Microsoft MXC Guide 2026: Sandbox AI Agents at the OS Level

Microsoft Execution Containers (MXC) launched at Build 2026 as the first OS-level sandboxing system designed specifically for AI agents. The premise: agents run untrusted code - model outputs, plugins, tool calls - and that code needs containment before it touches your filesystem, network, or clipboard.

MXC solves this with a declarative JSON policy that specifies exactly what an agent can access. The OS enforces those boundaries at runtime, before any code executes. OpenAI and NVIDIA adopted it at launch, which signals where agentic security is heading.

Last updated: October 19, 2026. @microsoft/mxc-sdk 1.0.1 is current (1.0.0 shipped October 6, 2026).

Updated October 19, 2026: The code in the original version of this post did not match the SDK. Even against 0.7.0, the release it named, spawnSandboxFromConfig() took a config with process.commandLine set rather than a command string, the state-aware functions took a backend name (only isolation_session) and a sandbox ID rather than a config object, and the UI and network policy keys were wrong. Since then, 1.0 replaced the whole surface: public APIs now live at @microsoft/mxc-sdk/v1 (the package root exports nothing), you pass a ContainerRequest to run() or spawn() instead of building a versioned config, network policy is directional (egress and ingress), and Node.js 24 or later is required. Every sample below is now adapted from the 1.0.1 SDK README or the MXC repository README and checked against the package's type definitions.

What MXC Actually Does#

MXC is a sandboxed code execution system for running untrusted code on Windows, Linux, and macOS. It provides multiple containment backends - from process sandboxes to full VMs - behind a unified JSON configuration schema and TypeScript SDK.

The key insight: instead of asking developers to implement their own sandboxing, MXC gives you a single policy declaration. Specify what files, network access, and UI capabilities your agent needs. MXC handles the enforcement.

// Adapted from the @microsoft/mxc-sdk 1.0.1 README
import { getPlatformSupport, run } from '@microsoft/mxc-sdk/v1';
import type { ContainerRequest } from '@microsoft/mxc-sdk/v1';

if (!getPlatformSupport().isSupported) {
  throw new Error('MXC is not available on this host');
}

const request: ContainerRequest = {
  filesystem: { readonlyPaths: [process.cwd()] },
  network: { egress: { default: 'deny' } },
  timeoutMs: 30_000,
  command: 'node my-agent.js',
};

const output = await run(request);
console.log(output.stdout, output.exitCode);

run() resolves with captured stdout, stderr, the exit code and whether the workload timed out. The SDK picks the wire contract version itself; callers no longer pass a schema version.

Platform Support#

MXC runs natively on all major platforms. Each has its own default backend and alternatives:

The backend choice determines the isolation strength. ProcessContainer is lightweight but weaker. MicroVM gives full VM isolation but higher overhead. MXC lets you choose based on your threat model.

Installation and Setup#

Requirements#

• Node.js 24 or later for SDK 1.0 (on Windows, native stdio transfer needs Node 24.21.0+ or 26.8.0+). The 0.x SDK needed Node 18.
• Rust 1.93 (pinned in src/rust-toolchain.toml) only if building from source
• Windows 11, Linux x64/ARM64, or macOS ARM64/x64

Install the SDK#

npm install @microsoft/mxc-sdk

The Node package bundles the native runtime assets for each platform, so it is large (over 100 MB unpacked for 1.0.1). There are also Rust (mxc-sdk on crates.io) and .NET (Microsoft.Mxc.Sdk) SDKs.

Build from Source (Optional)#

Only needed when you are changing MXC itself or want the standalone executor binaries. Per the repository README:

build.bat --all          # Windows: release build for the current architecture
./build.sh --all         # Linux: release build
./build-mac.sh --all     # macOS: release build for the native architecture

Configuration Schema#

Underneath, MXC's executors accept versioned JSON container-creation requests defined by the schemas in schemas/stable/ (development schemas live in schemas/dev/). With the 1.0 SDK you rarely write that JSON yourself: you describe the same policy as a typed ContainerRequest and the SDK maps it to the current contract.

Basic Request#

import { run, policy } from '@microsoft/mxc-sdk/v1';

const tools = policy.filesystem.getAvailableToolsPolicy(process.env); // dirs from PATH and tool env vars
const temp = policy.filesystem.getTemporaryFilesPolicy();             // TEMP/TMP, or TMPDIR or /tmp

const result = await run({
  command: 'python analyze.py',
  filesystem: {
    readonlyPaths: tools.readonlyPaths,
    readwritePaths: [...temp.readwritePaths, '/tmp/agent-workspace'],
  },
  network: { egress: { default: 'deny' } },
  ui: { disable: true, clipboard: 'none' },
  timeoutMs: 60_000,
});

The containment field selects a backend; omit it and the SDK uses the host's native process backend (ProcessContainer, Bubblewrap or Seatbelt).

