iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Microsoft Execution Containers (MXC) is a policy-driven execution layer for running untrusted code and AI-agent workloads inside a defined boundary. It is not an AI model or an agent. You declare which commands, files, network destinations and user-interface capabilities a workload needs, and MXC selects an appropriate containment backend to enforce those limits.
For a Windows AI coding agent, start with a least-privilege policy and choose a backend based on whether the task needs lightweight command execution, a separate desktop session, Linux tooling or stronger virtualization. Microsoft’s October 7, 2026 announcement lists process containers, session containers and WSL containers for Windows 11, plus experimental MicroVM support on Windows 11 and Linux. Availability and security properties vary, so verify the current documentation before deploying.
What is Microsoft Execution Containers?
MXC is a common policy and SDK model that puts an execution boundary around untrusted programs, generated code, plugins, tools, agent harnesses or an entire agent. The developer or organization defines the workload’s permitted resources; the workload does not get to expand those permissions for itself. Microsoft describes this principle succinctly: “An agent cannot be its own security authority,” wrote Logan Iyer, Corporate Vice President, Windows Platform + Developer, in the October 7, 2026 Windows Developer Blog announcement.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →The policy is separate from the containment technology. MXC can map one policy to a Windows process boundary, a separate Windows session, a Linux environment under WSL, or a MicroVM where supported. That lets an application keep its authorization model while selecting a backend that fits the host operating system and workload.
#1 Best Overall
- Spacious Design: Measuring 21.1" wide and 14.1" deep, our lap desk comfortably fits most laptops up to 15.6". Extra room for accessories ensures convenience.
- Enhanced Functionality: Packed with handy features, including a 5x9" precision tracking mouse pad and a built-in phone slot for seamless work or video calls. Plus, enjoy ergonomic support with the integrated cushioned wrist rest.
- Cool Comfort: Enjoy a stable surface with our lap desk's dual bolster cushion, designed for comfort and airflow, keeping your lap cool during extended use.
- Durable Surface: Work with confidence on our lap desk's solid surface, featuring a sleek black carbon color, ensuring optimal air circulation to prevent your laptop from overheating.
- On-the-Go Convenience: With an integrated handle and lightweight design (2.8 lbs), our lap desk is portable for travel or moving around the house, offering flexibility in any space.
MXC should not be treated as proof that an entire agent stack is secure. Credentials, tool servers, host integrations, network proxies, organization controls and fallback behavior can all affect the effective boundary. The policy limits the operations it covers; it does not remove the need for endpoint security, identity controls and careful tool design.
How does MXC contain an AI agent?
The basic flow is declarative: describe the workload, apply a policy when it starts, and let the selected backend enforce the supported restrictions.
- Declare the workload. Specify the command, arguments, working directory and environment the agent or tool should receive.
- Declare resources. List filesystem paths, network destinations and user-interface capabilities that are required. Explicit deny rules can protect sensitive locations even when a broader allow rule exists.
- Select a backend. MXC chooses or is configured to use a platform-appropriate containment mechanism, such as AppContainer-style process isolation on Windows, Seatbelt on macOS, Bubblewrap on Linux, a Windows session, WSL or a MicroVM.
- Start the workload under policy. The boundary is established outside the agent process. The agent can request an operation, but it cannot grant itself a new capability.
- Review behavior and tighten grants. During policy authoring, use an observation mode to identify legitimate requirements, then move to an enforcement policy that blocks unapproved access.
Microsoft’s policy areas include process launch, arguments, working directory and environment; filesystem read and write paths; inbound, outbound and loopback networking; and interaction with the user interface. Exact capabilities depend on the backend and current implementation.
Recommended Free Tools
How do I sandbox an AI coding agent on Windows?
On Windows, begin with a process container when the agent mainly runs commands and edits a repository. Move to a session container for long-running automation that needs its own desktop, use WSLc for Linux-first toolchains, and consider an experimental MicroVM only after confirming that its current support and operational maturity meet your risk requirements.
1. Define the smallest useful task boundary
Write down what the agent must do before creating its policy. A build-and-test agent may need a source directory, compiler or package-manager executables, a temporary directory and access to selected package registries. It generally does not need a user profile, browser data, password store or unrelated documents.
