Microsoft Launches MXC to Sandbox AI Agents and Stop Rogue Code
Microsoft Execution Containers are now GA, giving developers a cross-platform JSON layer to sandbox AI agents before they break production.
Tools · Source: Hacker News
What happened
Microsoft just made Microsoft Execution Containers generally available. MXC is a policy-driven sandbox layer for AI agents. It stops untrusted generated code from wrecking host systems. Developers use a single JSON file to define exactly what files, networks, and user interfaces an agent can touch.
The system maps these rules to native containers across Windows, macOS, and Linux. You get lightweight process containers for quick tasks and hardware-backed MicroVMs for high-risk workloads. Windows 11 users get exclusive session containers that isolate the agent completely from the user desktop and clipboard.
MXC includes three operating modes to help developers build rules. Enforcement mode blocks unauthorized access. Learning mode blocks access and records the attempt. Permissive mode lets the action happen but logs what would have been blocked. Major players like GitHub Copilot, Replit, and OpenAI Codex already support the standard. NVIDIA has also integrated OpenShell into MXC for advanced network controls and credential management.
Key facts
- 1.0.0 — Version of Microsoft Execution Containers now generally available
- 3 — Operating modes available: Enforcement, Learning, and Permissive
- 4 — Types of containment backends: Process, Session, WSL, and MicroVM
Why it matters
Building autonomous agents just got much safer. An agent cannot be its own security authority. You no longer have to choose between giving an agent full system access or crippling its usefulness. You can let a coding agent read a repository and run Git, while strictly blocking it from touching personal documents or opening outbound network connections.
Enterprise adoption of AI agents will accelerate because of this. Microsoft is tying MXC into Entra ID and Intune. Soon, IT admins will track agent identity separately from user identity in Microsoft Agent 365. If an agent goes rogue, security tools will kill the agent without locking the human employee out of their machine. One misbehaving agent will not ruin the workday.
For builders
Write cross-platform sandbox policies once
You define the resource limits in a unified JSON schema. MXC translates this to AppContainer on Windows, Seatbelt on macOS, or Bubblewrap on Linux. You save massive development time while securing your agent.
Test agent boundaries without breaking workloads
Use Permissive mode to observe what your agent tries to access. MXC records the denied actions but lets them run. You can build a perfect least-privilege policy based on actual behavior.
Prepare for strict enterprise IT overrides
Organizations will use Microsoft Intune to override your default agent permissions. You must design your agents to handle blocked resources gracefully instead of failing silently. Enterprise buyers will reject agents that crash when denied access.
My take
I love seeing Microsoft solve the actual plumbing of AI instead of just shipping more chat boxes. Building agents that can wipe a hard drive is terrifying. MXC gives founders a standardized way to lock down agents, which is exactly what we need to sell autonomous tools to paranoid enterprise buyers.
Original reporting: Hacker News. This is my rewrite and opinion.