Microsoft Execution Containers (MXC), a technology first previewed in June of last year, is now available in its stable version. The company has outlined how this system can restrict access by AI agents to files, applications, and networks. For nearly a year, Microsoft has been developing isolated environments that allow AI agents to perform tasks without having full access to the user's system. Following the introduction of Agent Workspace, which created a separate Windows session for AI agents, MXC was introduced in June 2023 as a more flexible and secure solution, offering multiple levels of isolation and access controls tailored to specific tasks. Microsoft has now officially announced the general availability of MXC on Windows 11, confirming its support by tools such as GitHub Copilot and OpenAI Codex. With MXC, developers can define the resources an AI agent can access, and the operating system enforces these restrictions. For example, an AI agent tasked with modifying a website's code can be allowed to work on the project's files without access to the user's personal documents, or it can read a server's configuration without being able to change it. Depending on the nature of the task and the required level of isolation, MXC offers four types of containers. Process containers, the simplest option, work across Windows 11, macOS, and Linux. They are optimized for responsiveness, such as running code generated by AI. Session containers, available only on Windows, use a separate account and graphical environment, isolating the desktop and clipboard from the user's session. This allows agents to perform extended tasks and interact with applications without disrupting the main session. Additional container types include those based on WSL for running Linux development environments on Windows 11, and microVM, an experimental option that uses hardware virtualization to better isolate high-risk operations. Developers define permissions in a shared JSON configuration across platforms, and MXC applies the appropriate isolation method for the selected container, ensuring that agents cannot alter their own permissions. Determining the right permissions may require some trial and error, as an agent could be blocked if it lacks access to a critical file or service. To help developers refine their rules, MXC offers three operating modes. Enforcement blocks unauthorized operations, while Learning applies the same restrictions but logs denied access attempts in a JSON report. Permissive mode allows these operations to proceed while logging them, helping developers identify necessary resources before applying stricter rules. However, this mode does not bypass other system protections, and activity reports are currently limited to process containers on Windows. Microsoft is also preparing tools for enterprise use. Soon, administrators will be able to use Intune to set their own restrictions on process containers on Windows 11, independent of the permissions set by developers. Windows will also use Microsoft Entra to differentiate between actions taken by AI agents and those taken by users. Agent 365 will allow tracking of agent activities and individual intervention in case of issues. If an agent is compromised, security teams can limit its access without disrupting the user's work. Several tools already support MXC, including GitHub Copilot, OpenAI Codex, OpenClaw, Replit, LM Studio, and Unsloth AI. NVIDIA has also integrated OpenShell into MXC to enhance file and inference service access controls, strengthen network protections, and manage identifiers. Other companies, such as Anthropic with Claude Code, Manus, Perplexity, and Raycast, are expected to follow. However, these protections do not automatically apply to all AI agents on Windows 11; they depend on the integration of MXC into the relevant applications and the specific tasks being isolated.