Microsoft made Microsoft Execution Containers generally available on 7 October. Agent containment stopped being a framework feature and became a Windows one.
- Policy is authored outside the agent and enforced at runtime, so an agent cannot widen its own permissions.
- Four backends range from a process container built on AppContainer, Seatbelt and Bubblewrap to an experimental MicroVM with a hardware-enforced boundary.
- A session container runs an agent under a separate Windows account with its own desktop, clipboard and input.
- Codex, GitHub Copilot, OpenClaw, Replit, LM Studio and Unsloth AI already support it.
- Intune policy management and Microsoft Entra agent identity are listed as coming, not shipped.
- Containment only helps when the agent people actually run respects it, and the coming list is longer than the shipped one.
Read the full analysis of what moved into the operating system
Get the next one before it is old news
Independent analysis of cloud-native infrastructure, Kubernetes and data center economics. No vendor spin.