Agent Sandboxing Goes Native: MXC GA, Copilot and Codex

On October 7, 2026, agents stopped being governed by prompts and started being governed by the kernel

For two years, agent safety has been argued at the prompt layer: system instructions, injection filters, "don't touch anything outside the repo." On October 7, 2026, that assumption took a structural hit. Microsoft Execution Containers went generally available — moving the boundary from the prompt into the operating system, where the agent cannot argue with it.

Three announcements landed in the same window: Microsoft shipped MXC v1.0, GitHub took local sandboxing for Copilot GA, and OpenAI added an MXC-backed sandbox mode to Codex (announced October 9). Here is what the primary sources actually say.

MXC is an SDK, not a product

MXC is an SDK you embed in an application, not something you install. You declare one versioned JSON policy — which files, network destinations, and UI surfaces a workload may reach — and the OS maps it onto a native isolation mechanism and enforces it at runtime. The code is MIT-licensed at microsoft/mxc. SDKs ship for Rust, .NET, and Node.js, with v1.0.0 dated October 7 as the first stable release and the stable compatibility boundary for the 1.x line:

• Rust: mxc_sdk::v1
• .NET: Microsoft.Mxc.Sdk.V1
• Node.js: @microsoft/mxc-sdk/v1

They are published on crates.io, NuGet, and npm. Four backends are available:

• Process container — AppContainer on Windows 11, Seatbelt on macOS, Bubblewrap on Linux. For lightweight, responsive work like generated code and tool calls.
• Session container — Windows 11 only. Runs the agent under a distinct Windows account and session with separate desktop, clipboard, UI, and input boundaries.
• WSL container (WSLC) — for Linux-first toolchains.
• MicroVM — hardware-backed isolation. Marked experimental.

The architectural point that matters: the policy lives outside the workload. Model-generated code cannot grant itself more access. There is also a learning mode that blocks ungranted operations and writes a JSON activity report, so you can author the policy from observed behavior instead of guessing. Three modes exist: enforcement, learning, and permissive.

GitHub Copilot's local sandboxing reaches GA

GitHub's October 7 changelog took local sandboxing GA in the Copilot CLI, the Copilot app, and VS Code sessions using Agent Host. It costs nothing extra on a Copilot seat (cloud sandboxing is usage-billed).

Enabling it is one slash command:

/sandbox enable

• /sandbox status — what the session is actually enforcing
• /sandbox policy — effective paths, network rules, and capabilities; pass a command (/sandbox policy npm install) to preview the access it would get without running it
• /sandbox config — interactive settings for filesystem, network, credentials, subprocesses, macOS keychain
• --sandbox / --no-sandbox — per-run control, usable with -p

The documented defaults are worth reading carefully:

• Filesystem: commands can write to the current working directory and temp folders. Inside a Git repo, Git metadata is writable and the rest of the repo above your working directory is read-only. The home directory as a whole is not exposed.
• Network: outbound internet is on by default. Local network access is off by default.
• Credentials: Git and gh auth are on by default, but sandboxed commands receive placeholders — a local proxy swaps in real credentials only for approved HTTPS destinations (for gh: github.com, api.github.com, uploads.github.com).

One caveat deserves emphasis because it is widely misread: the Copilot CLI itself is not sandboxed. Its built-in file tools run inside the CLI process, so the OS boundary never sees their file operations; GitHub says those tools check the policy on a best-effort basis. What the OS actually contains is the child processes — shell commands, file search, and by default local MCP and language servers. Remote MCP servers are never sandboxed.

Requirements differ per platform:

• Windows: Windows 11 25H2 with KB5124010 or later, or 26H1 with KB5124006 or later
• macOS: Seatbelt; macOS 15 Sequoia or later recommended (older versions aren't blocked, but untested)
• Linux: bubblewrap 0.5.0 or later (bwrap on PATH); outbound traffic additionally needs unshare/nsenter from util-linux 2.35+, plus slirp4netns, iptables, ip6tables, and /dev/net/tun

Two Windows gotchas are documented. Without the September 2026 update, sandboxed PowerShell can report a drive root as its working directory, breaking Set-Location and Git commands — the workaround is absolute paths, e.g. git -C "C:/PATH/TO/REPOSITORY" status. And credential proxying needs host loopback support with Allow local network enabled, which also opens private-network access beyond the proxy.

