Microsoft Introduces Execution Containers to Stop AI Agents From Accessing Unauthorised Files

Microsoft is expanding the use of a security technology designed to control what artificial intelligence agents can access and do on computers.

The technology, called Microsoft Execution Containers (MXC), allows developers and organisations to restrict AI agents to approved files, applications, and network resources.

Microsoft made MXC generally available on October 7, 2026.

During the company’s earnings call on October 28, CEO Satya Nadella highlighted growing adoption of the technology, including support from major AI developers.

OpenAI, Anthropic, and other companies are working with Microsoft’s containment approach as AI agents become more capable of interacting with computers.

But why do AI agents need special security controls, and how do execution containers work?

What Are AI Agents?

An AI agent is an artificial intelligence system designed to perform tasks involving several connected steps.

For example, a conventional chatbot might explain how to organise files on a computer.

An AI agent with the necessary permissions could potentially open folders, identify files, rename documents, or organise information.

Some agents can also write code, access websites, or work with connected applications.

These capabilities can improve productivity.

However, they also introduce new security risks.

An AI agent given too much access could accidentally change important files or interact with systems unrelated to its assigned task.

What Are Microsoft Execution Containers?

Microsoft Execution Containers, commonly called MXC, provide restricted environments for running AI agents and related workloads.

A container is a computing environment designed to limit how software interacts with the wider system.

Think about a company office where employees have access cards.

A receptionist may be allowed into the reception area but not into the server room.

An IT administrator may have access to technical systems that ordinary employees cannot use.

MXC applies a similar principle to AI agents.

Instead of giving an AI agent unrestricted access to the computer, developers can specify which resources it is allowed to use.

Microsoft then enforces those restrictions through the operating environment.

How Does MXC Work?

Imagine a developer asks an AI agent to improve a website.

The agent needs to read and modify the website’s source code.

It may also need access to development tools.

However, it does not need access to the developer’s private photographs, personal documents, or banking information.

With MXC, developers can create policies defining the resources the agent can use.

For example, the AI agent could receive permission to read and modify one project folder.

Access to unrelated folders could be blocked.

The agent could also be restricted from connecting to certain network destinations.

Importantly, Microsoft says these restrictions are enforced outside the AI agent’s control.

This means the agent should not be able to give itself additional permissions simply by generating different instructions.

What Can MXC Restrict?

Microsoft describes several types of controls.

1. File Access

MXC can restrict which files and folders an AI agent can read or modify.

For example, a coding agent could be allowed to work inside a software project while being blocked from unrelated personal files.

2. Network Access

Developers can specify which network connections are permitted.

For example, an agent might need access to a particular development service but not unrestricted internet access.

3. Computer Processes

MXC can control how an agent’s workload starts and which applications it is allowed to run.

4. Desktop Interaction

Some AI agents can interact with a computer’s graphical interface.

MXC can help separate an agent’s activity from the user’s main desktop session.

5. Organisational Policies

Businesses can apply additional security restrictions through central management tools.

For example, an IT administrator might restrict AI agents from accessing sensitive company folders.

Why Is This Important for AI Security?

Traditional software often follows instructions defined by developers.

AI agents are different because they may generate their own steps while completing a task.

For example, a coding agent might decide that it needs to inspect additional files or run a command.

This flexibility is useful, but it creates uncertainty.

An agent could misunderstand instructions or attempt actions beyond its intended scope.

Security researchers are also concerned about prompt injection.

Prompt injection occurs when an attacker places misleading instructions in information that an AI system processes.

For example, a malicious document might contain instructions intended to make an AI assistant reveal sensitive information.

Security boundaries can reduce the damage such attacks might cause.

However, containment is only one part of AI security and cannot eliminate every risk.

Which AI Companies Support MXC?

Microsoft identifies several agents and development tools that support its execution container technology.

These include OpenAI Codex, GitHub Copilot, Replit, OpenClaw, and other tools.

Microsoft has also identified planned integrations involving Anthropic Claude Code and additional AI platforms.

During the October 28 earnings call, Microsoft’s CEO discussed broader adoption involving OpenAI, Anthropic, and Meta’s Muse.

