Microsoft Build 2026: Windows gets built-In AI agent sandboxing with MXC, OpenClaw Support, and Nvidia OpenShell

Concerned about the security implications of running AI agents locally on your device? Microsoft is introducing new Windows capabilities designed to make on-device agent workloads more secure, with built-in identity isolation and governance controls enforced directly by the operating system.

Now available in preview, Microsoft Execution Containers (MXC) introduce a new policy layer that allows developers and IT administrators to define agent containment requirements once and rely on Windows to enforce them using native operating system primitives. The approach is designed to make running AI-generated code both easier and more secure.

Microsoft also announced that OpenClaw, one of GitHub's most popular open-source AI agent projects, is coming to Windows. Currently available in alpha on GitHub, OpenClaw will integrate more seamlessly with the Windows ecosystem, enabling developers to build and deploy AI agents more easily.

With these advances, agents will be able to execute complex, multi-step workflows locally while operating within OS-enforced security boundaries rather than unmanaged environments.

More from Tech

Nvidia OpenShell Runtime Comes to Windows

Nvidia is also collaborating with Microsoft to bring the Nvidia OpenShell Runtime to Windows. Built on Microsoft Execution Containers (MXC), OpenShell is Nvidia's open-source runtime for executing autonomous AI agents in sandboxed environments.

Microsoft said that integrating MXC with OpenShell provides developers with a streamlined way to deploy autonomous, always-on AI agents while maintaining enterprise-grade security and governance. The platform includes features such as policy management, inference routing, and personally identifiable information (PII) protection, while giving IT teams centralized visibility and control across devices, virtual machines, and cloud environments.