# Microsoft MXC Is in Public Preview — Here Is How to Sandbox Your AI Agents at the OS Level > Source: > Published: 2026-09-27 20:08:39+00:00 AI agents run untrusted code by design. Every tool call, plugin invocation, and LLM-generated script is a potential footgun — filesystem overwrites, unexpected outbound calls, clipboard reads. For most teams building agents today, the solution is either a cloud sandbox ([E2B](https://e2b.dev), Daytona, Modal) or a duct-taped process wrapper that barely qualifies as isolation. Microsoft has a different answer: stop managing this in your application layer and let the operating system enforce it. That is what **Microsoft Execution Containers (MXC)** actually does. ## What MXC Is MXC is a policy-driven execution layer embedded in Windows and WSL. You write a JSON policy declaring what your agent is allowed to access — specific filesystem paths, outbound network, clipboard, display, input injection. The OS kernel enforces those declarations at runtime. Your application does not enforce anything; the operating system does. That distinction matters. It is not a container runtime. No Docker daemon, no image registry, no Kubernetes overhead. MXC initializes in single-digit milliseconds and ships as an npm package. The current release is [SDK version 0.7.0](https://github.com/microsoft/mxc), in public preview since Build 2026: ``` npm install @microsoft/mxc-sdk ``` Requirements: Node.js 18+, Windows 11 24H2, Linux, or macOS ARM64/x64. ## The Policy Schema The core of MXC is a declarative JSON policy. Here is what a minimal agent sandbox looks like: ``` { "version": "0.6.0-alpha", "backend": "processcontainer", "filesystem": { "readonlyPaths": ["/usr/local/bin"], "readwritePaths": ["/tmp/agent-workspace"] }, "network": { "allowOutbound": false }, "ui": { "clipboard": false, "display": false, "inputInjection": false }, "timeoutMs": 60000 } ``` Everything not explicitly listed in `readwritePaths` is blocked. Network defaults to no outbound unless you add host-based allow rules. UI access — clipboard, screen capture, input injection — is independently toggleable. You can set a hard execution timeout. The policy model covers the attack surface that actually matters for most agent workloads. ## Running Code in the Sandbox Two usage patterns: one-shot execution for stateless tasks, and a lifecycle API for multi-step agent workflows. **One-shot (stateless):** ``` js import { spawnSandboxFromConfig, createConfigFromPolicy } from '@microsoft/mxc-sdk'; const config = createConfigFromPolicy({ version: '0.6.0-alpha', filesystem: { readwritePaths: ['/tmp/work'] }, network: { allowOutbound: false }, timeoutMs: 30_000, }); const result = await spawnSandboxFromConfig(config, 'python analyze.py'); ``` **Lifecycle (multi-step agents):** ``` js const sandbox = await provisionSandbox(config); await startSandbox(sandbox); await execInSandboxAsync(sandbox, 'npm install'); await execInSandboxAsync(sandbox, 'npm test'); await stopSandbox(sandbox); await deprovisionSandbox(sandbox); ``` The lifecycle API is the one you want for any agent that executes more than one command in sequence — coding agents, CI runners, agentic test suites. ## Three Isolation Levels The `backend` field in your policy controls how deep the isolation goes: - **ProcessContainer** — Lightweight, fast. Restricts filesystem and network within the current user session. Right for most coding agent use cases. - **SessionIsolation** — Runs the agent in a separate session from the user’s desktop. Prevents UI spoofing, clipboard reads, input injection. Right for agents that interact with the GUI or browser. - **MicroVM (Nanvix)** — Full hypervisor-backed isolation. On the roadmap; not yet in preview. Right for high-risk workloads where ProcessContainer is not sufficient. Start with `processcontainer`. Escalate to session isolation only when your agent touches the desktop layer. ## It Is Already Shipping [GitHub Copilot CLI uses MXC for local sandboxing](https://github.blog/changelog/2026-06-02-cloud-and-local-sandboxes-for-github-copilot-now-in-public-preview/), now in public preview. Enable it with `/sandbox enable` in a Copilot session — shell commands executed by Copilot run with restricted filesystem, network, and system access. No configuration required, included with standard Copilot seats. OpenAI adopted MXC for Codex, Nvidia built it into OpenShell, and Manus (the autonomous agent startup) ships it in production. Microsoft’s Pavan Davuluri put it plainly: “security, containment, isolation, and user control are essential to making AI agents commercially viable.” ## The Honest Catch Do not ship MXC to production yet. [The documentation is explicit](https://blogs.windows.com/windowsdeveloper/2026/06/02/windows-platform-security-for-ai-agents/): no MXC profiles should be treated as security boundaries currently. SDK 0.7.0 is public preview. Microsoft recommends waiting for v1.0 before production deployment. The enterprise-grade integration — Agent 365, Entra identity binding, Intune policy enforcement, Defender telemetry — is in preview as of July 2026 and still stabilizing. The other real constraint: Windows 11 24H2 minimum for full support. If your agent infrastructure runs on older Windows or Linux-only servers, you will need to rely on the Linux backends (Bubblewrap, LXC), which are functional but have less documentation. ## MXC vs. The Alternatives The cloud sandbox market — E2B (Firecracker microVMs), Daytona (Docker containers), Modal (gVisor) — is solving a different problem. Those platforms are built for cloud-hosted agent execution: you spin up a sandbox per API call, pay per second, and discard it. MXC is built for local execution on a managed device. The right comparison is not “which is better” but “where is your agent running.” Use a cloud sandbox when your agent infrastructure is cloud-native and you need GPU access (Modal is the only option there). Use MXC when your agents run locally or on managed Windows/WSL machines, and you want OS-level enforcement without per-execution billing. If you are building developer tooling — coding agents, local CI, agentic IDEs — MXC is the right default, once it hits v1.0. ## Bottom Line MXC is the right architecture. Declaring agent permissions upfront and enforcing them at the OS level is cleaner and more reliable than application-layer sandboxing. The ecosystem adoption — GitHub Copilot, OpenAI, Nvidia — signals this is where agent infrastructure is heading on Windows. The catch is timing: it is not production-ready today. Use it now to build familiarity, design your policies, and test your agent workflows. Wait for v1.0 before shipping it to users who depend on it as a security boundary.