What Is Microsoft Execution Containers (MXC)? The Beginner's Guide

CodexFuse Team · 2026-11-04T12:19:17.200Z · 14 min read min read

Give an AI coding agent a task and it can do astonishing work: edit your files, run shell commands, install packages, even open a pull request. The uncomfortable part is what it does that with. Today, most coding agents run with the full authority of the signed-in user — every file you can read, they can read; every command you can run, they can run. Microsoft Execution Containers (MXC) is Microsoft's answer to that problem: a policy-driven execution layer that confines agents and untrusted code to exactly the files, network destinations, and UI access a developer or IT team declares, with the operating system enforcing the boundary. If containerization is new to you, our Docker containerization guide covers the concepts MXC builds on.

Microsoft announced MXC as generally available on October 7, 2026, in a Windows Developer Blog post by Logan Iyer, Corporate Vice President for Windows Platform + Developer, and within weeks the biggest coding agents had started adopting it. This guide explains what MXC actually is, how its JSON policy works, which backends and modes it offers, and how to sandbox an AI coding agent on Windows 11 with it — as of November 4, 2026.

What Is Microsoft Execution Containers?

Anyone arriving here asking "what is MXC" is really asking one question: what stops an AI agent from doing something its operator never intended? Microsoft Execution Containers is the policy-driven answer.

Microsoft Execution Containers is a policy-driven execution layer for untrusted code or dynamically generated workloads. In practice, that means you write a versioned JSON policy naming the container type, the command to run, and the resources the workload may touch — files it can modify, files it can only read, paths it may never touch, inbound and outbound network connectivity, and access to the desktop — and MXC validates the request, picks a backend, and launches the workload inside a container that enforces those rules.

The key architectural idea is where the policy lives. As Microsoft puts it: "An agent cannot be its own security authority. It must run within a boundary defined by the developer or organization and enforced independently of the agent itself." Because the policy remains outside the workload's control, the agent — or code the agent generated — cannot grant itself more access. A developer declares the resources a workload requires, and MXC enforces the resulting boundary with the appropriate container.

MXC is open source under the MIT license (the repository is github.com/microsoft/mxc, written mostly in Rust), and Microsoft ships SDKs in three languages — Rust (mxc-sdk), .NET (Microsoft.Mxc.Sdk), and Node (@microsoft/mxc-sdk) — behind one unified JSON configuration schema. The same policy model applies from a local device to the cloud: Microsoft also announced Windows 365 support for MXC generally available, so agents can run next to existing work on Cloud PCs.

Why Does an AI Agent Need a Sandbox?

Microsoft's announcement framed the status quo as a false choice. Customers, it said, feel they have "only two choices: give agents unrestricted access and hope nothing goes wrong or block them and lose the productivity benefits they provide. Neither option is acceptable." The whole point of MXC is to replace that with agent least privilege: "Instead of giving an agent the full authority of the signed-in user," developers and IT administrators define an OS-enforced boundary around the agent's workload.

That is a bigger shift than it sounds, and it is what an agent sandbox actually means: not permission popups the model can argue with, but an OS-enforced boundary around everything the agent runs. An agent sandbox is not the same as an agent that asks permission politely. Prompt-level guardrails are suggestions a model can talk itself out of; an OS-enforced boundary is not. As one independent explainer (moorai.dev) puts it: "A command that writes outside the paths the policy grants, or connects where the policy does not allow, is stopped by the operating system whatever the model decided."

How an MXC JSON Policy Works

Every MXC run starts with a container-creation request: a JSON document validated against a versioned schema (1.0.0 stable at launch, with a 1.1.0 preview carrying experimental features). The policy covers five areas, described in Microsoft's announcement:

Here is what a policy looks like. This example comes from Dinis Cruz's sgit.ai briefing, which states that the field names are the schema's while the paths and command are illustrative:

{
  "version": "1.0.0",
  "containerId": "website-update",
  "containment": "processcontainer",
  "process": {
    "commandLine": "agent-run --task update-homepage",
    "cwd": "C:/src/website",
    "timeout": 600000
  },
  "filesystem": {
    "readwritePaths": ["C:/src/website"],
    "readonlyPaths":  ["C:/deploy/server-config", "C:/tools/git"],
    "deniedPaths":    ["C:/Users/me/Documents", "C:/Users/me/.ssh"]
  },
  "network": {
    "egress":  { "default": "deny" },
    "ingress": { "default": "deny", "hostLoopback": "deny" }
  },
  "ui": { "disable": true },
  "processContainer": { "leastPrivilege": true }
}

Three things about that policy deserve attention. First, containers are deny by default: leave the network section out and outbound traffic is denied. Second, the network rules are numeric — an address range, a protocol, and a port. Filtering by host name is left to a proxy the caller runs; MXC itself does not see what the traffic says. Third, the agent can see that policy but cannot change it, because the policy is validated and held outside the workload.

