Microsoft MXC: Open-Source Sandboxing for AI Agents and Untrusted Code

X postSimon WillisonTool

Simon Willison highlights Microsoft's newly open-sourced MXC (Microsoft eXecution Container). The cross-platform library enables sandboxed execution of untrusted code—such as model outputs, plugins, and tools—across Windows, Linux, and macOS.

Key points

  1. MXC (Microsoft eXecution Container) isolates untrusted code execution, model outputs, and tools across multiple operating systems.
  2. Leverages native containment backends: ProcessContainer on Windows, Bubblewrap on Linux, and Seatbelt on macOS.
  3. Supports additional and experimental backends including LXC, WSLC, Windows Sandbox, MicroVM (Nanvix), and Hyperlight.
  4. Policy-driven configuration via JSON covering filesystem read/write rules, outbound network egress, and UI permissions.
  5. Provides typed SDKs for Rust, .NET, and Node.js, alongside standalone executor binaries.
  6. Features diagnostics and an audit mode to observe access-denied failures and tune security policies.

Why it matters

As AI agents increasingly run shell commands and generate code locally, containment is critical. MXC offers a unified, lightweight cross-platform alternative to spinning up full virtual machines for untrusted workloads.

Analysis

Isolating agentic workflows across different operating systems previously forced developers to manage disjointed tooling. By wrapping native OS isolation primitives behind a single typed API and policy schema, MXC provides an ecosystem-wide foundation for secure local AI execution.

Original post

Simon Willison

@simonw · 8 October 2026

New open source cross-platform (Windows, macOS, Linux) sandboxing library from Microsoft - looks very promising, uses processcontainer/bubblewrap/seatbelt under the hood t.co/WMW0AXeBoG t.co/1xXIohaD5g

777 likes105 replies545 bookmarks45.5k views

View on X
Selected replies (5)
  • @olshansky @simonw As an FDE @ OAI, windows sandboxing has been one of the most tumulus challenges so far. Luckily, the codex team is already on it! t.co/OwSI12zo2s
  • @grok @SylonZero @simonw Multipass launches full Ubuntu VMs via native hypervisors for interactive dev and cloud-init simulation. Mature, stable, strong isolation but with VM overhead. MXC is a newer open-source SDK for policy-driven sandboxed execution of untrusted code (esp. AI agents). Defaults to
  • @yarikonaut @simonw this is what i want for claude code in bypass mode. right now my only safety net is a hook that blocks rm -rf. a real sandbox and i'd sleep better
  • @MarcusSpillane @simonw bubblewrap and a seatbelt is exactly how much I trust an agent with my laptop.
  • @niv_ai @hadoukentino @simonw I went the local Docker route: each agent gets its own Linux computer on my Mac with only its workspace mounted, so it skips prompts without seeing my home folder. Pro: it runs on my ChatGPT plan through Codex. Con: my computer has to be on, and I've only tested with Colima.

Mentioned links

Links and tools from this entry

Summary generated by AI (Gemini 3.8 Flash, 9 October 2026). It may contain errors – the original source is authoritative.

Related entries

Similar in content, found by the AI search.

  • Repository:microsoft/mxc

    Microsoft eXecution Container (MXC): Sandboxed Execution for Untrusted Code

    Microsoft eXecution Container (MXC) is a cross-platform sandboxed code execution framework designed for running untrusted workloads such as AI model output, plugins, and tools across Windows, Linux, and macOS. It wraps native OS containment mechanisms and VMs into a unified policy engine and typed SDKs.

    1.8kstarsRust

    AI & LLMs· Tool

  • Repository:anthropics/sandbox-runtime

    Anthropic Sandbox Runtime: Lightweight Process Isolation Without Containers

    Anthropic's Sandbox Runtime (srt) is an open-source tool designed to enforce OS-level filesystem and network restrictions on arbitrary processes. Developed as a safety component for Claude Code, it isolates AI agents, MCP servers, and shell commands without requiring containerisation.

    5.1kstarsTypeScript

    AI & LLMs· Tool

  • Repository:NVIDIA/OpenShell

    NVIDIA OpenShell: Isolated Runtime for Autonomous AI Agents

    NVIDIA OpenShell is an open-source runtime written in Rust designed to run autonomous AI agents in secure sandboxes. It enforces declarative policies at the kernel level and guards access to network routes and credentials.

    16.6kstarsRust

    AI & LLMs· Tool

  • Repository:agent-substrate/substrate

    Agent Substrate: Zero-Trust Sandboxing for Autonomous Agents on Kubernetes

    Agent Substrate is an open-source Go runtime designed to run millions of agent workloads securely and efficiently on Kubernetes. It isolates untrusted code using microVMs or gVisor and snapshots idle agents to save resources.

    5.4kstarsGo

    AI & LLMs· Tool

  • Repository:CopilotKit/OpenBot

    OpenBot: Open-Source Platform for Isolated and Governed AI Coworkers

    OpenBot by CopilotKit is a self-hosted platform providing AI agents as coworkers. Each agent operates within its own dedicated computer environment, featuring a real browser, scoped file access, and explicit tool permissions.

    4.3kstarsTypeScript

    AI & LLMs· Tool

  • Article:Eli Aleyner, Nikhil Kaul

    NanoClaw Integrates Docker Sandboxes for Isolated AI Agents

    Lightweight agent framework NanoClaw has integrated with Docker Sandboxes. By executing agents inside disposable MicroVMs, the integration provides operating system-level isolation while leaving the host untouched.

    AI & LLMs· Announcement

Back to the knowledge base

Let's talk about your project

Get in touch

Locations

  • Mattersburg
    Johann Nepomuk Bergerstraße 7/2/14
    7210 Mattersburg, Austria
  • Vienna
    Ungargasse 64-66/3/404
    1030 Wien, Austria

Parts of this content were created with the assistance of AI.