Filesystem Policies#

MXC gives granular control over what the sandboxed code can read and write:

• readonlyPaths: Directories the agent can read but not modify
• readwritePaths: Directories the agent can read and write
• deniedPaths: Paths explicitly denied
• Everything else is blocked by default. Setting a working directory does not grant access to it.

Network Policies#

• egress: Outbound policy with a default action (allow or deny, defaulting to deny) plus explicit allow and deny rule lists, where deny rules win
• ingress: Inbound LAN traffic and host-loopback actions
• Host filtering is backend-dependent; the 0.x README noted host allow and block lists were not enforced on Windows

UI Access#

• disable: Whether UI is disabled (no visible windows)
• clipboard: none, read, write or all
• allowInputInjection: Allow simulating keyboard/mouse input

On Windows, PowerShell needs UI access to start, so a request that launches powershell.exe or pwsh.exe has to leave UI enabled.

One-Shot vs Lifecycle APIs#

The TypeScript SDK provides two execution models:

One-Shot Execution#

For a single command, use run() (captured output, shown above), spawn() (live stdout and stderr streams) or spawnWithPty() (an interactive terminal). Adapted from the SDK README:

import { spawn } from '@microsoft/mxc-sdk/v1';

const processHandle = await spawn({
  command: 'python analyze.py',
  filesystem: { readwritePaths: ['/tmp/work'] },
  network: { egress: { default: 'deny' } },
  timeoutMs: 30_000,
});
try {
  processHandle.standardOutput?.on('data', (chunk) => process.stdout.write(chunk));
  processHandle.standardError?.on('data', (chunk) => process.stderr.write(chunk));
  console.log(await processHandle.wait());
} finally {
  processHandle.dispose();
}

Lifecycle (Persistent Containers)#

For multi-step workflows where you need to keep the container running, the lifecycle API provisions a container once and runs several commands in it. It only supports persistent backends: isolation_session and wslc, both on Windows. Adapted from the SDK README:

import {
  provisionContainer,
  startContainer,
  runInContainer,
  stopContainer,
  deprovisionContainer,
} from '@microsoft/mxc-sdk/v1';

const { containerId } = await provisionContainer({
  containment: 'isolation_session',
  network: {
    egress: { default: 'allow' },
    ingress: { default: 'allow', hostLoopback: 'allow' },
  },
});
try {
  await startContainer(containerId);
  try {
    const install = await runInContainer(containerId, { command: 'npm install', timeoutMs: 300_000 });
    const test = await runInContainer(containerId, { command: 'npm test', timeoutMs: 300_000 });
    console.log(install.exitCode, test.exitCode);
  } finally {
    await stopContainer(containerId);
  }
} finally {
  await deprovisionContainer(containerId);
}

On Linux and macOS, use one-shot calls instead. For agents, the 0.x README advised several narrow sandboxes (one policy per task step) rather than one broad one.

Native Binary Execution#

The platform executors (wxc-exec.exe on Windows, lxc-exec on Linux, mxc-exec-mac on macOS, all bundled in the npm package's bin/ directory) accept JSON container-creation requests defined by the stable schema. The repository README documents them for testing or for apps that cannot embed the SDK:

wxc-exec.exe config.json            # run a request
wxc-exec.exe --debug config.json    # MXC diagnostic output
wxc-exec.exe --audit policy.json    # record accesses to author a policy (turns sandboxing OFF)

Never use --audit with untrusted code: the README warns it disables all sandbox security for the workload being analyzed.

Agent 365 Integration#

For enterprise environments, MXC integrates with Microsoft's security stack:

• Entra: Identity binding so agents receive strong user identities
• Intune: Policy enforcement across managed devices
• Defender: Runtime threat detection
• Purview: Compliance and data governance

Agent 365 layers these protections on top of MXC containment. The preview shipped July 2026.

Security Considerations#

During the public preview, Microsoft's README stated that no MXC profiles should be treated as security boundaries, as policies might be overly permissive. The 1.0 READMEs no longer carry that warning, but several backends are still marked experimental (Windows Sandbox, MicroVM and Hyperlight on Windows).

What this means in practice:

• Use MXC as defense-in-depth, not as your only security layer
• Prefer the default process backend for each platform until the experimental backends graduate
• Pin the SDK version; 1.0 changed every API name, and minor releases can still change behaviour
• Conduct your own security review before production use

Testing Your Sandboxes#

Start from the runnable Rust, .NET and Node samples in the repository rather than from scratch. When a workload fails inside the sandbox, the repo's logging access denied guide shows how to capture the blocked accesses and tune the policy. The SDK's lifecycle API also exposes validateProvision(), validateProcess() and related functions that check a request without executing it.