Before a policy goes to production, MXC offers three operating modes:

The Learning mode is the practical heart of the system. Nobody can predict every file and socket a coding agent will touch on the first run, so you observe the agent in Learning or Permissive mode, read the JSON agent activity report showing which resources the workload tried to use, and tighten the policy until it grants only what the agent actually needs. Even Permissive mode, Microsoft notes, does not bypass other applicable operating system or organizational restrictions.

The Four Containment Backends

One JSON schema, four isolation backends — that is the design choice that lets the same policy run on Windows, macOS, and Linux. Microsoft maps the requested controls onto the backend appropriate for the platform and the workload:

Windows Sandbox and Hyperlight micro-VMs also exist as backends, but they are marked experimental in the repository. The default on Windows is the AppContainer-based process container — lightweight enough that GitHub Copilot uses its BaseContainer tier of the process backend on Windows, Seatbelt on macOS, and bubblewrap on Linux, with no separate virtual machine or container image required (analysis from canberk.me).

Which Agents Already Support MXC?

In the launch announcement, Microsoft said the leading agents and agent frameworks already supporting MXC include GitHub Copilot, OpenClaw, OpenAI Codex, Replit, LM Studio, and Unsloth AI. NVIDIA has integrated OpenShell into MXC, adding policy controls for agent access to files and inference services, advanced network controls, and credential management. Microsoft also named the agents lined up to release support: Anthropic Claude Code, Box, Egnyte, Heidi Health, Hermes Agent by Nous Research, Manus, Perplexity, Raycast, and Simular, among others.

The two biggest integrations landed the same week as the announcement. GitHub Copilot's local sandbox went generally available on October 7 on top of MXC — in the Copilot CLI, the /sandbox command sets it up, and most of the commands and tools Copilot invokes run inside the OS sandbox (saved as sandbox.enabled). If Copilot is your daily driver, our GitHub Copilot app walkthrough covers the tool itself. Two days later, on October 9, OpenAI announced that Codex on Windows has a new sandbox mode built on MXC, promising "faster setup, stronger network enforcement, and granular file access controls" on compatible Windows 11 devices; the Codex docs now recommend MXC as the Windows sandbox, selected with windows.sandbox = "mxc" or preferred with prefer_mxc, and an administrator can block it with allow_mxc = false.

Claude Code is the notable holdout for now: Microsoft lists Anthropic's agent as "will release support" with no date, and as of October 29 it had no MXC support on native Windows. On the OpenClaw side, our OpenClaw setup guide covers getting that agent running. Note the sibling relationship: OpenClaw is an agent that uses the MXC containment layer; MXC itself is the OS enforcement layer underneath, not an agent.

Is MXC the Same as Windows Sandbox?

No. Windows Sandbox gives the user an isolated Windows desktop where they can run apps separately from the main operating system. MXC is a policy-driven execution framework that controls what an AI agent or workload can access while it runs. As pureinfotech summarized it: "Windows Sandbox gives the user an isolated environment, while MXC gives an application or agent a controlled security boundary."

Windows Sandbox does exist as one of MXC's backends on Windows 11 — but it is the experimental one. The default Windows backend is the AppContainer-based process container, and on macOS and Linux MXC uses Seatbelt and Bubblewrap respectively. So when someone says "Microsoft built a sandbox for AI agents into Windows," MXC is the framework and Windows Sandbox is just one of several isolation technologies it can use.

How to Sandbox an AI Coding Agent With MXC

Here is the practical path, in five steps, for a Windows 11 machine:

1. Check your build. MXC process-container isolation needs Windows 11 24H2 at build 26100.9278 or later; the "Process Isolation for MXC" support shipped in the August 27, 2026 preview cumulative update KB5120998. On a managed device, ask IT — Intune management of MXC policies was still listed as coming soon at launch.
2. Use an agent that speaks MXC. As of early November 2026 that means GitHub Copilot, OpenAI Codex, OpenClaw, Replit, LM Studio, or Unsloth AI on their MXC-capable builds.
3. Select the MXC backend. In Codex that is windows.sandbox = "mxc" in the config (or prefer_mxc to prefer it when available; prefer_mxc was still off by default in the standalone CLI at launch). In Copilot CLI, enable the sandbox with the /sandbox command.
4. Start in Learning mode. Let the agent work a normal session and read the JSON agent activity report — it shows every file and network destination the workload tried to use.
5. Tighten, then enforce. Set readwritePaths to the project directory, deniedPaths to secrets and credentials (like .ssh), deny network egress except the package registries and APIs the agent needs, and switch to Enforcement mode for production.

Codex's documentation includes a quick smoke test for the backend: codex -c windows.sandbox=mxc sandbox --include-managed-config --permission-profile :workspace -- cmd.exe /d /c echo MXC_OK. And keep one honest config note in mind, from moorai.dev's testing: mxcCapable: true in a build means MXC is allowed, not that it is switched on — Microsoft rolls the backend out gradually, so verify the sandbox is actually engaged.

