By ByteBot
October 2026 has been a rough month for AI agent security. GitSpawn let untrusted git repos silently execute code inside Claude Code, Codex, Cursor, and Grok — bypassing both sandboxes and approval dialogs entirely. A compromised LiteLLM release hit an estimated 23 million weekly downloads before PyPI quarantined it. And 82% of enterprises discovered AI agents running in their environment that nobody had authorized. If you’re still relying on your agent to police itself, October 2026 is your wake-up call. Microsoft’s answer — Microsoft Execution Containers (MXC) — went generally available on October 7. The premise is simple: an agent cannot be its own security authority. The OS enforces the boundary, not the model.
What MXC Actually Does
MXC is a policy-driven execution layer. You — the developer or the admin — declare what the agent is allowed to reach: which file paths, which network destinations, whether it can touch the clipboard or the desktop. Windows enforces those limits at runtime, independently of whatever the model decides. The model doesn’t get a vote on whether it can reach ~/.ssh. The container says no, and that’s the end of it.
The SDK is a Rust library you embed in your application. Three language bindings are available today:
- Rust:
mxc-sdkon crates.io - .NET:
Microsoft.Mxc.Sdkon NuGet - Node.js:
@microsoft/mxc-sdkon npm
The full SDK, policy format, and documentation live at github.com/microsoft/mxc.
Four Container Types: Pick the Right One
MXC ships four container types. Three are production-ready. One is experimental and should stay out of your production deploy for now.
| Type | OS Support | Backend | Status | Best For |
|---|---|---|---|---|
| Process | Windows, macOS, Linux | AppContainer / Seatbelt / Bubblewrap | GA | Most workloads — start here |
| Session | Windows 11 only | Separate OS session + desktop | GA | Long-running agents, UI isolation |
| WSL | Windows 11 only | Linux via WSL | GA | Linux-first toolchains on Windows |
| MicroVM | Windows 11, Linux | Hardware VM | Experimental | Highest-risk workloads — not yet |
For most development scenarios, Process containers are where to start: cross-platform, lightweight, and they generate activity reports — which you need to tune your policy. The Session container is the right call if your agent interacts with the desktop, because it completely isolates the agent’s UI surface from the user’s session. Don’t ship MicroVM containers yet; they’re still experimental and the API will change.
Three Modes: The Right Deployment Workflow
MXC ships with three operating modes. Progress through them in order rather than jumping straight to enforcement:
- Permissive — nothing is blocked, everything is logged. Use this during development to understand what your agent actually tries to access before you write a policy.
- Learning — access is blocked and logged. You get a JSON report of what was denied. Use this to validate your policy before production.
- Enforcement — access is blocked with no log. Production mode.
There’s an important limitation here worth flagging: only Process containers generate activity reports. Session, WSL, and MicroVM containers produce no logs from MXC itself — you’re dependent on your EDR tooling for visibility into blocked access in those environments.
Who’s Already Using It
Several tools have MXC built in already: GitHub Copilot, OpenAI Codex, OpenClaw, Replit, LM Studio, Unsloth AI, and NVIDIA OpenShell. If you use any of these on Windows 11, you’re already running inside MXC containers whether you configured them or not.
On the same day MXC went GA, VS Code 1.141 shipped agent sandboxing across Windows, macOS, and Linux. On Windows it uses MXC process containers (experimental flag). On macOS and Linux it uses Seatbelt and Bubblewrap respectively. The setting is chat.agent.sandbox.enabled — MCP servers and language servers are sandboxed by default when it’s enabled.
Claude Code, Perplexity, Box, Manus, and Raycast are listed as coming soon. If you’re building on top of any of those, MXC support is arriving whether you planned for it or not.
What MXC Doesn’t Fix
MXC reduces risk. It does not eliminate it. Three gaps matter.
The Intune gap. Enterprise IT governs software policy through Intune. MXC Intune policies are “coming soon” with no timeline attached. Until they ship, developers declare container policies — not IT admins. In a regulated environment, this means you’re shipping a security control your security team can’t centrally manage yet. Pilot carefully; defer fleet-wide deployments.
The audit gap. Only Process containers log blocked access. If you’re running Session or WSL containers and something gets denied, you won’t see it in MXC telemetry. EDR coverage is required to fill that gap.
The social engineering ceiling. A user can still be tricked into approving something, and a misconfigured allow-list can grant more access than intended. Container policy is a floor, not a ceiling.
Where to Start
If you’re building or deploying AI agents today, the practical starting point is a Process container in Learning mode. Install the SDK for your stack, declare a conservative initial policy — read-only project directory, no network, no desktop — and run it in Learning mode for a sprint to see what your agent actually needs. Tighten from there into Enforcement mode before you ship.
The October 2026 attack surface for AI agents is real and getting wider. GitSpawn still has four unpatched flaws across major coding agents. MXC doesn’t patch those vulnerabilities — but it does mean that if a malicious repo tries to execute code in your agent’s environment, it hits a policy wall the model can’t override. That’s a meaningful layer to add right now.
