Microsoft MXC Is in Public Preview — Here Is How to Sandbox Your AI Agents at the OS Level

Microsoft released Microsoft Execution Containers (MXC) SDK version 0.7.0 in public preview, a policy-driven OS-level execution layer for Windows and WSL that enforces JSON-declared filesystem, network, clipboard, display and input-injection limits on AI agents at the kernel rather than in the application. MXC initializes in single-digit milliseconds, ships as the npm package @microsoft/mxc-sdk, requires Node.js 18+ on Windows 11 24H2, Linux or macOS ARM64/x64, and offers three isolation backends — ProcessContainer, SessionIsolation and a roadmap MicroVM (Nanvix) — with GitHub Copilot CLI already using MXC for local sandboxing.

AI agents run untrusted code by design. Every tool call, plugin invocation, and LLM-generated script is a potential footgun — filesystem overwrites, unexpected outbound calls, clipboard reads. For most teams building agents today, the solution is either a cloud sandbox E2B https://e2b.dev , Daytona, Modal or a duct-taped process wrapper that barely qualifies as isolation. Microsoft has a different answer: stop managing this in your application layer and let the operating system enforce it. That is what Microsoft Execution Containers MXC actually does. What MXC Is MXC is a policy-driven execution layer embedded in Windows and WSL. You write a JSON policy declaring what your agent is allowed to access — specific filesystem paths, outbound network, clipboard, display, input injection. The OS kernel enforces those declarations at runtime. Your application does not enforce anything; the operating system does. That distinction matters. It is not a container runtime. No Docker daemon, no image registry, no Kubernetes overhead. MXC initializes in single-digit milliseconds and ships as an npm package. The current release is SDK version 0.7.0 https://github.com/microsoft/mxc , in public preview since Build 2026: npm install @microsoft/mxc-sdk Requirements: Node.js 18+, Windows 11 24H2, Linux, or macOS ARM64/x64. The Policy Schema The core of MXC is a declarative JSON policy. Here is what a minimal agent sandbox looks like: { "version": "0.6.0-alpha", "backend": "processcontainer", "filesystem": { "readonlyPaths": "/usr/local/bin" , "readwritePaths": "/tmp/agent-workspace" }, "network": { "allowOutbound": false }, "ui": { "clipboard": false, "display": false, "inputInjection": false }, "timeoutMs": 60000 } Everything not explicitly listed in readwritePaths is blocked. Network defaults to no outbound unless you add host-based allow rules. UI access — clipboard, screen capture, input injection — is independently toggleable. You can set a hard execution timeout. The policy model covers the attack surface that actually matters for most agent workloads. Running Code in the Sandbox Two usage patterns: one-shot execution for stateless tasks, and a lifecycle API for multi-step agent workflows. One-shot stateless : js import { spawnSandboxFromConfig, createConfigFromPolicy } from '@microsoft/mxc-sdk'; const config = createConfigFromPolicy { version: '0.6.0-alpha', filesystem: { readwritePaths: '/tmp/work' }, network: { allowOutbound: false }, timeoutMs: 30 000, } ; const result = await spawnSandboxFromConfig config, 'python analyze.py' ; Lifecycle multi-step agents : js const sandbox = await provisionSandbox config ; await startSandbox sandbox ; await execInSandboxAsync sandbox, 'npm install' ; await execInSandboxAsync sandbox, 'npm test' ; await stopSandbox sandbox ; await deprovisionSandbox sandbox ; The lifecycle API is the one you want for any agent that executes more than one command in sequence — coding agents, CI runners, agentic test suites. Three Isolation Levels The backend field in your policy controls how deep the isolation goes: - ProcessContainer — Lightweight, fast. Restricts filesystem and network within the current user session. Right for most coding agent use cases. - SessionIsolation — Runs the agent in a separate session from the user’s desktop. Prevents UI spoofing, clipboard reads, input injection. Right for agents that interact with the GUI or browser. - MicroVM Nanvix — Full hypervisor-backed isolation. On the roadmap; not yet in preview. Right for high-risk workloads where ProcessContainer is not sufficient. Start with processcontainer . Escalate to session isolation only when your agent touches the desktop layer. It Is Already Shipping GitHub Copilot CLI uses MXC for local sandboxing https://github.blog/changelog/2026-06-02-cloud-and-local-sandboxes-for-github-copilot-now-in-public-preview/ , now in public preview. Enable it with /sandbox enable in a Copilot session — shell commands executed by Copilot run with restricted filesystem, network, and system access. No configuration required, included with standard Copilot seats. OpenAI adopted MXC for Codex, Nvidia built it into OpenShell, and Manus the autonomous agent startup ships it in production. Microsoft’s Pavan Davuluri put it plainly: “security, containment, isolation, and user control are essential to making AI agents commercially viable.” The Honest Catch Do not ship MXC to production yet. The documentation is explicit https://blogs.windows.com/windowsdeveloper/2026/06/02/windows-platform-security-for-ai-agents/ : no MXC profiles should be treated as security boundaries currently. SDK 0.7.0 is public preview. Microsoft recommends waiting for v1.0 before production deployment. The enterprise-grade integration — Agent 365, Entra identity binding, Intune policy enforcement, Defender telemetry — is in preview as of July 2026 and still stabilizing. The other real constraint: Windows 11 24H2 minimum for full support. If your agent infrastructure runs on older Windows or Linux-only servers, you will need to rely on the Linux backends Bubblewrap, LXC , which are functional but have less documentation. MXC vs. The Alternatives The cloud sandbox market — E2B Firecracker microVMs , Daytona Docker containers , Modal gVisor — is solving a different problem. Those platforms are built for cloud-hosted agent execution: you spin up a sandbox per API call, pay per second, and discard it. MXC is built for local execution on a managed device. The right comparison is not “which is better” but “where is your agent running.” Use a cloud sandbox when your agent infrastructure is cloud-native and you need GPU access Modal is the only option there . Use MXC when your agents run locally or on managed Windows/WSL machines, and you want OS-level enforcement without per-execution billing. If you are building developer tooling — coding agents, local CI, agentic IDEs — MXC is the right default, once it hits v1.0. Bottom Line MXC is the right architecture. Declaring agent permissions upfront and enforcing them at the OS level is cleaner and more reliable than application-layer sandboxing. The ecosystem adoption — GitHub Copilot, OpenAI, Nvidia — signals this is where agent infrastructure is heading on Windows. The catch is timing: it is not production-ready today. Use it now to build familiarity, design your policies, and test your agent workflows. Wait for v1.0 before shipping it to users who depend on it as a security boundary.