Microsoft Cages the Agent: MXC, MDASH, and the Push to Govern Autonomous AI at Runtime

Autonomous AI agents can read files they shouldn't touch, leak credentials, and make unsanctioned network calls. That list of failure modes is not hypothetical. Microsoft, at its annual Build developer conference, announced a stack of controls designed to make that behavior the exception rather than the default.

The centerpiece is Microsoft Execution Containers — MXC. It is a policy-driven runtime containment system that lets developers declare, via a JSON configuration schema and TypeScript SDK, exactly which files, networks, credentials, and resources an agent can reach. At runtime, MXC enforces those boundaries. Backends range from OS-native process sandboxes to full virtual machines, running across Windows, Linux, and macOS.

Containers and sandboxes are old news. What Microsoft is doing differently is positioning MXC as infrastructure purpose-built for agentic workloads — environments where models don't just generate text but invoke tools, modify code, and take actions with real side effects. The threat model is different. The blast radius, if something goes wrong, is different.

Several platforms are already integrating MXC. OpenClaw and NVIDIA's OpenShell are running agents inside MXC-isolated environments. Agent 365 SDK — a framework for building and deploying AI agents — will pull in controls from Defender, Entra, Intune, and Purview through the MXC integration. Windows 365 for Agents, a managed cloud workspace for autonomous agents, sits alongside that effort.

On the vulnerability-research side, Microsoft used Build to announce expanded preview availability and Defender integration for its Security Multi-model Agentic Scanning Harness, tracked internally as MDASH. The system fields more than 100 specialized AI agents across multiple models to find vulnerabilities, score exploitability, and cut false positives before findings surface to human analysts. Microsoft first disclosed MDASH in May 2026, noting it had already helped surface critical Windows remote code execution vulnerabilities.

Two open-source governance initiatives rounded out the announcements. ASSERT — Adaptive Spec-driven Scoring for Evaluation and Regression Testing — gives organizations a way to measure agent behavior against defined security and operational requirements. The Agent Control Specifications framework provides portable governance policies that travel with an agent across runtimes and platforms rather than locking to a single vendor stack.

Capability and intent are separate questions. Microsoft has the engineering reach to ship this infrastructure broadly. Whether enterprises adopt the governance frameworks with the same enthusiasm they bring to shipping agents in the first place is a different matter entirely.