# Microsoft Execution Containers

Microsoft's open-source, policy-driven containment layer for AI agents and untrusted code

**Verdict: conditional.** Microsoft Execution Containers is a free, MIT-licensed containment layer: you declare in one JSON policy what an agent may touch, and a process, session, WSL or microVM backend enforces it on Windows 11, macOS and Linux. Conditional because the microVM backend is experimental, the session and WSL backends run only on Windows 11, and Claude Code support is only planned. The evidence we read is Microsoft's own announcement and repository, with no independent security assessment. It suits teams embedding agents in products. Last verified 2026-10-15.

Microsoft Execution Containers (MXC) is a policy-driven execution layer for untrusted code and dynamically generated workloads such as AI agents. Microsoft announced general availability on October 7, 2026, and says Windows 365 support is also GA. A developer declares the resources a workload needs in a unified JSON configuration schema covering the containment environment, process settings, file system access, network connectivity and user interface access, and MXC enforces those boundaries. Four backends are documented: a process container (Windows 11, macOS and Linux, using platform sandboxes), a session container (Windows 11 only, OS-isolated sessions with a separate desktop and clipboard), a WSL container (Windows 11 only) and a microVM (Windows 11 and Linux, marked experimental). The GitHub repository lists defaults of ProcessContainer on Windows 11, Bubblewrap on Linux and Seatbelt on macOS. Three modes exist: Enforcement (operations outside the boundary are restricted), Learning (blocks and records ungranted access in JSON reports) and Permissive (records access the policy would have denied but allows it). SDKs ship for Rust (the mxc-sdk crate), .NET (Microsoft.Mxc.Sdk on NuGet) and Node.js (@microsoft/mxc-sdk on npm). The repository is MIT licensed. Microsoft names GitHub Copilot, OpenClaw, OpenAI Codex, Replit, LM Studio and Unsloth AI as supporting MXC, and lists Claude Code, Box, Egnyte, Perplexity and Raycast as planned.

## Strengths

- Declaring an agent's file, network, process and UI boundaries once in a JSON policy and enforcing it across Windows 11, macOS and Linux
- Finding out what an agent needs before locking it down: Learning mode blocks and records ungranted access in JSON reports
- Embedding containment in your own product through SDKs for Rust, .NET and Node.js under an MIT license
- Windows 11 setups that want a separate desktop and clipboard (session container) or a Linux environment (WSL container)
- Hardware-backed isolation you can rely on today: the microVM backend is marked experimental
- Session or WSL containers on macOS or Linux: those backends are Windows 11 only
- Running Claude Code, Box, Egnyte, Perplexity or Raycast under MXC today: Microsoft lists them as planned, not shipped
- Judging isolation strength independently: the pages we read hold no third-party security assessment

## Pricing

- Model: open-source
- Open source (MIT): $0

Website: https://github.com/microsoft/mxc

## Sources

- [GitHub: microsoft/mxc (MIT, SDKs, platform defaults, experimental backends)](https://github.com/microsoft/mxc)
- [Windows Developer Blog: Microsoft Execution Containers (October 7, 2026)](https://blogs.windows.com/windowsdeveloper/2026/10/07/microsoft-execution-containers-policy-driven-containment-for-ai-agents/)

Canonical: https://neomanex.com/directory/microsoft-execution-containers