{"resourceId":"microsoft-windows-dev-blog-mxc-ga-agent-containment-openshell-20261007","versions":[{"version":"external-ecba71cc96628c69ba45225f1fc2e223ce842decc5f401620a8438a55ce3da15","resource":{"id":"microsoft-windows-dev-blog-mxc-ga-agent-containment-openshell-20261007","title":"Microsoft: Execution Containers (MXC) for AI agents are generally available; NVIDIA OpenShell is integrated, but Intune management and Entra agent identity are still 'coming soon'","organization":"Microsoft (with NVIDIA OpenShell integration)","sector":"Technology vendor (operating system / agent security)","geography":"Global","publishedAt":"2026-10-07","publicationDate":"2026-10-07","eventDate":"2026-10-07","sourceName":"Windows Developer Blog","sourceLabel":"Vendor announcement (NVIDIA partner)","sourceUrl":"https://blogs.windows.com/windowsdeveloper/2026/10/07/microsoft-execution-containers-policy-driven-containment-for-ai-agents/","evidenceClass":"vendor-claim","outcomeClass":"emerging","topics":["developers-agents","data-security","governance-procurement"],"finding":"Microsoft announced general availability of MXC, a policy-driven layer that runs agents, generated code, plugins or tools inside a container whose file, network, process and UI permissions are declared outside the agent's control. Backends are a process container (Windows 11, macOS, Linux), a session container and WSL container (Windows 11 only) and a MicroVM (experimental). Enforcement, Learning (block and record) and Permissive (allow and record) modes support policy authoring. Microsoft says NVIDIA has integrated OpenShell into MXC, adding inference-access, network and credential controls and OCSF auditing. Intune management of MXC process containers 'will soon be available', and Entra separation of agent from user activity is 'coming soon'.","sledRelevance":"State agencies, school districts and universities piloting coding or productivity agents on Windows need a way to stop an agent acting with the user's full authority. MXC plus OpenShell is the first OS-level option tied to NVIDIA's agent stack, but the controls IT departments actually use to manage endpoints (Intune policy, Entra identity) are not yet available, so early use is developer-managed.","evidence":"Opened and read the full Windows Developer Blog post (Oct 7, 2026). Also opened the microsoft/mxc GitHub README for corroboration. Vendor description with no independent testing or performance data.","architectureImplications":"Developers embed the MXC SDK (Rust, .NET, Node) and declare a JSON policy; MXC maps it to AppContainer, Seatbelt or Bubblewrap and other backends. Organizations can layer management policy on top once Intune support arrives. OpenShell sits above MXC for inference routing, egress control and audit.","governanceImplications":"Until Intune policy and Entra agent identity ship, organizations cannot centrally govern which agents create containers or attribute agent actions separately from users; governance relies on each agent developer's declared policy.","securityPrivacyImplications":"Containment backends have different security properties; Microsoft says workloads should be matched to backend. The MXC README warns its audit mode turns off all sandbox security and must never run untrusted code, and marks several Windows backends experimental. Permissive mode allows denied operations, so it should not be used in production.","caveats":"Vendor announcement; no independent evaluation. Enterprise management (Intune) and identity (Entra/Agent 365 for local agents) are announced, not available. The list of agents 'releasing support' is forward-looking.","streamIds":["nvidia"],"roles":{"sales":"MXC gives public-sector security teams a concrete answer to the question blocking agent pilots: what stops an agent touching files and networks it should not? The honest framing is that containment is available now but central management is not. We can offer a policy-design workshop for one agent use case. We should not claim MXC or OpenShell makes agents safe for sensitive data today, or that IT can manage them through Intune yet; Microsoft says those controls are coming.","engineering":"Fit is strongest for developer-led agent pilots on Windows 11 where the team can embed the SDK or use an MXC-integrated agent such as GitHub Copilot. Architecture: per-workload JSON policy, choice of process, session, WSL or experimental MicroVM backend, with OpenShell adding egress and audit. Constraints are missing Intune and Entra integration and experimental backends. Proof of value: run one agent in Learning mode, review the activity report, then switch to Enforcement and attempt out-of-policy actions.","delivery":"Delivery work is writing, testing and maintaining per-agent containment policies until central management arrives. Security engineering should own policy approval; developers own the declared policy. Checkpoints are policy review after Learning mode, an out-of-policy test, and a re-review when Intune policy becomes available. Proposed acceptance: every piloted agent runs in Enforcement mode with a reviewed policy and blocked attempts are logged. Risk: Permissive or audit modes left on after testing."