Windows local AI agents can now run tools inside operating-system-enforced containers instead of relying entirely on safeguards built by each application. Microsoft made Microsoft Execution Containers generally available on Windows 11 on October 7, 2026, giving developers a shared policy layer for file, network and interface permissions. Local model inference remains separate, creating a modular architecture for private, responsive agent software.
What are Windows local AI agents?
Windows local AI agents are software systems that can use on-device models, access approved PC context and perform actions through tools running on Windows 11. Microsoft’s 2026 architecture separates model execution from tool containment, so an agent can combine local or cloud intelligence with operating-system-enforced restrictions on files, networking and user-interface access.
An AI agent is software that selects and executes actions to pursue a user-defined objective. Unlike a conventional chatbot, an agent may run shell commands, modify project files, contact services or invoke a Model Context Protocol server. Those capabilities make permissions more consequential than the location of the model itself.
Microsoft calls its broader design “Hybrid Intelligence.” GitHub HydraFusion is intended to route tasks between local and cloud models, while Windows ML provides a common local inference layer across the GPU, neural processing unit and CPU. Microsoft announced llama.cpp support for Windows ML on October 7, 2026.
The approach reflects the practical advantages covered in our guide to on-device AI in 2026: local processing can reduce network dependence, keep selected data on the PC and lower round-trip latency. It doesn’t automatically make an agent safe. A local model with unrestricted shell access can still delete files or expose credentials.
How do Microsoft Execution Containers protect AI agents?
Microsoft Execution Containers protect AI agents by validating an application’s requested workload, containment rules and container type before launching an isolated process. Policies are enforced at runtime through Windows controls and can allow, deny or limit filesystem paths, network connections, proxies, clipboard use, display access and graphical interfaces.
Microsoft Execution Containers, or MXC, is an application-embedded SDK and unified policy layer that selects an appropriate isolation backend for a declared workload. The application remains responsible for supplying the command and rules. Windows handles the policy validation and launch process.
That distinction matters. Microsoft said on October 7, 2026 that traditional sandboxes weren’t designed for containment requirements that may change with every prompt and tool call. An agent editing one repository might need write access to that working directory, read-only access to compilers and no access to personal documents.
Microsoft’s GitHub Copilot example grants its working directory read-write access while making most of the remaining system read-only or inaccessible. GitHub Copilot can place shell commands, local Model Context Protocol servers and language servers inside the sandbox. Its built-in file tools are policy-checked within Copilot rather than launched as separately isolated child processes, a subtle boundary developers shouldn’t overlook.
The main controls available to an MXC-integrated application cover the following areas:
- Filesystem paths with read-only, read-write or denied access.
- Network egress, ingress, proxy use and host-loopback behavior.
- User-interface capabilities, including clipboard, display and GUI access.
- Container lifecycle operations such as provision, start, execute, stop and deprovision.
- One-shot execution for short-lived commands that don’t need a persistent environment.
This is a meaningful improvement over asking every AI vendor to invent a sandbox. Still, policy quality remains the developer’s problem. An overly broad rule can be valid and dangerous at the same time, much like the dependency risks described in our analysis of security problems created by AI coding.
Which MXC isolation option should developers use?
Microsoft Execution Containers offers three supported backend families in 2026: ProcessContainer, IsolationSession and WSL Container. ProcessContainer provides lightweight process isolation without a separate virtual machine or container image, while IsolationSession and WSL Container suit workloads needing different Windows session or Linux execution boundaries. Several stronger options remain experimental.
| MXC backend | 2026 status | Best fit | Key consideration |
|---|---|---|---|
| ProcessContainer | Supported | Fast command and coding-tool isolation | No separate VM or container image required |
| IsolationSession | Stable SDK surface in v0.9.0 | Workloads needing session isolation | Requires Windows build 26340.9212 or later and the relevant feature |
| WSL Container | Stable SDK surface in v0.9.0 | Linux tools and environments on Windows | Uses the Windows Subsystem for Linux path |
| Windows Sandbox | Experimental | Broader disposable desktop isolation | API and behavior may change |
| MicroVM | Experimental | Hardware-backed isolation | Not part of the stable production surface |
| Hyperlight | Experimental | Lightweight virtualized workloads | Not ready to treat as a stable dependency |
GitHub Copilot uses the BaseContainer/ProcessContainer tier on Windows, Seatbelt on macOS and Bubblewrap on Linux, according to Microsoft’s Command Line blog on October 7, 2026. Process-level containment avoids the startup and storage cost of shipping a complete virtual machine. For frequent coding commands, that’s the sensible default when its boundary matches the threat model.
