Microsoft used Build 2026 to announce that Windows 11 will function as a managed runtime for autonomous AI agents, not just a platform for running AI-assisted applications. The centerpiece is the Microsoft Execution Containers (MXC) SDK, a policy-driven execution layer that isolates agent workloads at the process level while giving IT teams granular control over what each agent can access.

What MXC Does

MXC strips agent isolation down to the process boundary rather than virtualizing an entire user session the way Windows Sandbox does. According to Microsoft’s Windows Developer Blog, the SDK lets developers “declare what an agent can access (e.g., files, network) with containment boundaries enforced at runtime,” offering “a spectrum of isolation semantics that are dynamically composable based on intent and risk.” The SDK is available in early preview.

Windows News reported additional technical details from the keynote: each container receives a cryptographic identity from the device’s TPM 2.0 chip, a BitLocker-encrypted virtual disk, and a filtered filesystem view exposing only authorized directories. Cold-start latency sits under 180 milliseconds on a Snapdragon X3 Elite. Microsoft demonstrated three agents running concurrently in separate MXC containers while a user edited a PowerPoint deck, maintaining 60 fps scrolling with NPU utilization under 14%.

“We’re not bolting a chatbot onto the taskbar,” Pavan Davuluri, CVP of Windows + Devices, said at the keynote, according to Windows News. “We’re giving every agent a sandbox, an identity, and a policy that the operating system enforces.”

OpenClaw Runs Natively Inside MXC

OpenClaw now runs natively on Windows with MXC containment. The Windows Developer Blog confirmed that “the Windows node and gateway run contained, so your system stays secure,” with a companion app for setup and configuration. NVIDIA is also bringing OpenShell to Windows built on MXC, providing “an easy-to-deploy package for autonomous, always-on agents safely.”

The OpenClaw SDK on Windows abstracts model selection and tool calling, according to Windows News, allowing agents to swap between on-device Phi-4-Silica NPU models and Azure-hosted GPT-5o without rewriting orchestration logic. An OpenClaw Extension Host lets classic Win32 applications surface capabilities to agents via a COM interface, so Excel can declare functions like forecast_model and pivot_table that agents pick up automatically through Windows Copilot Runtime.

Enterprise Security: Agent 365 Meets MXC

Agent 365 integrates natively with MXC to deliver Defender, Entra, Intune, and Purview protections for local agents. This integration, arriving in preview in July according to the Windows Developer Blog, means each agent gets a unique Entra ID service principal with scoped privileges rather than sharing a user’s OAuth token. Conditional Access policies can require that an agent be launched from a compliant, Azure-region-joined device.

Microsoft’s Security Blog described MXC as providing “OS-level control over agent execution, giving developers and IT teams the ability to define containment and policy, applied by the OS through isolation technologies.”

On-Device Models and Timeline

Microsoft also announced two new on-device SLMs: Aion 1.0 Instruct (a smaller, faster model) and Aion 1.0 Plan (a reasoning and tool-calling model for “fully local agentic capabilities”), per the Windows Developer Blog. These expand Windows AI APIs beyond NPU-only devices to capable discrete GPUs and CPUs.

The agent runtime ships in the Windows 11 25H2 update, expected in September 2026. MXC initially requires a Copilot+ PC with an NPU, with CPU fallback emulation following in Q1 2027.

The Competitive Positioning

This positions Windows directly against Linux-based container orchestration for agent workloads. Until now, production agent deployment has largely meant Docker containers on Linux, Kubernetes clusters, or cloud-hosted sandboxes. Microsoft is betting that enterprise IT teams will prefer OS-enforced agent governance with Entra identity, Defender monitoring, and Purview compliance built in over assembling equivalent capabilities from open-source components.

Sixteen ISVs announced immediate support, including Salesforce, SAP, Adobe, and ServiceNow, according to Windows News. Whether enterprises trust desktop-resident agents with business-critical automation remains the open question. The infrastructure for it now exists.