Choosing the Right Backend#

Backend selection depends on your threat model and performance needs:

Start with the default backend for your platform. Upgrade to stronger isolation when your threat model requires it.

Comparison to Other Sandboxes#

MXC enters a market with existing solutions. How does it compare?

MXC's advantage is the OS-level enforcement and enterprise integration. Its disadvantages are a recent Windows 11 build requirement on Windows, a fast-moving API (1.0 renamed everything) and several backends still marked experimental.

For more on code sandbox architecture, see the AI agent code sandbox comparison.

Getting Started Checklist#

1. Install the SDK on Node.js 24+: npm install @microsoft/mxc-sdk
2. Check getPlatformSupport() from @microsoft/mxc-sdk/v1
3. Write a minimal ContainerRequest (command, filesystem, network, timeout)
4. Test it with run()
5. Move to spawn() for streaming, or the lifecycle API for persistent Windows containers
6. Monitor the MXC GitHub for updates

FAQ#

What is Microsoft MXC?#

Microsoft Execution Containers (MXC) is a policy-driven sandboxing system for running untrusted code - model outputs, agent plugins, tool calls - with OS-level enforcement on Windows, Linux, and macOS. Announced at Build 2026.

Which platforms does MXC support?#

MXC supports Windows 11 24H2 or later, Linux (x64 and ARM64), and macOS (ARM64 and x64). Each platform has a different default containment backend.

Is MXC production-ready?#

It is closer. The SDK reached 1.0 on October 6, 2026 (1.0.1 is current), with a versioned @microsoft/mxc-sdk/v1 API. During the preview Microsoft said no MXC profiles should be treated as security boundaries; that warning is gone from the 1.0 READMEs, but several backends are still experimental, so treat MXC as one layer of defense and do your own review.

How does MXC compare to Docker containers?#

MXC provides OS-level isolation with declarative policy enforcement. Docker containers provide application isolation but assume trusted code. MXC is designed for untrusted code execution where the agent itself may be compromised.

What backends are available?#

Windows offers ProcessContainer (default), Windows Sandbox, WSLC, MicroVM, Hyperlight, and IsolationSession; Windows Sandbox, MicroVM and Hyperlight are experimental. Linux offers Bubblewrap (default), LXC, MicroVM, and Hyperlight. macOS currently only supports Seatbelt.

How do I choose between one-shot and state-aware APIs?#

Use one-shot calls (run() or spawn()) for single commands on any platform. Use the lifecycle API (provisionContainer, startContainer, runInContainer, stopContainer, deprovisionContainer) when you need several commands in the same container; it currently supports only the isolation_session and wslc backends on Windows.

What is the relationship between MXC and Agent 365?#

Agent 365 layers Microsoft's enterprise security stack (Entra, Intune, Defender, Purview) on top of MXC containment. MXC provides the isolation; Agent 365 provides governance and compliance.

Does MXC work with OpenAI and Anthropic agents?#

Yes. OpenAI and NVIDIA adopted MXC at launch. The TypeScript SDK works with any agent framework that can shell out to sandboxed processes. You control what the agent code can access regardless of which model backs it.

Continue Reading#

• GitHub Copilot CLI With Ollama: Local Models and the New Sandbox - MXC in production: the sandbox Copilot made generally available on October 7
• Claude Code vs Codex vs Copilot CLI: Local Sandboxes Compared - how Copilot's MXC-based sandbox stacks up against Claude Code and Codex
• Deno Desktop Lets You Build Native Apps with TypeScript
• Running Fable 5 Agents on Vercel's eve Framework
• Microsoft's Work IQ APIs Hit GA: What Agent Builders Actually Get on June 16
• Claude Code Desktop SneakPeek Flaw: Fixed Version and What To Do - the app's own renderer sits outside an agent sandbox: Claude Desktop's August preview-pane fix
• Code Sandboxes for AI course - secure code execution environments for agents, the problem MXC tackles at the OS level
• Intro to Agents 101 course - permissions, least privilege, and approval gates for agents, built hands-on

Sources#

• Microsoft MXC GitHub Repository: github.com/microsoft/mxc
• Build 2026 Windows Developer Blog: Furthering Windows as the trusted platform for development
• Windows Platform Security for AI Agents: Windows Developer Blog
• MXC schema documentation: github.com/microsoft/mxc/schemas
• @microsoft/mxc-sdk npm package and README: npmjs.com/package/@microsoft/mxc-sdk
• MXC SDK samples: github.com/microsoft/mxc/tree/main/samples
• Microsoft Build 2026 Overview: Microsoft Blog