OpenAI Codex gets an MXC mode (October 9)

OpenAI added a new Windows sandbox mode built on MXC. The practical difference: it avoids the administrator-approved setup, separate Windows accounts, and local firewall rules the older elevated sandbox required of a compatible Windows 11 device. Codex on Windows is available in the ChatGPT desktop app, the Codex CLI, and the IDE extension.

Configuration is two lines in config.toml:

[features]
prefer_mxc = true

Note the wording: prefer, not force. If MXC is unavailable or blocked, Codex falls back to the legacy selection flow instead of failing. To test a single command without changing saved settings, Codex CLI 0.162.0+ supports:

codex -c windows.sandbox=mxc sandbox --include-managed-config --permission-profile :workspace -- cmd.exe /d /c echo MXC_OK

Expected output is MXC_OK and exit code 0. Administrators can distribute or enforce features.prefer_mxc = true through requirements.toml (both permit legacy fallback), or block MXC entirely with:

[windows]
allow_mxc = false

Microsoft introduced MXC process isolation in Windows 11 24H2 (build 26100.9278) and 25H2 (build 26200.9278), and is still rolling the capability out. Two compatibility limits are documented: managed networking requires an effective allow_local_binding = true (MXC permits host-loopback connections, and the proxy's additional private-network destination checks are removed), and remaining child processes stop when the foreground command exits — so workflows that rely on detached development servers break.

The companion numbers: MAI-Code-1.1-Flash running locally

Microsoft also published an on-device build of MAI-Code-1.1-Flash, a coding-optimized MoE with 137B total / 6.8B active parameters. Quantization to roughly 3.3 bits per weight brings it to 53 GB — an 80% reduction in size, while keeping a 256K context window. Measured October 5, 2026 on a Windows ARM64 llama.cpp CUDA runtime with DFlash2 sliding-window speculative decoding:

• SWE-Bench Verified: 72.6% cloud bf16 → 70.80% quantized on device (GPT-OSS-120B GGUF comparison: 32.0%)
• Terminal-Bench 2.1: 62.9% → 66.29% (GPT-OSS-120B: 23.6%)
• Peak memory 75.5 GB at 256K context; prompt-processing throughput of 923.5 and 769.8 tokens/second at 64K and 128K
• No per-inference charges for local model calls. Microsoft recommends devices with more than 120 GB of RAM

The quantized build outscoring the bf16 cloud variant on Terminal-Bench is a measurement artifact — different decoding and runtime conditions — not evidence that quantization improved the model. Read it that way.

What actually changed this week

MXC's GA lets teams move the agent boundary from the prompt to the OS. But the GA is asymmetric:

• Available now: MXC itself, Windows 365 support, Copilot's local sandboxing at no extra cost, Codex's MXC mode
• "Coming soon," no date: Intune policy for MXC process containers, Entra separation of agent activity from user activity, and Agent 365 on-device local agent controls

That last gap is the one to plan around. The mechanism that records which agent acted — rather than whose account it ran under — is not in the GA. Your audit log still attributes agent file access to the employee. Until those land, the developer who built the agent writes the boundary, and Copilot's defaults are GitHub's choices while OpenClaw's are that project's. Microsoft states plainly that agents cannot serve as their own security authority.

The company also left one warning standing. On February 19, 2026, Microsoft's Defender Security Research Team wrote that OpenClaw "is not appropriate to run on a standard personal or enterprise workstation" and should be evaluated "only in a fully isolated environment such as a dedicated virtual machine or separate physical system." OpenClaw now ships MXC support — and MXC's VM-grade backend is the one still marked experimental. Nothing in the October 7 post retracts the February guidance. A process container on a laptop is not a dedicated VM.

So the question for October 2026 is not "is the agent sandboxed?" It is: which strength of isolation, and who writes the boundary, on what day.