Microsoft ships containers that limit what AI agents can touch on Windows 11

Microsoft made Microsoft Execution Containers, or MXC, generally available on Windows 11 on October 7. MXC lets developers and IT administrators set hard limits on what an AI agent running on a PC can do: which files it can read and write, which network connections it can open, which processes it can start and whether it can interact with the user's desktop.

The limits are enforced outside the agent. As eSecurity Planet put it, an AI agent "cannot simply grant itself additional file or network access."

How it works

Limits are written in a JSON configuration file, and developers build them in with an SDK. MXC can contain an agent in several ways:

Each container runs in one of three modes. Enforcement blocks anything outside the policy. Learning blocks it too and writes a JSON report of what was blocked, which helps when writing a policy for a new agent. Permissive mode only records what would have been blocked and lets it through, so it gives no protection.

Which agents use it

eSecurity Planet lists GitHub Copilot, OpenAI Codex, OpenClaw, Replit, LM Studio, NVIDIA OpenShell and Unsloth AI as already supporting MXC. Anthropic's Claude Code, Box, Egnyte, Manus and Perplexity are among those planning support. Support does not mean every feature of an agent runs inside a container, so check with each vendor.

What is missing

For IT teams, the gaps matter as much as the launch. Central management of MXC process containers through Intune is "not yet generally available" and will arrive in a future release. Agent identity, which Microsoft plans to build with Entra and Microsoft Agent 365, is still being developed. Microsoft has not given dates for either.

Until Intune support lands, MXC policies are set per agent and per device, which is hard to run across a fleet.