From the NVIDIA edition of October 7, 2026
Microsoft: Execution Containers (MXC) for AI agents are generally available; NVIDIA OpenShell is integrated, but Intune management and Entra agent identity are still 'coming soon'
Microsoft (with NVIDIA OpenShell integration) · Technology vendor (operating system / agent security) · Global
- Publisher
- Windows Developer Blog
- Original publication
- 2026-10-07
- Source retrieved
- 2026-10-08
- Event date
- 2026-10-07
What happened
Microsoft announced general availability of MXC, a policy-driven layer that runs agents, generated code, plugins or tools inside a container whose file, network, process and UI permissions are declared outside the agent's control. Backends are a process container (Windows 11, macOS, Linux), a session container and WSL container (Windows 11 only) and a MicroVM (experimental). Enforcement, Learning (block and record) and Permissive (allow and record) modes support policy authoring. Microsoft says NVIDIA has integrated OpenShell into MXC, adding inference-access, network and credential controls and OCSF auditing. Intune management of MXC process containers 'will soon be available', and Entra separation of agent from user activity is 'coming soon'.
Why it matters
State agencies, school districts and universities piloting coding or productivity agents on Windows need a way to stop an agent acting with the user's full authority. MXC plus OpenShell is the first OS-level option tied to NVIDIA's agent stack, but the controls IT departments actually use to manage endpoints (Intune policy, Entra identity) are not yet available, so early use is developer-managed.
Evidence and measured results
Opened and read the full Windows Developer Blog post (Oct 7, 2026). Also opened the microsoft/mxc GitHub README for corroboration. Vendor description with no independent testing or performance data.
Limitations and uncertainty
Vendor announcement; no independent evaluation. Enterprise management (Intune) and identity (Entra/Agent 365 for local agents) are announced, not available. The list of agents 'releasing support' is forward-looking.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-10-08; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Agencies and campuses want to pilot AI agents on Windows without letting them act with the user's full file and network authority.
- Stakeholders
- CISO / information security office
- Endpoint management lead
- Developer platform or innovation team
- Privacy officer
- Discovery questions
- Which agents are staff already running on Windows devices?
- How do you approve what an agent can reach today?
- Do you need central policy through Intune before any pilot?
- Value hypothesis
- OS-level containment may let a security office approve narrowly scoped agent pilots sooner than a blanket ban or blanket allow (interpretation).
- Potential engagement
- A one-agent containment pilot: design, test in Learning mode, enforce, and document the policy and logs for security review.
- Unsupported claims
- Agents are safe for sensitive data today
- Central Intune management available now
- Agent identity separated in Entra today
- Measured reduction in incidents
Pre-sales engineering
Role takeaway
- Fit
- Good for developer-led pilots on Windows 11 using MXC-integrated agents or custom agents that can embed the SDK.
- Architecture and integration
- MXC SDK with JSON policy maps to process, session, WSL or MicroVM backends; OpenShell adds inference routing, network and credential controls and OCSF audit above it.
- Prerequisites
- Windows 11 devices
- MXC-integrated agent or SDK integration
- A written least-privilege policy per agent
- Log collection for activity reports
- Constraints
- Intune policy not yet available
- Entra agent identity not yet available
- MicroVM and some Windows backends experimental
- Policies must be maintained per agent
- Security
- Policy is enforced outside the agent; avoid audit and Permissive modes in production; choose VM-backed isolation for untrusted or sensitive workloads where available.
- Proof of value
- Run an agent in Learning mode and review the activity report
- Attempt out-of-policy file and network actions in Enforcement mode
- Confirm logs reach the security team's tooling
Delivery
Role takeaway
- Work
- Author, test and maintain per-agent MXC policies for pilot agents and plan migration to Intune-managed policy when available.
- Dependencies
- MXC-capable agents
- Security office review capacity
- Future Intune and Entra releases
- Ownership
- Security engineering approves and owns containment policy; agent developers maintain declared resource needs.
- Skills and adoption
- Developers and security staff learn MXC policy schema, operating modes and activity-report review.
- Governance checkpoints
- Policy review after Learning mode
- Out-of-policy test before enforcement
- Re-review when Intune policy ships
- Acceptance criteria
- Every piloted agent runs in Enforcement mode with a reviewed policy (proposed)
- Blocked attempts are logged and reviewed weekly (proposed)
- Risks
- Permissive or audit mode left enabled
- Policy sprawl across agents
- Reliance on announced but unshipped management features
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Developers embed the MXC SDK (Rust, .NET, Node) and declare a JSON policy; MXC maps it to AppContainer, Seatbelt or Bubblewrap and other backends. Organizations can layer management policy on top once Intune support arrives. OpenShell sits above MXC for inference routing, egress control and audit.
Governance
Who approves, reviews and stays accountable for outcomes?
Until Intune policy and Entra agent identity ship, organizations cannot centrally govern which agents create containers or attribute agent actions separately from users; governance relies on each agent developer's declared policy.
Security and privacy
What data, permissions and controls need testing?
Containment backends have different security properties; Microsoft says workloads should be matched to backend. The MXC README warns its audit mode turns off all sandbox security and must never run untrusted code, and marks several Windows backends experimental. Permissive mode allows denied operations, so it should not be used in production.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Session containers separate agent desktops and input from the user's; accessibility tooling interactions with contained agents are not described.
Procurement
What should contracts, pricing and exit terms secure?
When buying agent tools, ask vendors whether they support MXC containment, which backend they use, and what policy they declare by default.
Operating model
Which teams own the service once it runs?
Agent permissions become an explicit, reviewable artifact; security teams gain a new policy-review duty per agent.
Publication history
- 2026-10-07NVIDIA · Issue 328 resources
Stable resource ID: microsoft-windows-dev-blog-mxc-ga-agent-containment-openshell-20261007