‑case	Key isolation properties
Process container	Windows 11, macOS, Linux	Low‑latency workloads, model‑generated code, tool execution	Uses AppContainer (Win), Seatbelt (macOS), Bubblewrap (Linux) – lightweight sandbox
Session container	Windows 11 only	Long‑running agents needing a desktop, clipboard, UI isolation	Separate Windows account & session; isolates desktop, clipboard, input
WSL container (WSLc)	Windows 11 only	Linux‑first toolchains, workloads that depend on Linux packages	Executes inside WSL, giving a full Linux environment
MicroVM	Windows 11, Linux (experimental)	High‑risk workloads that require hardware‑backed isolation	Hardware‑enforced VM boundary, full Linux compatibility

Each backend maps the same JSON policy to platform‑specific enforcement mechanisms, letting developers write a single policy file regardless of the host OS.

Policy schema – what can be locked down?

MXC policies are divided into five areas:

1. Containment – selects the backend (process, session, etc.).
2. Process – command line, arguments, working directory, environment.
3. File system – explicit allow/deny lists for read, write, and no‑access paths.
4. Network – inbound/outbound rules, loopback enable/disable.
5. User interface – permission to interact with the desktop, clipboard, or UI elements.

A typical policy for a coding agent might look like:

{
  "containment": "process",
  "process": {"command": "python", "args": ["agent.py"]},
  "filesystem": {"allowRead": ["/repo/**"], "allowWrite": ["/repo/**"]},
  "network": {"allowOutbound": ["git.example.com:443"]},
  "ui": {"allowDesktop": false}
}

The policy lives outside the agent, so the agent cannot elevate its own privileges.

Operational modes – from learning to enforcement

MXC supports three mutually exclusive modes that help teams iterate on least‑privilege policies:

Mode	Access outcome	Activity report	Recommended stage
Enforcement	Blocked operations are denied	No report	Production
Learning	Blocked operations are denied and recorded	JSON activity log	Policy authoring
Permissive	All operations are allowed but recorded	JSON activity log	Early testing

In Learning mode, a denied file‑access attempt appears in the activity report, allowing developers to add the missing path to the policy without exposing the system to risk.

Integration with Microsoft Entra and Agent 365 (future)

Microsoft announced that Entra will soon tag agent activity with a distinct identity separate from the logged‑in user. This will enable:

• Per‑agent audit trails in Microsoft Agent 365.
• Policy enforcement that targets the agent principal rather than the human user, preventing a compromised agent from affecting the user's broader access.
• Granular governance (e.g., block a single misbehaving agent while keeping the employee productive).

Real‑world adoption – partners and frameworks

The blog lists several early adopters:

• NVIDIA OpenShell – integrates MXC for file, network, and credential controls.
• GitHub Copilot, OpenAI Codex, Replit, LM Studio, Unsloth AI – already ship with MXC sandboxing for developer workflows.
• Upcoming support from Anthropic Claude Code, Box, Egnyte, Heidi Health, Nous Research’s Hermes Agent, Manus, Perplexity, Raycast, Simular, and others.

These integrations demonstrate that MXC is not just a proof‑of‑concept; it is being used in production‑grade coding assistants that need fine‑grained access to repositories and toolchains while protecting the host system.

Community feedback – strengths and concerns

• Positive reception – Commenters appreciate the ability to finally lock down app permissions without admin rights (e.g., the note about Windows 11 25H2 allowing AppContainer creation without elevation).
• Criticism of maturity – Some users label the release as a “tech preview” rather than a true 1.0 GA, noting missing polish in documentation (especially Bubblewrap integration) and the need for a deeper security model overhaul.
• Enterprise focus – A question was raised about whether MXC will be limited to corporate customers, with concerns that everyday users may not get the same level of protection.
• Alternative solutions – One commenter suggested using existing Linux containers/VMs, arguing that “just works” solutions already exist on Linux.

These viewpoints highlight that while MXC fills a gap in Windows‑centric agent security, adoption will depend on tooling maturity, clear documentation, and broader availability beyond enterprise licensing.

Getting started

1. Clone the MXC repository: https://github.com/microsoft/mxc.
2. Install the language‑specific SDK (C#, Python, etc.) from the repo’s README.
3. Draft a JSON policy using the schema above.
4. Run the agent in Learning mode to generate an activity report.
5. Refine the policy, then switch to Enforcement for production.

Feedback and bug reports are welcomed via the GitHub Issues tracker.

---

Bottom line

Microsoft Execution Containers 1.0.0 gives developers a concrete, policy‑driven way to sandbox AI agents across major OSes, separating what an agent can do (containment) from who the agent is (future Entra identity). By providing multiple isolation back‑ends, a clear JSON policy model, and three operational modes for safe policy iteration, MXC turns the “unrestricted‑or‑blocked” dilemma into a manageable security posture—provided the tooling matures and documentation catches up.