Microsoft Execution Containers: Windows AI Agent Security Explained

Microsoft Execution Containers: the confirmed announcement

Microsoft’s October 7 Windows announcement says Microsoft Execution Containers, or MXC, are generally available on Windows 11. The company describes runtime enforcement of file and network access policies for agents, alongside containment, identity and management capabilities.

The announcement also discusses local and cloud model routing. These are separate parts of a broader platform direction; availability of one component does not mean every announced feature is already on every PC. Microsoft’s Windows announcement is the primary source. We have not tested MXC.

Why enforced boundaries matter

Our analysis: instructions and permissions serve different purposes. Asking an assistant to use only one project folder states your intent. A restriction enforced outside the model can prevent access to other folders even if the model makes a mistake.

Consider an agent that prepares a weekly summary. It may need to read a small set of documents, but it does not automatically need permission to change those documents or send them to an arbitrary destination. The desired boundary follows the task, rather than the broadest capabilities the software offers.

Containment is one layer. A workflow can still produce incorrect content inside an allowed folder, or send an inappropriate message through an authorized integration. Review the resulting actions as well as the access rules.

Questions to ask before a pilot

• Which files are readable, and which are writable?
• Which network destinations can the workflow reach?
• Can the agent access credentials outside its task?
• Who approves sharing, purchases or destructive changes?
• Can you identify the acting agent in logs?
• How can you stop the workflow and revoke access?

Ask the supplier to demonstrate the configured boundary using harmless sample files. An agent refusing a request in conversation is different evidence from an access attempt being blocked by policy. Record the product version and settings so the result can be reproduced.

Start with a task whose output is reviewed before it leaves the organization. Our agent permissions checklist gives a practical starting point; our prompt injection guide explains why external documents should not authorize actions.