Microsoft MXC

Microsoft Execution Containers (MXC) is Microsoft's open-source sandboxed code-execution system for running untrusted code: model output, plugins, and agent tools. It works on Windows, Linux, and macOS, and it layers several containment backends, from OS-native process sandboxes to full VMs, behind one JSON configuration schema and a TypeScript SDK. Public coverage on 2026-06-02 (per NOVALOGIQ) placed it alongside partners OpenAI, Nvidia, Manus, Nous Research, and OpenClaw.

Key Features

• Cross-platform: Platform-appropriate containment backends for Windows, Linux, and macOS.
• Backend-agnostic config: A versioned JSON schema defines execution parameters and security policies.
• Many containment backends: ProcessContainer, Windows Sandbox, LXC, Bubblewrap, Seatbelt (macOS), MicroVM (NanVix), Hyperlight, IsolationSession, and WSLC.
• Policy-driven sandboxing: Filesystem policy (read-only and read-write path lists), network policy (proxy, allow/block outbound, host filtering), and UI policy (clipboard, display, GUI).
• TypeScript SDK: The @microsoft/mxc-sdk npm package offers one-shot and state-aware APIs.

Use Cases

Who Should Use This Tool?

• Agent runtime builders who must isolate model output that can execute code or call tools.
• Plugin and tool developers shipping third-party code into a host without trusting it.
• Enterprise teams that need policy-driven permissions for what an agent can read, write, or reach over the network.

Problems It Solves

1. Untrusted model output: An agent's next token can become a command; MXC wraps execution in a sandbox.
2. Granular access control: Read-only paths, blocked outbound traffic, and disabled clipboard/display are configured as policy, not code.
3. One config across OSes: The same JSON schema targets Windows, Linux, or macOS.

Pricing

You pay only for the infrastructure you run the sandboxes on.

Advantages & Unique Selling Points

• Depth of isolation: Pick the backend that matches your threat model, from a process container to a micro-VM.
• Policy as data: Filesystem, network, and UI restrictions live in a versioned JSON schema.
• Very early, so verify: The repo explicitly warns it is an early preview; current MXC policies can be overly permissive and should not be treated as a security boundary.

Getting Started

1. Clone microsoft/mxc.
2. Read the README warning before relying on any profile as a hardened boundary.
3. Use the default backend (Bubblewrap on Linux, Seatbelt on macOS, ProcessContainer on Windows 11 24H2+) for stable one-shot sandboxes.
4. Set experimental: true or the --experimental flag before using Windows Sandbox, WSLC, micro-VM, Hyperlight, or IsolationSession.

Frequently Asked Questions

Is it a security boundary today?

No. The repository says the early preview is not yet a security boundary and that generated policies may be overly permissive. Verify before production.

Does it replace a container runtime?

It complements one. It is specifically a containment layer for agent execution with policy controls, not a general-purpose orchestrator.

Alternatives

• Microsoft ThinkingBox: Sandbox and benchmark for checking whether agents complete tasks reliably.
• OpenClaw: The open-source agent that ran inside MXC during the Windows sandbox demo.
• OpenSandbox: Another sandbox for running agent-generated code.

Tips

1. Never depend on MXC as your only boundary while it is an early preview.
2. Select the backend by OS and by your minimum acceptable isolation level, not by habit.
3. Test that network and filesystem policies actually hold before shipping an autonomous agent.

Conclusion

Microsoft MXC is a free, cross-platform containment layer for agent code execution, designed so you can express filesystem, network, and UI permissions as policy and pick an isolation backend to match the risk. Because it is an early preview, treat it as the foundation to evaluate, not the finished security boundary.