Microsoft Introduces Execution Containers to Secure AI Agents on Windows

Microsoft has introduced a new security architecture to safeguard autonomous AI agents on Windows, unveiling the Microsoft Execution Containers (MXC) SDK at Build 2026.

The move reflects a growing industry concern: as AI agents evolve from passive assistants into autonomous systems capable of executing code, accessing files, and orchestrating workflows, they introduce significant security and trust challenges.

Microsoft’s latest initiative positions Windows as a “trustworthy OS for agents,” embedding containment, identity, and governance at the operating system level.

Microsoft Execution Containers to Secure AI Agents

AI agents are increasingly operating with dynamic, non-deterministic behavior, often generating and executing code at runtime. This shift breaks traditional security assumptions where applications operate within predictable boundaries.

In contrast, modern agents can chain actions across systems, manipulate environments, and interact with sensitive enterprise data. Microsoft emphasizes that without built-in safeguards, such capabilities could expose organizations to uncontrolled risk at scale.

To address this, Microsoft is integrating policy-driven controls through Agent 365 and MXC, enabling organizations to define strict boundaries on what AI agents can access and execute.

These controls are enforced at runtime, ensuring that even dynamically generated agent behavior adheres to predefined security policies. This approach aligns with zero-trust principles, which hold that no process is inherently trusted without verification and constraints.

At the core of this model is the MXC SDK, a cross-platform execution layer that abstracts complex isolation mechanisms. Instead of requiring developers to manage low-level sandboxing techniques, MXC allows them to define constraints declaratively, while Windows enforces them consistently. This significantly reduces the complexity of building secure AI-driven applications while maintaining performance and usability.

Key MXC Capabilities

• Process isolation: Lightweight containment that restricts agent access to files, system resources, and network domains, ideal for developer tools like coding agents.
• Session isolation: Separates agent execution from user environments, mitigating risks such as UI spoofing, input injection, and cross-session data leakage.
• Identity attribution: Assigns unique local or cloud-backed identities via Microsoft Entra, enabling precise tracking and auditability of agent actions.
• Policy enforcement: Integration with Microsoft Intune allows administrators to apply granular security policies and lifecycle controls.
• Cross-platform support: Extends to Windows Subsystem for Linux (WSL), enabling secure execution of Linux-based AI workloads.

GitHub Copilot CLI has already adopted MXC’s process-isolation model, demonstrating the real-world application of these controls to constrain dynamically generated code. This highlights Microsoft’s strategy of embedding security into widely used developer tools to drive adoption.

Containment Models Overview

Containment Type	Security Level	Use Case	Key Benefit
Process Isolation	Moderate	Coding agents, rapid execution tasks	Low overhead, fast performance
Session Isolation	High	Long-running workflows, automation	Strong separation from user environment
Micro-VM (Planned)	Very High	Sensitive data processing, untrusted code	Hardware-backed isolation
Linux Containers (WSL)	Flexible	ML workloads, Linux-based agents	Ecosystem compatibility
Cloud Isolation (Windows 365)	Maximum	Enterprise-scale agent deployments	სრული isolation via cloud PCs

Microsoft is also advancing future containment models, including micro-VMs leveraging hypervisor-based isolation to mitigate sandbox escape risks, an area gaining attention as research shows large language models can potentially bypass weak sandboxing mechanisms.

Additionally, integration with Windows 365 for Agents enables execution within disposable cloud environments, ensuring that even compromised agents cannot impact local systems.

Security enhancements extend beyond containment. Windows Defender now includes protections against prompt injection attacks, while platform-level features such as passkeys, Secure Boot, Rust-based drivers, and post-quantum cryptography further reduce the attack surface. These built-in defenses ensure that agents inherit a hardened security baseline without requiring additional configuration.

Microsoft is collaborating with ecosystem partners including NVIDIA, OpenAI, and Nous Research to standardize secure agent execution.

Tools like OpenShell and Hermes Agent already integrate with MXC, enabling always-on, autonomous agents with enforced guardrails. This ecosystem-driven approach ensures compatibility with real-world developer workflows while maintaining enterprise-grade security.

With MXC and Agent 365, Microsoft is effectively redefining endpoint security for the AI era. By embedding containment, identity, and governance directly into Windows, the company aims to enable organizations to scale AI adoption without compromising control or trust.

As AI agents become integral to enterprise operations, such OS-level security innovations will likely become a foundational requirement rather than an optional enhancement.

Interact with Cyber Threats in Windows, Linux, macOS VMs to Trigger Full Attack Chain - Analyse Malware & Phishing with ANY RUN