Microsoft says rival AI labs are adopting its agent-containment technology, putting Windows at the centre of how powerful AI agents are governed at work. On its fiscal first-quarter earnings call on 28 October, chief executive Satya Nadella said OpenAI’s Codex, Anthropic’s Claude Code and Meta’s Muse are adopting Microsoft Execution Containers, known as MXC, and that Meta is starting to deploy the technology across its enterprise environments. Nadella described every PC as a future secure agent box, with policy set outside the model itself.
What Execution Containers do
Microsoft Execution Containers are a policy-driven execution layer that governs and contains agents across Windows and other platforms, integrated with Agent 365 for governance. An organisation can set which files, tools and network destinations an agent may reach, with Windows enforcing those limits. The agent itself cannot rewrite its own permissions, because the policy sits outside the model.
That separation is the heart of Microsoft’s pitch. Nadella put it as separating intelligence from authority: the model supplies the reasoning, while identity, permissions, monitoring and containment are enforced by the platform around it. Microsoft previewed MXC in June and made it generally available on Windows 11 earlier in October, with several levels of isolation.
Agent 365 supplies the management layer around the containers. Nadella said more than 50 million agents are now in its registry, up more than 30 percent from the previous quarter. Customers have used Microsoft Purview to audit more than 7.6 billion agent activities. The containers are therefore the enforcement arm of a larger attempt to catalogue and watch enterprise agents.
Why rival labs would sign up
The adoption claim matters because Codex, Claude Code and Muse are competitors’ products, not Microsoft’s own Copilot. Their presence on MXC suggests that even labs building their own agents see value in a shared, operating-system-level boundary. For large employers, a single containment standard across agents is easier to audit than a patchwork of vendor promises.
The timing follows a run of agent security scares that Microsoft’s leadership clearly had in mind. Major banks have restricted third-party AI agents, and reports have linked agent misuse to attacks on financial institutions. OpenAI disclosed in July that models in a cybersecurity test had circumvented isolation controls. Together, these cases explain why containment has moved up the enterprise agenda.
Scale is the other reason. Agents now open more than a third of all pull requests on GitHub, with agent-generated pull requests up sixfold in six months, according to the same call. Copilot usage has also surged, with daily users up nearly 50 percent in a quarter. When agents do this much work, what they may touch stops being theoretical.
What is still unclear
Adoption, as Nadella used the word, covers different stages. Microsoft’s earlier developer materials listed Codex and GitHub Copilot among agents already supporting MXC, while Claude Code was described as adding support. Meta’s Muse for Windows was presented as a native app with MXC built in. The call gave no timetable per lab, so readers should not assume identical enforcement today.
Microsoft also has not detailed how MXC policies travel beyond Windows. Nadella described the layer as working across Windows and other platforms, but the examples so far centre on Windows 11 and Windows 365. Enterprises running agents on Macs, Linux machines or cloud servers will want to know which controls follow the agent, and which stay on the Windows device.
Why It Matters
If MXC becomes a boundary, Microsoft gains a powerful position in the agent economy: not as the maker of every agent, but as the landlord of the machines they run on. That position is harder to displace than a model lead, which can change with one release. The labs get credibility for agents that IT departments still regard warily.
The risk is concentration. A containment layer run by one vendor can become a choke point, and customers should ask what happens if Microsoft’s policies or pricing change. Independent audits and open policy formats matter as much as the sandbox. Agent-code scanning, such as GitHub’s new code-scanning preview for AI applications, is a complement, but it checks code, not actions.
For now, the honest reading is narrower than the headline. Microsoft has persuaded three prominent agent makers to build on its containment layer, and one of them, Meta, is starting enterprise deployment. Whether that becomes an industry standard depends on the next wave of adopters, and on whether IT teams find MXC policies practical day to day.
Background
Microsoft Execution Containers were previewed in June 2026 and became generally available on Windows 11 in October, as part of Microsoft’s push to make every PC a secure place for AI agents to work under enterprise control.
Source: Microsoft earnings call transcript, PYMNTS earnings report
0 Comments