Pimp My IDE / garage dispatchBack to the garage
October 10, 2026 / agent containment / Windows, macOS, Linux

Find the sandbox seam.

One agent session can cross an OS sandbox, an in-process policy check, and a remote service. The word "sandboxed" does not tell you which action crossed which boundary.

Draw the route for every tool class. Name where policy runs, who can change it, and which blocked probe proves the boundary.

MXC turns policy into a native boundary.

Microsoft released Microsoft Execution Containers 1.0 as an open-source SDK for running untrusted code on Windows, macOS, and Linux. An application declares a command plus file, network, and interface rules. MXC selects a platform backend such as AppContainer, Seatbelt, or Bubblewrap.[1][2]

The useful part is ownership. The workload does not control the policy that contains it. A model, plugin, generated program, or tool cannot grant itself a wider path through the MXC request.

A portable policy is useful. The enforced boundary still depends on the backend and the caller.

The agent session has several enforcement planes.

Microsoft's GitHub Copilot write-up draws an important seam. With sandboxing enabled, shell commands and, by default, local MCP servers and language servers run inside the process boundary. Built-in file tools run inside the Copilot process. The harness checks those requests against policy, but that is not OS-enforced child-process isolation. Remote MCP servers also sit outside the local process sandbox.[3]

This is not a criticism of in-process checks. It is a demand for precise language. "The session is sandboxed" hides which code reached an operating-system boundary and which code trusted the application to enforce its own rules.

Portable does not mean identical.

The repository lists a default process backend for each desktop platform. Windows uses ProcessContainer, Linux uses Bubblewrap, and macOS uses Seatbelt. Other backends have their own platform support and maturity. The Windows blog marks MicroVM support as experimental and says the isolated session backend is Windows-only.[1][2]

A shared JSON request can reduce integration work. It does not make the backends equivalent. Review the selected backend, the rule each backend can enforce, and the result of the same negative probe on every target host.

Learning mode needs its own warning lamp.

MXC documents a Windows learning mode that records denied access while keeping it blocked. It also documents an audit mode that turns off sandbox security while observing a trusted workload. The repository warns against using audit mode for untrusted code.[2]

Do not collapse those states into one "observe" switch. Deny-and-record and allow-and-record have opposite security behavior. The active mode belongs in the run receipt.

The packages exist. This run stayed read-only.

The npm, crates.io, and NuGet registries each exposed an MXC SDK at version 1.0.0. We fetched the npm archive without installing it. The 37,746,375-byte archive held 211 entries, including JavaScript bindings and native executables for several platforms. Its SHA-256 was 39e59ffd9d0832334889b0cd583d0beb43b1bbbe9f783dd7c6980203d23e9602.[4]

We did not load the native library, create a container, or run a blocked probe. The cutaway below is a teaching tool. It records the enforcement question you still need to answer on a real host.

Keep a seam card for each action.

  1. Name the operation, caller, and child process.
  2. Record whether the check runs in the OS, the harness, or a remote service.
  3. Pin the host, MXC version, backend, and effective policy.
  4. Run one denied file probe and one denied network probe.
  5. Save the observed mode, result, and cleanup evidence.

A boundary earns trust when the denied operation fails in the place the architecture claims.

Interactive makeover / route selector plus seam card

Trace the enforcement plane.

A normal sandbox badge compresses several routes into one green light. This cutaway joins an action selector, route diagram, policy areas, and copyable test card. It does not inspect your machine.

Choose actionLocate planeSelect probesSave card

Action selector

Choose one Copilot action class described in Microsoft's October 7 write-up. The display shows the documented control plane, not the configuration on your host.

Choose an action class
Include these negative probes
Shell commandOS process boundary

Route cutaway

The harness launches a child command through the selected MXC process backend. File and network rules can cross into the OS-enforced boundary.

01RequestModel asks
02HarnessCaller routes
03OS boundaryBackend enforces
04RemoteOutside host
OS enforcement is in the route for the spawned workload. Prove the exact policy with blocked probes on the target backend.
FILESProbe selected. Record the denied path and result.
NETWORKProbe open. Add a blocked destination.
INTERFACEProbe open. Add a clipboard, display, or input check.
IDENTITYProbe open. Record which identity performed the action.
Test card started. A real host, backend, policy, and denial result are still required.
Sources read / October 10, 2026 UTC

Source log

Open the evidence boundary
  1. Microsoft Windows Developer Blog, "Microsoft Execution Containers: Policy-driven containment for AI agents", published October 7 and read October 10, 2026 UTC. This first-party release post supports the general-availability claim, policy areas, backend table, operating modes, and platform limits.
  2. Microsoft MXC repository at revision c6f301d, inspected October 10, 2026 UTC. The pinned README and documentation support package names, default backends, policy fields, SDK languages, diagnostic modes, and the warning that audit mode disables sandbox security.
  3. Microsoft Command Line, "Bringing local models and sandboxed tools to Windows and GitHub Copilot", published October 7 and read October 10, 2026 UTC. This first-party product post distinguishes spawned shell and local-service isolation from built-in file-tool checks and remote MCP connection policy.
  4. npm registry record for @microsoft/mxc-sdk 1.0.0, fetched October 10, 2026 UTC. The package archive was fetched read-only and inventoried without installation or execution. crates.io and NuGet also listed version 1.0.0.
  5. Hacker News item 50016956, "Mxc: Microsoft Execution Containers version 1.0.0", read October 10, 2026 UTC. The exact discussion ID came from the Hacker News API. The discussion was used as a reading lead, not as proof of MXC behavior.

Artifact boundary: the npm archive was fetched read-only. We did not install an SDK, load native code, start a container, or verify a sandbox on this host. Registry presence and archive contents prove distribution, not backend behavior. The interactive cutaway is an original dependency-free teaching tool.