},"roleDetails":{"sales":{"customerProblem":"Agencies and campuses want to pilot AI agents on Windows without letting them act with the user's full file and network authority.","stakeholders":["CISO / information security office","Endpoint management lead","Developer platform or innovation team","Privacy officer"],"discoveryQuestions":["Which agents are staff already running on Windows devices?","How do you approve what an agent can reach today?","Do you need central policy through Intune before any pilot?"],"valueHypothesis":"OS-level containment may let a security office approve narrowly scoped agent pilots sooner than a blanket ban or blanket allow (interpretation).","potentialEngagement":"A one-agent containment pilot: design, test in Learning mode, enforce, and document the policy and logs for security review.","unsupportedClaims":["Agents are safe for sensitive data today","Central Intune management available now","Agent identity separated in Entra today","Measured reduction in incidents"]},"engineering":{"fit":"Good for developer-led pilots on Windows 11 using MXC-integrated agents or custom agents that can embed the SDK.","architectureIntegration":"MXC SDK with JSON policy maps to process, session, WSL or MicroVM backends; OpenShell adds inference routing, network and credential controls and OCSF audit above it.","prerequisites":["Windows 11 devices","MXC-integrated agent or SDK integration","A written least-privilege policy per agent","Log collection for activity reports"],"constraints":["Intune policy not yet available","Entra agent identity not yet available","MicroVM and some Windows backends experimental","Policies must be maintained per agent"],"security":"Policy is enforced outside the agent; avoid audit and Permissive modes in production; choose VM-backed isolation for untrusted or sensitive workloads where available.","proofOfValue":["Run an agent in Learning mode and review the activity report","Attempt out-of-policy file and network actions in Enforcement mode","Confirm logs reach the security team's tooling"]},"delivery":{"work":"Author, test and maintain per-agent MXC policies for pilot agents and plan migration to Intune-managed policy when available.","dependencies":["MXC-capable agents","Security office review capacity","Future Intune and Entra releases"],"ownership":"Security engineering approves and owns containment policy; agent developers maintain declared resource needs.","skillsAdoption":"Developers and security staff learn MXC policy schema, operating modes and activity-report review.","governanceCheckpoints":["Policy review after Learning mode","Out-of-policy test before enforcement","Re-review when Intune policy ships"],"acceptanceCriteria":["Every piloted agent runs in Enforcement mode with a reviewed policy (proposed)","Blocked attempts are logged and reviewed weekly (proposed)"],"risks":["Permissive or audit mode left enabled","Policy sprawl across agents","Reliance on announced but unshipped management features"]}},"retrievedAt":"2026-10-08T02:58:52Z","enrichedAt":"2026-10-08T03:09:35Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Session containers separate agent desktops and input from the user's; accessibility tooling interactions with contained agents are not described.","procurementImplications":"When buying agent tools, ask vendors whether they support MXC containment, which backend they use, and what policy they declare by default.","operatingModelImplications":"Agent permissions become an explicit, reviewable artifact; security teams gain a new policy-review duty per agent.","sourceVerification":{"openedUrl":"https://blogs.windows.com/windowsdeveloper/2026/10/07/microsoft-execution-containers-policy-driven-containment-for-ai-agents/","referenceExcerpt":"Intune policy will soon be available to manage MXC process containers used by MXC-integrated agents on Windows 11.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}