Guide · AI agent security · as of 6 November 2026

The operating system now holds the box your AI agent runs in.

By , Managing Director, BRev Digital ·

Until now, what an AI coding agent could touch on a laptop was mostly the agent’s own decision. Its permission prompts, its allow-lists and its good behaviour were the boundary. Microsoft has shipped a different kind of boundary: a container the operating system enforces, with a policy the agent cannot edit, and a Defender feature that lists which agents are running on which machines and which MCP servers they load. Here is what Microsoft Execution Containers and the Defender discovery do, where the same idea already exists for macOS and Linux, what we found when we checked our own machine this morning, and how to put a box around your agents this week.

What Microsoft shipped

The policy sits outside the agent.

Microsoft Execution Containers, MXC for short, were announced generally available on 7 October 2026 and again in Microsoft’s security round-up of 5 November. Microsoft describes them as a policy-driven execution layer for untrusted code or dynamically generated workloads, which is a careful way of saying: code an AI agent wrote or decided to run. The agent starts inside the container, and the policy that limits it is held by the operating system. In Microsoft’s words, the policy remains outside the agent workload’s control. The default form is a process container. On Windows 11 it uses AppContainer, on macOS it uses Seatbelt, and on Linux it uses bubblewrap, so it is not a Windows-only idea. Windows gets more options: a session container that runs the agent under its own Windows account with its own desktop, clipboard and input, a WSL container for Linux workloads, and an experimental MicroVM with a hardware boundary. The code is on GitHub under the MIT licence with SDKs for Rust, .NET and Node, so an agent vendor can build it in. Microsoft lists GitHub Copilot, OpenClaw, OpenAI Codex, Replit, LM Studio and Unsloth as supporting MXC now, with Anthropic’s Claude Code, Perplexity, Manus, Raycast and others listed as coming. Integration with Intune, Entra and Microsoft Agent 365 is announced for later, which is where a company would set the policy centrally rather than per laptop.

What one policy controls

from the MXC announcement and repository

Four doors, each with a lock.

  • Files: which folders the agent can change, which it can only read, and which it cannot see at all.
  • Network: inbound and outbound connections, including whether the agent may talk to services on the same machine.
  • Processes: the command, its arguments, the working directory and the environment it starts with.
  • The screen: whether the agent may reach the desktop, the clipboard and other user-interface resources.
  • Three modes: enforcement applies the policy; learning blocks anything not granted and writes down what the agent asked for; permissive allows it and writes it down. The written report exists only for Windows process containers today.

The inventory you did not have

Defender now lists the agents on your laptops.

The second half of the news is older by a week and matters more to most companies. Since 29 October 2026, Microsoft Defender for Endpoint can discover local AI agents and the MCP servers they are configured with, on Windows and macOS, by watching what the agents do. Microsoft says it covers more than 50 agents and MCP servers. The named list includes Claude Code, Codex CLI, Gemini CLI and GitHub Copilot CLI on the command line; ChatGPT, Claude, Codex, Copilot, Ollama and Perplexity desktop apps; Cursor, Devin, Kiro and Antigravity as editors; the Claude Code, Cline, Codex, Gemini and Copilot extensions inside VS Code; and OpenClaw and its relatives. For each one it records the agent’s name, version, vendor and process, the device and the user account, and for each MCP server its name, type and endpoint or the command that starts it. That last item is the one we care about, because a week ago we wrote about agents installing archived MCP servers from memory, and the only place that shows is the config file on the developer’s machine. Discovery needs Defender for Endpoint P2 or higher. A runtime protection feature that inspects the agent loop and stops malicious instructions is in preview and Windows-only. Microsoft’s own advice is to start with a small group in audit mode for one to two weeks before enforcing anything.

Deprecated MCP servers your AI agent may install

What we found on our own machine

The box was there. We had not switched it on.

We run our agents on Linux with Claude Code, which has had an operating-system sandbox of its own for a while: Seatbelt on macOS, bubblewrap on Linux, with a proxy that only lets commands reach hosts on an allow-list. It is off by default. So this morning we checked ours. The sandbox was off. The two packages it needs, bubblewrap 0.12.0 and socat, were already installed. Five agent sessions were running with the permission prompt switched off. That means on this machine 22 agent definitions and 5 MCP servers were being contained by nothing the operating system enforces. What contains them instead is policy. The database server’s token is read-only. Secrets live in the system keyring and are handed to a command only for the one call that needs them. Each agent works in its own git worktree, 64 of them at the last count. Eight hook entries run before and after tool calls. And a written rule says no MCP server with write access runs while the permission prompt is off. Every one of those is a decision a person made and wrote down, and every one of them is a rule the agent could in principle talk its way around, because nothing below it holds. That is precisely the gap Microsoft is describing. Two honest caveats before we fix it. Claude Code’s sandbox covers the shell commands the agent runs; its file tools, web fetches, MCP servers and hooks run outside it, so an MCP server still needs its own narrow token. And the network allow-list starts empty, which means the first day of running sandboxed is a day of discovering which hosts a real session needs. That is what Microsoft’s learning mode is for, and it is why we are turning ours on this week in audit form first, not on the production lanes today.

