Microsoft MXC

Overview

Microsoft eXecution Container (MXC) is Microsoft’s answer to a problem every agent platform hits: how do you let AI-generated code run on a user’s machine without giving it the keys to the kingdom? Announced at Build 2026 and open-sourced under MIT, MXC provides a policy-driven sandbox that works across Windows, Linux, and macOS. Instead of building one isolation technology, Microsoft built a unified policy layer that maps onto the best available containment primitive on each OS — AppContainer on Windows, Seatbelt on macOS, Bubblewrap on Linux — so developers write one JSON policy and get OS-native enforcement everywhere.

The project reached general availability on Windows 11 in October 2026 and is already the engine behind local sandboxing in GitHub Copilot CLI. Adoption extends to OpenAI Codex, Replit, LM Studio, and Unsloth AI, with Claude Code and others announced as coming.

Key Capabilities

Policy-driven isolation: MXC policies are JSON documents that declare what a sandboxed workload can access: filesystem paths (read-only or read-write whitelists), network destinations (allow/block lists with proxy support), and UI resources (clipboard, display, GUI). The critical design choice is that the policy sits outside the workload — an agent running inside the sandbox cannot modify its own permissions.

Learning mode: When building policies from scratch, MXC’s learning mode runs the workload, blocks any action not explicitly granted, and writes a JSON report listing everything that was denied. This makes it practical to write least-privilege policies without guessing what a complex tool chain needs.

Multi-backend architecture: The same JSON policy maps onto AppContainer process containers (Windows 11 24H2+), Seatbelt sandbox profiles (macOS), Bubblewrap with seccomp (Linux), Windows session containers, WSL containers, and an experimental microVM backend. Backend maturity varies — process, session, and WSL containers are GA; the microVM backend is experimental.

Stateful lifecycle: MXC supports both one-shot execution and a stateful provision-start-exec-stop-deprovision flow. The stateful mode keeps a sandbox alive across multiple steps, which matters for agent workflows that execute a sequence of commands in the same environment.

Use Cases

Agent platforms use MXC to sandbox tool calls and code execution on end-user machines. GitHub Copilot CLI uses it to wrap every command an agent runs in OS-level isolation. Development tools embed it to run AI-generated build scripts, tests, or shell commands without risking the host. Enterprise teams use the policy layer to enforce least-privilege controls on agent actions across their fleet.

Considerations

MXC is still maturing. The project README warns that no MXC profiles should currently be treated as definitive security boundaries. Default policies from the SDK are described as overly permissive — authors need to tighten them for production use. On Windows, the primary backend requires Windows 11 24H2 or later. Network proxying on Linux and macOS is cooperative rather than enforced, meaning a determined process could bypass network restrictions. Enterprise management via Intune and Entra is announced but not yet available.

Who It’s For

MXC is built for developers building agent platforms, coding assistants, and AI-powered developer tools who need OS-level sandboxing without building their own isolation layer. It suits teams that need cross-platform support, organizations that want policy-driven controls over what AI agents can access, and anyone building on top of GitHub Copilot’s local execution model.