What the Policy Boundary Cannot Judge

One caution from independent testing deserves its own section. A boundary answers one question: can this command reach that file or that host? It does not ask whether the agent should be taking this action at all. Two gaps follow from that.

First, the boundary cannot judge intent. If the policy lets the agent read a file containing an API key, and the agent then pastes that key into a tool call that leaves the network, the file rule allowed the read and the leak is in what the agent does with the value. Second, anything inside the allowed area is fair game — a destructive command inside a writable project directory is within policy. MXC contains the commands the agent runs; it does not make the agent wise. That is the layer Microsoft calls identity and manageability, plus the tool-call-level policies other specifications target — and it is why a sandbox is one layer of agent security, not the whole stack.

MXC Requirements and Windows 11 Agent Security

To use MXC today you need Windows 11 24H2 at build 26100.9278 or newer, with the August 27, 2026 preview cumulative update KB5120998 if you need the process-container isolation path. The session container, learning-mode reports, and (forthcoming) Intune management are Windows-only; the process container backend runs on Windows, macOS, and Linux.

Looking ahead, Microsoft says Windows will soon let Microsoft Entra distinguish agent activity from user activity — the identity layer — and will extend Microsoft Agent 365 controls to local on-device agents, the manageability layer. MXC is the containment layer of that three-part plan.

One last disambiguation: MXC is not the same product as the GitHub Copilot Fusion experience Microsoft was talking about this fall — Copilot Fusion is an agent product lane of its own, covered in our Copilot Fusion write-up. MXC is the OS-level containment those agents and others can run inside.

Sources

All sources fetched and checked on November 4, 2026:

• Microsoft Windows Developer Blog — "Microsoft Execution Containers: Policy-driven containment for AI agents," by Logan Iyer, October 7, 2026 (announcement; policy areas, SDKs, modes, support list, Windows 365, Entra/Agent 365 roadmap).
• github.com/microsoft/mxc — repository README (backend table, experimental flags, MIT license, lifecycle, lifecycle mechanics).
• moorai.dev — "MoorAI and Microsoft Execution Containers (MXC)," published October 14, 2026, updated October 29, 2026 (Codex October 9 sandbox mode, policy coverage, boundary-does-not-judge analysis, mxcCapable note).
• canberk.me — "Microsoft Execution Containers (MXC) explained" (technical breakdown, session container, Copilot's backend use, repository facts).
• newsroom.sgit.ai — "Where the platform draws the line," by Dinis Cruz, October 11, 2026 (example policy field names, deny-by-default and numeric network rules).
• swarchitect.net — "Windows MXC Ships With OS-Enforced Agent Permissions" (prefer_mxc default-off, no domain rules, Intune soon).
• platform-monkey.com — MXC review, tested on Ubuntu (Bubblewrap backend, fail-closed refusals, deny-by-default filesystem).
• pureinfotech.com — "Microsoft Execution Containers (MXC) explained" (MXC vs Windows Sandbox distinction).
• windowsforum.com — "OpenAI Codex MXC sandbox on Windows 11" (KB5120998 and build 26100.9278 requirements, Codex test command).

Frequently Asked Questions

What does MXC stand for?

MXC stands for Microsoft Execution Containers — Microsoft's policy-driven execution layer for untrusted code and dynamically generated workloads, generally available since October 7, 2026. A developer or IT team writes a JSON policy declaring what files, network destinations, and UI access a workload may use, and the operating system enforces that boundary independently of the agent itself.

Is MXC free to use?

MXC is open source under the MIT license, so the code is free to use and modify; Microsoft's SDKs are published for Rust, .NET, and Node. The containment itself runs on the host OS — Windows 11, macOS, or Linux — so there is no per-use Microsoft service fee described in the announcement. Enterprise manageability features, like the forthcoming Intune controls and Entra agent identity, will live on the management side.

Does MXC work on macOS and Linux?

Yes — the process container backend, which is the default, runs on Windows 11, macOS, and Linux, using AppContainer on Windows, Seatbelt on macOS, and Bubblewrap on Linux. Some capabilities are Windows-only: the session container, the learning-mode activity reports, and the planned Intune management. The MicroVM backend is experimental on Windows 11 and Linux.

What is the difference between Learning mode and Enforcement mode?

In Learning mode, access outside the policy is blocked but recorded in a JSON activity report, so you can diagnose failures and verify that the policy grants only the access the agent actually needs. In Enforcement mode, ungranted access is simply blocked with no report — that is the production setting. A third mode, Permissive, allows and records ungranted access so you can observe a workload before enforcing anything.

Can an agent escape its MXC policy?

By design, no — the policy lives outside the workload's control, so the agent or code it generates cannot widen its own permissions, and violations are blocked by the operating system. What the policy cannot do is judge intent: a permitted read of a file can still be misused by the agent, and a destructive command inside a writable directory is within policy. MXC is the containment layer; judging whether an action is a good idea remains the job of the layers above it.