How our agents learn from mistakes

How to put a box around your agents this week

Inventory first. Then the boundary.

  • Find out what is running. With Defender for Endpoint P2, turn on local agent discovery in audit mode for a small group. Without it, search the config files agents write: .mcp.json and ~/.claude.json for Claude Code, claude_desktop_config.json, ~/.cursor/mcp.json, .vscode/mcp.json and ~/.codex/config.toml.
  • Windows: adopt MXC through an agent that supports it, or through the SDK for your own. Start in learning mode and read the activity report before you enforce. Permissive mode is for discovery, not for production.
  • macOS and Linux: if your team uses Claude Code, enable its sandbox in the settings file, add the hosts your builds need to the network allow-list, and set it to refuse to start when the sandbox is unavailable rather than fall back silently.
  • Keep tokens narrow anyway. A container limits what a process can reach on the machine; it does not shrink a database key or a cloud token the agent was handed. Read-only where possible, one per service.
  • Write the policy down where it is reviewed like code. The point of MXC is that the policy lives outside the agent. The same should be true of your allow-lists and your MCP config: in the repository, changed by pull request.
  • Treat permission prompts as a convenience, not a control. If your developers run agents with prompts off, and many do, the only thing left between the agent and the machine is the operating system boundary. Make sure there is one.

Why this matters to us

We run agents with the prompt off.

We are an AI lab in Dubai. Our own agents build and ship software without a person approving each command, and the agents we build for UAE businesses read email, databases and accounting data. Whether the boundary around an agent is a rule we wrote or something the operating system holds is not a detail; it is the difference between trusting the model and not having to.

AI agents, built in Dubai

Questions

Questions about sandboxing AI agents.

  • What is Microsoft Execution Containers (MXC)?

    A containment layer, enforced by the operating system, that runs an AI agent or any untrusted code inside a policy covering files, network, processes and the screen. The policy is held outside the agent, so the agent cannot change it. Microsoft announced it generally available on 7 October 2026 and the code is open source under the MIT licence.

  • Does MXC work on macOS and Linux?

    The process container does. It uses AppContainer on Windows 11, Seatbelt on macOS and bubblewrap on Linux. The session container, the WSL container and the activity report are Windows-only, and the MicroVM backend is experimental.

  • Is MXC the same as Windows Sandbox?

    No. Windows Sandbox is one of several backends MXC can use on Windows, alongside the default process container, WSL, Hyperlight and a MicroVM. MXC is the policy layer that chooses and configures a backend for each workload.

  • Does Claude Code have a sandbox?

    Yes, and it is off by default. On macOS it uses Seatbelt and on Linux it uses bubblewrap with socat, limiting writes to the working directory and routing network traffic through a proxy with an allow-list. It covers the shell commands the agent runs; file tools, MCP servers and hooks run outside it. On native Windows, Claude Code runs commands unsandboxed. Microsoft lists Claude Code as a coming MXC integration.

  • How do I find which AI agents are installed on company laptops?

    Microsoft Defender for Endpoint P2 can discover more than 50 local agents and their MCP servers on Windows and macOS since 29 October 2026. Without Defender, search the config files each agent writes, such as .mcp.json, ~/.claude.json, claude_desktop_config.json, ~/.cursor/mcp.json and ~/.codex/config.toml.

  • Does an AI agent sandbox stop prompt injection?

    No. A sandbox limits what a hijacked agent can reach: which files, hosts and processes. It does not stop the agent being hijacked, and it does not shrink the tokens the agent holds. Narrow tokens, a reviewed MCP config and the container together are what reduce the damage.

Sources

read 6 November 2026

Check it at the source.

  1. Windows Developer Blog: Microsoft Execution Containers (7 October 2026, the announcement)
  2. Microsoft Security: what’s new, November 2026 (5 November 2026)
  3. Microsoft Defender: discover local AI agents (29 October 2026, generally available)
  4. github.com/microsoft/mxc (the code, schema and SDKs, MIT)
  5. Claude Code docs: Sandboxing (Seatbelt, bubblewrap, the network allow-list)

A question?

Do you know what your agents can reach?

Tell us which AI tools your team runs and on what, and we will tell you honestly where the boundary is today and what it would take to move it into the operating system.

Talk to usWhatsApp +971 50 728 5494hello@brevdigital.com