However, support and deployment stages differ between products.

Some integrations are already available, while others are planned or being introduced gradually.

Does MXC Work Only on Windows?

No.

Microsoft describes MXC as a technology that can support workloads across Windows, macOS, and Linux through different containment systems.

However, some specific execution options are only available on certain operating systems.

For example, Windows session containers and Windows Subsystem for Linux containers depend on Windows-specific capabilities.

The level of isolation also varies depending on the chosen container type.

Developers need to select the appropriate protection mechanism for their applications.

Can MXC Protect Personal Computers?

MXC is intended to help improve security when people use AI agents on personal and work computers.

For example, someone using a coding assistant may want the AI to access a programming project without accessing unrelated personal information.

Microsoft says execution containers can enforce resource boundaries for compatible agents.

However, simply installing Windows does not mean every AI application is automatically protected by MXC.

Protection depends on the application, its integration, and the configured policies.

Users should continue checking permissions before allowing AI tools to access their files or accounts.

Will AI Agents Become More Common?

AI agents are increasingly being developed to assist with software engineering, administrative work, research, and business operations.

For example, companies are experimenting with agents that prepare reports, investigate technical incidents, and support customer service.

As these tools become more capable, the need for reliable access controls will become more important.

An organisation may be comfortable allowing an AI agent to summarise documents.

It may require stronger safeguards before allowing the agent to modify financial records or delete information.

Technologies such as MXC could help support this distinction.

What Does This Mean for African Developers and Businesses?

Developers in Africa are increasingly exploring AI agents and workflow automation.

For example, a Kenyan software company might use an AI coding assistant to build and maintain applications.

A business might connect an AI agent to an inventory or customer management system.

These integrations can be useful, but access must be carefully controlled.

An inventory reporting agent may need permission to read stock information.

It should not automatically receive permission to delete products or change financial records.

Developers should apply the principle of least privilege.

This means giving a user or software system only the access necessary to complete its assigned task.

How Can Beginners Use AI Agents More Safely?

People using AI agents should understand the permissions they grant.

Useful practices include reviewing connected applications, restricting access to sensitive files, testing automation with non-sensitive information, and keeping backups.

Developers should also maintain logs of important actions.

For example, if an AI agent modifies a database, the system should make it possible to identify what changed.

High-impact actions, such as deleting records or transferring money, should require appropriate approvals.

These precautions remain important even when a containment technology is available.

QueryFun Take: AI Agents Need Rules, Not Just Intelligence

Microsoft Execution Containers highlights an important challenge in artificial intelligence.

AI agents are becoming capable of performing tasks that previously required direct human interaction with computers.

However, greater capability should not automatically mean greater access.

An AI agent that can write code does not need unrestricted permission to read every file.

An AI assistant that prepares reports does not need authority to delete financial records.

The most useful AI systems will combine capability with carefully designed security controls.

For students interested in software development, cybersecurity, and AI automation, understanding permissions, operating systems, and secure application design will become increasingly valuable.

Frequently Asked Questions

What are Microsoft Execution Containers?

MXC is Microsoft’s technology for running AI agents and workloads within restricted computing environments.

When did Microsoft launch MXC?

Microsoft made MXC generally available on October 7, 2026.

What was new about the October 29 news?

Microsoft’s leadership highlighted adoption of MXC by major AI developers during its October 28 earnings call, with media coverage following on October 29.

Can MXC stop AI agents from accessing private files?

It can restrict file access for compatible agent workloads when the appropriate policies are configured.

Does MXC make AI agents completely safe?

No. It reduces certain risks through containment but does not eliminate every possible security weakness.

Does OpenAI Codex support MXC?

Microsoft identifies Codex among the agent tools supporting MXC.

Can developers use MXC on Linux or macOS?

Microsoft provides a cross-platform framework, although the available containment mechanisms and capabilities differ by operating system.

What is the principle of least privilege?

It means giving a user, application, or AI agent only the permissions necessary to perform its task.

Primary sources:

Microsoft: Execution Containers for AI Agents

Microsoft: Building Windows for Hybrid Intelligence