Developers shouldn’t equate “container” with one fixed security strength. A process boundary, a Linux environment and a hardware-backed micro-virtual machine make different trade-offs. Our coverage of NVIDIA OpenShell and hardware-oriented agent safety provides useful context for applications handling untrusted code.
MXC SDK v0.9.0, released September 29, 2026, exposes Rust, .NET and Node SDKs. Its recommended policy schema is labeled 0.9.0-alpha, while experimental capabilities use 0.10.0-alpha. The “alpha” schema label is an easy-to-miss deployment risk even though MXC itself reached general availability in October 2026.
Do local models and MXC solve the same problem?
Local models and Microsoft Execution Containers solve different problems on Windows 11. Windows ML and llama.cpp run inference across local GPU, NPU and CPU hardware, while MXC restricts what agent tools may do. GitHub HydraFusion separately decides whether a suitable task should go to a local model or a cloud model.
Think of the design as three independent decisions: where reasoning occurs, which tool is selected and what permissions that tool receives. A cloud model can request an action inside a local MXC sandbox. A local model can also call a poorly restricted tool. Model placement alone doesn’t establish containment.
Memory remains a hard constraint for Windows local AI agents. Microsoft said on October 7, 2026 that 3-bit quantization reduces the size of MAI Code 1.1 Flash by nearly 80%. The company also said an upcoming 2-bit NVIDIA Nemotron model with more than 70 billion parameters is expected to consume just over 20GB of memory.
Here’s the useful calculation: a system with 24GB of available accelerator memory would have less than 4GB left after loading a model using just over 20GB, before accounting for runtime overhead, context caches or other applications. Honestly, that class of model only makes sense when the hardware budget leaves meaningful headroom. Smaller models or cloud routing will remain practical necessities.
Privacy claims need similar precision. Local inference may keep prompts away from a remote model provider, but an agent’s tools can still connect to the internet unless network egress is denied. Enterprise teams should pair containment with the kind of inventory and oversight described in our guide to finding unsanctioned AI tools.
When can developers use Windows local AI agents?
Developers can use Microsoft Execution Containers as a generally available Windows 11 capability from October 7, 2026, subject to supported builds and features. ProcessContainer support reached serviced Windows 11 versions 24H2 and 25H2 through the August 2026 KB5120998 update, while some newer networking and directory controls arrived later.
Microsoft’s September 2026 KB5124010 update added host-loopback networking and enumerate-only directory access, according to the MXC release notes. IsolationSession requires Windows build 26340.9212 or later plus its associated operating-system feature. Those prerequisites make build detection and graceful fallback necessary for software distributed across mixed corporate fleets.
Microsoft listed OpenAI Codex, GitHub Copilot, OpenClaw, Replit, LM Studio, NVIDIA OpenShell and Unsloth AI among MXC-integrated agents on October 7, 2026. Meta’s Muse for Windows was also announced as a native application with MXC integration, although Microsoft supplied no release date.
Copilot’s revised Windows interface contains Home, Code and Autopilot areas. Autopilot supervises agent tasks, while permission-based local context can expose relevant files and recent PC activity after user approval, according to Microsoft’s October 2026 announcement. Consent is meaningful only when the prompt tells you which data and action are being requested.
Local-model routing through GitHub HydraFusion was scheduled for experimental preview later in October 2026 across the Copilot app, Copilot CLI and Visual Studio Code. Production teams should therefore separate what’s generally available from what was merely announced. MXC containment is the production foundation; HydraFusion routing was still an upcoming experiment at announcement time.
Windows local AI agents FAQ
Does MXC require a virtual machine?
Microsoft Execution Containers does not always require a virtual machine. The ProcessContainer backend used by GitHub Copilot in 2026 needs neither a separate VM nor a container image, while experimental MicroVM options provide a different isolation level.
Can MXC stop an agent from accessing the internet?
Microsoft Execution Containers can restrict network egress, ingress, proxies and host-loopback access through application-defined policies. Protection depends on the policy being narrow enough and on relevant agent actions actually running inside the controlled workload.
Does Copilot ask permission before reading local activity?
Microsoft said in October 2026 that Copilot’s local context would require user permission before accessing relevant files and recent PC activity. The announcement doesn’t mean every third-party Windows agent automatically inherits the same consent interface.
Is MXC telemetry mandatory?
MXC telemetry is Windows-only and requires explicit user consent, according to Microsoft’s 2026 GitHub release notes. The telemetry path fails closed when its consent requirements aren’t satisfied.