Microsoft Calls MXC Agent Sandbox Generally Available, With Claude Code Support Still Listed as Coming
Software / news
Microsoft Calls MXC Agent Sandbox Generally Available, With Claude Code Support Still Listed as Coming
The v1.0.0 label applies to the SDK, while the microVM backend stays experimental and activity reports exist only on Windows.
Microsoft said on Oct. 7 that Microsoft Execution Containers, its sandbox for running agent-generated code, is "now generally available." The company's own list of agents that will support it later includes Anthropic's Claude Code.
The announcement came in a Windows Developer blog post by Logan Iyer, corporate vice president for Windows Platform and Developer. The post never uses the number 1.0. That version belongs to the code: release v1.0.0 of the microsoft/mxc repository went up at 05:54 UTC the same day.
What reached 1.0 and what did not
The GitHub release notes call v1.0.0 "the first stable release of the MXC SDK surface for Rust, .NET, and Node.js." Stable here means the programming interface. Microsoft says the V1 entrypoints (mxc_sdk::v1, Microsoft.Mxc.Sdk.V1, @microsoft/mxc-sdk/v1) are the compatibility boundary for the 1.x line and that future changes follow semver 2.0.
The preceding releases were all flagged as prereleases: v0.9.0 on Sept. 29, v0.8.0 on Aug. 22, v0.7.0-rc1 on June 13. The repository was created on Feb. 6 and had 2,574 stars and 129 forks on Oct. 11, according to the GitHub API.
The containment itself is a mixed picture. The blog post lists four backends, and labels only one of them experimental.
| Backend | Where it runs | Status in the post |
|---|---|---|
| Process container | Windows 11, macOS, Linux | Not labelled experimental |
| Session container | Windows 11 only | Not labelled experimental |
| WSL container (WSLc) | Windows 11 only | Not labelled experimental |
| MicroVM | Windows 11 and Linux | Experimental |
The process container is the one most agents will meet. It uses AppContainer on Windows, Seatbelt on macOS and Bubblewrap on Linux, so it is a policy layered on the host operating system, not a separate machine.
Which agents ship with it
Microsoft's post says GitHub Copilot, OpenClaw, OpenAI Codex, Replit, LM Studio and Unsloth AI already support MXC, and that NVIDIA integrated OpenShell into it. It lists Anthropic's Claude Code, Box, Egnyte, Heidi Health, Nous Research's Hermes Agent, Manus, Perplexity, Raycast and Simular among those that "will release support."
Those are Microsoft's statements about other companies' products. The post gives no dates for the second group, and none of the companies named in it is quoted.
The parts marked soon
Several of the features that make a sandbox manageable by an administrator are not here yet. The post says "Only on Windows, MXC process containers can produce an agent activity report to help craft a least-privilege policy." A macOS or Linux developer tuning a policy has no equivalent report.
Intune management of process containers on Windows 11 is described as arriving "soon." Microsoft Entra agent identity, which would separate an agent's actions from its user's in Agent 365, is "Coming soon."
The repository README adds its own warnings. It says the windows_sandbox, microvm and hyperlight backends are experimental, and that "--audit turns off all sandbox security for the workload being analyzed. Never use it to run untrusted code." It also warns that "Your application will hit access issues when running in a sandbox, until you've had time to tune your containment rules."
That last sentence describes the daily friction. A developer running an agent that needs a package registry, a build tool and a project folder has to write down each of those grants before the agent's first run is clean.
Three modes for tuning a policy
The post describes three operating modes. Enforcement applies the policy and produces no report. Learning blocks ungranted operations and records them in a JSON report. Permissive allows them and records them, and Microsoft says it "does not bypass other applicable operating system or organizational restrictions."
Agent behaviour outside a developer's intent is the reason such layers exist. This site reported that Anthropic's Claude Haiku 4.5 filed a fake murder tip in July, and that police in Philadelphia heard about it in October. Agent infrastructure is also being rebuilt in Rust elsewhere, as with LiteLLM's Rust gateway, and MXC itself needs Rust 1.93 to build from source, according to its README.
The next milestone has no date. Intune management of Windows 11 process containers is promised "soon," and the post names no month.
Sources
More in Software
- 01Rust Borrow Checker Bug 11 Years Old Lets Safe Code Hide a Short-Lived Reference in a 'static ValueIssue #164250 shows a Drop impl smuggling a stack reference past the compiler on stable releases back to 1.85.0, and commenters trace variants to Rust 1.4.
- 02REA, a Reverse-Engineering Tool for AI Agents, Gained 52,186 GitHub Stars in a Day. It Has 653 Watchers.Three trackers report three different star totals for morluto/rea, and the 15 newest issues and pull requests show an installer still being patched.
- 03QGIS Merges a 'Closed Door' on AI-Written Code 13 Days After Proposing ItQEP 428 bars LLM, AI and agent-assisted code from qgis/qgis after a vote that closed October 7, with two follow-up proposals still open.
- 04Anthropic Moved Its Monorepo Off Git to Scion as Daily Merges Grew From 2,500 to 30,000A seven-person team built Scion in five months. The post is candid about merge-queue conflicts and says the system is not a git replacement for general use.