2. Separate read, write and execute needs
Grant read-only access wherever possible. A repository can be writable while deployment configuration is read-only. Deny unrelated personal folders explicitly, and avoid passing broad inherited environment variables that expose credentials or internal endpoints.
Rank #2
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
3. Restrict network destinations
Allow only the package registries, source hosts, APIs or inference services required by the task. Decide separately whether loopback access is necessary: local services can be useful for tests but can also expose other processes on the host.
4. Decide whether the agent needs a GUI
A command-line coding loop usually fits a process container. An agent that manipulates a desktop, clipboard, input devices or an interactive application needs a different design, such as a session container, and should not share the signed-in user’s desktop by default.
5. Author and test the policy in an observation mode
Start with a policy that reflects known requirements, reproduce the real task, and inspect blocked or attempted operations. Approve only accesses that are necessary for the task. Do not turn observation into a permanent production posture.
6. Deploy with enforcement enabled
Once the allow-list is understood, use enforcement so ungranted operations are blocked. Keep the policy versioned with the agent or application and review changes whenever tools, plugins, repositories or network services change.
Microsoft has not established one universal installation command, SDK language or host-prerequisite list in the cited announcement. Check the current MXC repository documentation for those details before writing automation around a particular release.
Which MXC sandbox should I use for an AI agent?
There is no universal “best” backend. Choose according to host operating system, GUI or session requirements, Linux compatibility, isolation needs and the maturity of the option available on that host.
Rank #3
- Note: Not suitable for MacBooks released after 2023 or devices with a protruding front camera; Not applicable to full-screen or notch-style tempered glass screen protectors; Do not use on the rear camera of the phone.
- 💻 Why Do You Need a Webcam Cover Slide? — Safeguard your privacy by covering your webcam with our reliable webcam cover when not in use. Don't let anyone secretly watch you. Stay protected!
- ✅ Thin & Stylish — Enhance your laptop's functionality and aesthetics with our 0.027" ultra-thin webcam covers. Seamlessly close your laptop while adding a touch of sophistication.
- ✅ Fits Most Devices — Compatible with laptops, phones, tablets, desktops! Keep your privacy intact on Ap/ple, Mac/Book, iPh/one, iP/ad, H/P, L/novo, De/ll, Ac/er, As/us, Sa/msung devices.
- ✅ 365 Days Protection — Our upgraded 3.0 adhesive ensures a strong hold that won't damage your equipment. Experience reliable, long-term privacy protection day in and day out.
| Backend | Host support described by Microsoft | Best fit | Isolation and compatibility notes | Maturity note |
|---|---|---|---|---|
| Process container | Windows, macOS and Linux, using platform-appropriate mechanisms | Lightweight, responsive execution of generated code and tools | Process-level policy for files, network, processes and other supported capabilities; works well for command-line agents | Presented as the general-purpose option; exact protections vary by operating system |
| Session container | Windows 11 | Long-running agents or automation that needs a desktop or separate interactive session | Runs under a separate Windows account and session, separating desktop, clipboard, UI, input and active session | Windows 11-specific in the announcement; verify current availability |
| WSL container (WSLc) | Windows 11 | Agents built around Linux tools or Linux-first development environments | Provides a Linux environment while the host is Windows; check compatibility with required devices, services and filesystem paths | Windows 11-specific in the announcement; verify current support |
| MicroVM | Windows 11 and Linux | Higher-risk workloads that benefit from hardware-backed virtualization and Linux compatibility | VM-style boundary with Linux workload compatibility; operational assumptions differ from process isolation | Described as experimental in the October 7, 2026 announcement, not a blanket production recommendation |
The MXC repository also lists backends including ProcessContainer, Windows Sandbox, LXC, Bubblewrap, Seatbelt, MicroVM (Nanvix), Hyperlight, IsolationSession and WSLc. That repository inventory is broader than the end-user comparison in Microsoft’s announcement; support, packaging and maturity can differ by release.
What can an MXC policy control?
