Microsoft has made Microsoft Execution Containers generally available. It is an operating system layer that confines what an AI agent, plugin or other generated workload is allowed to touch. A developer or an IT administrator declares the files, network destinations and interface access the workload may use, and the system enforces that boundary while it runs. The policy sits outside the workload, so an agent cannot widen its own permissions.
There are four containment options. Process containers work on Windows 11, macOS and Linux, built on AppContainer, Seatbelt and Bubblewrap respectively. Session containers, which are Windows only, run the agent under a separate account with its own desktop, clipboard and input. A WSL container gives it a Linux environment. A hardware-enforced MicroVM exists on Windows and Linux but is labelled experimental. Each can run in enforcement, learning or permissive mode, the latter two logging what the agent tried to reach.
Agent containment has mostly been a promise made by whoever built the agent. This puts it where the agent is not the one deciding. Microsoft says GitHub Copilot, OpenAI Codex, Replit and LM Studio already support it, with Claude Code, Perplexity and Manus among those announced. The management half is unfinished: Intune policy, Entra agent identity and Agent 365 control of local agents are all described only as coming.
Source: Microsoft, Microsoft Execution Containers: policy-driven containment for AI agents.