Windows AI agent security: how isolation works

Microsoft’s approach to AI agent security is intricately designed around three distinct execution boundaries: local process isolation, session isolation, and the cloud-based Windows 365 for Agents. This layered architecture aims to enhance security by managing how agents interact with files and networks. Process isolation restricts access to specific files and network domains, while session isolation ensures that an agent operates independently from the user’s interactive environment. The introduction of Microsoft Execution Containers (MXC) on June 2, 2026, marks a significant step in this local isolation strategy.

Two ways to isolate an agent locally

Within the realm of local isolation, Microsoft employs two primary methods:

• Process Isolation: This method confines an agent’s workload within a restricted process boundary. Microsoft emphasizes that policies can limit both file access and network reach. This approach is particularly suitable for coding agents, where the generated code operates within predefined limits set by the application or developer.
• Session Isolation: This technique separates an agent from the user’s desktop, clipboard, interface, input devices, and active sessions. An isolated session can utilize either a local identity or a cloud-provisioned identity supported by Microsoft Entra. The initial rollout focused on non-interactive sessions, distinguishing it from mere process restrictions.

In a recent interview, Microsoft CEO Satya Nadella highlighted the potential insider risks posed by AI agents, reinforcing the need for human oversight in advanced AI systems. The MXC framework embodies this security philosophy by clearly defining what an agent can access and enforcing these boundaries during runtime.

MXC’s policies and the audit-mode warning

The MXC repository outlines a comprehensive set of policies governing filesystem access, network traffic, and user-interface controls, including clipboard and GUI interactions. The choice of backend determines the available isolation behaviors, with Windows 11 supporting both x64 and ARM64 architectures. The default backend is ProcessContainer, while Windows Sandbox, MicroVM, and Hyperlight are classified as experimental.

One critical setting to note is the audit mode, which disables sandbox security for the workload under analysis. This diagnostic mode should not be confused with a protected execution environment. Developers examining an agent’s behavior must recognize that an audit run does not guarantee containment.

Additionally, Microsoft Defender offers real-time protection against emerging threats such as prompt injection. The design of MXC separates identity, runtime boundaries, and threat monitoring, allowing a distinct agent identity to track activities while process and session isolation dictate the scope of the workload’s reach.

Local isolation or Windows 365 for Agents?

The choice between local isolation and Windows 365 for Agents hinges on the execution environment of the agent and the necessary separation from the user’s workspace. Process isolation limits file and network access, while session isolation creates a distinct local session for the agent. In contrast, Windows 365 for Agents shifts execution to an Intune-managed Cloud PC, entirely separate from the user’s device.

Microsoft’s announcement on June 2, 2026, indicated that MXC is currently in early preview, with local process and session isolation expected to follow suit shortly after Build 2026. Meanwhile, Windows 365 for Agents is already generally available, presenting distinct deployment options that cater to varying security needs rather than interchangeable labels for a single sandbox environment.