A useful policy is specific enough to prevent accidental authority without breaking the task. Microsoft’s illustrative coding-agent scenario allows read/write access to a source repository and required development tools, read-only access to deployment configuration, and denies unrelated personal folders and interactive desktop access.
Process and environment
Control which executable may start, its arguments, working directory and environment. Restrict child-process creation where the task does not require arbitrary tools. Treat inherited variables containing tokens, proxy credentials or cloud credentials as sensitive inputs rather than harmless configuration.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesFilesystem
Use separate read and write rules. A compiler may need read access to dependencies and write access to a build directory; a deployment manifest may need to be read but never modified. Deny rules are valuable for protecting user profiles, browser data, SSH keys and unrelated repositories.
Network
Specify outbound destinations and ports where possible, and decide whether inbound connections or loopback are needed. A package install, test server and model-inference call have different network requirements. A broad “internet access” grant makes auditing and incident response harder.
User-interface access
Desktop, clipboard, keyboard, mouse and active-session access can expose data outside the repository. Grant UI capabilities only to an agent that genuinely needs them, and prefer a separate session when interactive automation is unavoidable.
Rank #4
- Anti-Slip Surface - Transform your laptop into a mobile workstation with the AboveTEK portable laptop lap desk. The anti-slip surface provides a strong grip for laptops up to 15.6 inches(Diagonal), while the double rubber strip on the bottom ensures a stable display or typing experience on your lap, couch, or bed.
- Retractable Mouse Pad - Retractable laptop mouse pad extends on both directions for the left/right handed with elevation along the edges for stopping mouse from falling off. The size of laptop tray is 14" X 9.7" and the size of mouse pad is 7.4" X 6.1".
- Effective Heat Shield - The effective heat shield made of sturdy and thick material protects your laptop from overheating. Prioritizes your comfort and safety, an ideal lap pad or board for working anywhere.
- EASY to Carry and Store - With an ergonomic and simplistic design, the lap desk is portable to store in a backpack. Only 15" in size, 2.2 lb of weight and with slim 0.6 inch thickness, it is ready to be easily carried around.
- Widely Applicable - The smooth platform accommodates laptops and tablets up to 15.6 inches(Diagonal), making it a versatile accessory and one of the best gifts for mom, dad, students and professionals. Perfect for use as a laptop bed tray or tablet holder anywhere at home, library, or park.
What is the difference between enforcement, learning and permissive mode?
The modes serve different stages of policy work. Learning keeps the boundary active while recording blocked accesses; permissive records would-be denials but allows them, so it is not equivalent to enforcement.
Free tools Windows power users keep installed
One-click scans. No signup required.
| Mode | What happens to ungranted access? | Activity report | Appropriate use |
|---|---|---|---|
| Enforcement | Blocked | No activity report in Microsoft’s description | Production policy after requirements are understood |
| Learning | Blocked and recorded | Yes, for Windows process containers | Diagnosing failures while retaining the configured boundary |
| Permissive | Allowed and recorded | Yes, for Windows process containers | Observing attempted resource use while authoring a policy |
Permissive mode does not override other Windows, security-product or organizational restrictions. A reasonable rollout is to reproduce the real workload, review each denied or attempted operation, narrow the allow-list, and then switch to enforcement. Treat that as a policy-authoring approach derived from Microsoft’s mode descriptions, not as a guarantee that every agent will require the same sequence.
How secure is an MXC sandbox?
Security depends on the backend and the policy, not on the word “sandbox” alone. Microsoft advises evaluating each backend’s distinct security properties against the workload. The cited announcement provides no independent benchmark or comparative security score, and it does not establish universal latency, throughput or memory-overhead figures.
- Contain the whole execution path. If an agent can invoke an unrestricted helper, plugin or host integration, that component may become the effective escape route.
- Protect credentials separately. Do not expose a user’s full token set merely because the agent runs in a container. Use scoped credentials and short-lived access where possible.
- Audit allowed network paths. A permitted endpoint can still return sensitive content or perform consequential actions.
- Plan for fallback behavior. If a tool fails, an agent may try another command or service. Ensure alternatives are subject to the same policy.
