On October 7, 2026 (local time), Microsoft announced the official release of Microsoft Execution Containers (MXC), an isolated environment for safely running AI agents on Windows 11. Runtime policies let users define which files and networks agents can access, enabling three safeguards: limiting their scope of action, distinguishing human activity from agent activity, and monitoring their actions.
The More Work You Delegate, the More You Need Boundaries
Replying to emails, coordinating schedules, organizing files. Autonomous AI agents such as OpenClaw have reached the point where they can handle these everyday tasks on a PC for people. Their usefulness comes from being able to interact directly with files and apps. But the broader their access, the greater the risks—such as accidentally deleting important files or making unintended network connections.
MXC is not a fence designed to stop agents, but an enclosure that defines in advance where they are allowed to operate. Users can place the agent itself, along with its plugins, tools, agent harness, and generated output, inside MXC. The announcement suggests that the conversation is shifting from “What can agents do?” to “How far should we let them go?”
Microsoft also explained on its official Windows Developer account that users can define where agents have file and network access and apply policies at runtime. The initiative is part of the company’s effort to make Windows the safest platform for agents.
Choose the Level of Isolation for the Task
One of MXC’s key features is the ability to choose from multiple backends with different levels of isolation. Think of it like the locks on a house: sometimes a lock on the front door is enough, while other situations call for a safe as well.
### Process-Level and Account-Level Isolation
Process isolation using AppContainer, Windows’ built-in sandbox, is considered suitable for coding agents and agent-driven tool execution. This approach seems like a good fit for tasks that need to run with a light footprint.
Session containers provide another level of isolation. Agents run under a separate account from the human user, with the desktop, clipboard, user interface, input, and active session all separated. This approach is suited to agents such as OpenClaw that operate autonomously for long periods. The agent works in a separate “room” while you use your own desktop.
### Isolation Through Virtualization
MXC also supports WSL containers (WSLc), a container-based virtualization option on WSL, and MicroVMs, which provide hardware-level isolation. Isolation can be strengthened in stages—from process to account to virtualization—so users can choose based on the permissions required and how long the agent needs to run.
The different options can be summarized as follows.
Method / Isolation unit / Suitable uses
AppContainer / Process / Coding agents, tool execution
Session container / Separate account and session / Long-running agents such as OpenClaw
WSL container (WSLc) / Container-based virtualization on WSL / Situations requiring separation at the virtualization level
MicroVM / Hardware level / Situations requiring stronger isolation
Security Depends on Configuration and Operations
With every option, policies can specify whether access to files and networks is allowed. Users can not only create an enclosure but also define what is permitted inside it. For organizations, policy configuration through Windows Intune is also planned, with an eye toward deploying agents not just on personal devices but across large numbers of company-managed PCs.
As for compatibility, Microsoft announced that many partners—including OpenClaw and Anthropic’s Claude Code—will support MXC. If OS-level isolation becomes standard and agent developers increasingly build on it, MXC could become an operational foundation for agents rather than merely a component for developers.
Ultimately, real-world security depends on deciding what to allow and what to prohibit. Grant too much access and isolation loses its meaning; restrict it too much and the agent cannot do its job. The practice of starting with the least privilege needed for the task and expanding access only when necessary is likely to become a key consideration as people put agents to work.
Comments