- Keep host security in place. MXC complements endpoint protection, patching, identity policy and organizational controls; it does not replace them.
How does MXC relate to other Microsoft agent sandboxes?
MXC is a local and cross-platform execution layer. Microsoft’s Azure SRE Agent security overview describes a separate hosted architecture in which each agent uses a micro-VM and separates reasoning, tool execution, identity and network-proxy components. The two designs should not be treated as having identical isolation guarantees.
Microsoft’s VS Code guidance uses “sandbox” for a narrower feature scope: supported terminal commands and child processes, with certain MCP or language-server checks controlled by settings. That guidance explicitly says the feature is not a VM or user-account boundary and does not replace endpoint security; it identifies MXC process containers as the Windows mechanism for that VS Code implementation. Those statements apply to the described VS Code feature, not automatically to every MXC backend.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What enterprise controls and integrations are available?
Microsoft’s October 7, 2026 announcement said Intune policy management for MXC process containers on Windows 11 would be available soon. It also described Entra-based attribution distinguishing agent activity from user activity and Agent 365 management for local agents as forthcoming. These are dated roadmap statements, so confirm their status before designing a production control plane around them.
Best Value
- Spacious Design: Measuring 21.1" wide and 12" deep, our lap desk comfortably fits most laptops up to 15.6". Extra room for accessories ensures convenience.
- Enhanced Functionality: Packed with handy features, including a 5x9" precision tracking mouse pad and a built-in phone slot for seamless work or video calls. Plus, enjoy laptop support with the integrated device ledge.
- Cool Comfort: Enjoy a stable surface with our lap desk's dual bolster cushion, designed for comfort and airflow, keeping your lap cool during extended use.
- Durable Surface: Work with confidence on our lap desk's solid surface, featuring a blush pink color, ensuring optimal air circulation to prevent your laptop from overheating.
- On-the-Go Convenience: With an integrated handle and lightweight design (2.14 lbs), our lap desk is portable for travel or moving around the house, offering flexibility in any space.
Microsoft named GitHub Copilot, OpenClaw, Replit, LM Studio, NVIDIA OpenShell and Unsloth AI as agents or integrations supporting MXC. The announcement does not imply that every feature or backend is supported by each integration. Microsoft also reported that NVIDIA integrated OpenShell with MXC policy controls, inference-service access controls, credential management and enterprise OCSF auditing; that is vendor-reported integration information rather than an independent evaluation.
What should I check when an agent fails inside MXC?
Most failures are policy mismatches rather than model errors. Diagnose them without immediately granting broad access.
- Confirm that the command, arguments, working directory and environment are allowed.
- Check whether a required executable is outside the permitted tool paths.
- Review denied reads and writes, including temporary, cache and dependency directories.
- Check DNS, proxy, TLS, registry and loopback requirements against the network policy.
- Determine whether the task actually needs clipboard, desktop or input access.
- For Linux tooling on Windows, verify that the selected WSL environment contains the expected packages and path mappings.
- After a policy change, rerun the complete task rather than testing only the step that previously failed.
If the workload still cannot be made reliable with a narrow policy, reconsider the agent design or backend instead of switching permanently to unrestricted execution.
Frequently Asked Questions
Can MXC run an entire AI agent, or only its generated code?
Microsoft describes MXC as applicable to generated output, plugins, tools, an agent harness or the entire agent. The practical choice is to place the least-trusted component inside the boundary while preserving only the permissions that component needs.
Does a Windows process container provide a virtual machine?
No. A process container is a platform-specific process boundary, not automatically a full virtual machine or separate user session. Use a session container or a MicroVM when the workload’s isolation and compatibility requirements call for those different models.
Can an agent in permissive mode access everything on my PC?
Permissive mode allows and records accesses that the MXC policy would otherwise deny, but it does not cancel Windows, endpoint-security or organizational restrictions. It should be treated as a policy-authoring mode, not as a security setting for normal operation.
Are MXC performance and security differences benchmarked?
The cited Microsoft announcement does not provide independent comparative benchmarks for latency, throughput, memory use or security assurance. Select a backend based on its documented boundary and workload fit, then validate it in your own environment.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
