On October 7, 2026, Microsoft showed how Windows will become a platform for "Hybrid Intelligence," where AI agents can run either locally on a device or in the cloud depending on the task. Microsoft CEO Satya Nadella and Nvidia CEO Jensen Huang appeared together on stage at the event.
Why Windows constrains agents
In June 2026, Microsoft warned that AI agents increasingly operate autonomously across systems, introducing new risks for control and trust. On October 7, the company explained that agents' ability to work across files, networks, and applications can introduce new security risks.
What the container technology does
Microsoft Execution Containers (MXC) is a policy-driven execution layer for untrusted code or dynamically generated workloads. Developers can use it to restrict model outputs, plugins, tools, agent harnesses, or entire agents. Developers declare needed resources such as files and network targets, and MXC enforces the resulting boundary. The policy remains outside the workload's control, so an agent cannot grant itself additional access. As an example, Microsoft describes a coding agent that such a policy could allow read and write access to its source code repository while blocking personal folders, network connections, and the interactive desktop.
A process container is available on Windows 11, macOS, and Linux, using the appropriate sandbox for each system. Experimental variants like MicroVM are intended to provide hardware-backed isolation, though Microsoft itself notes that each backend has different security properties and workloads should be tested accordingly.
Available today, announced for later
MXC has been generally available since October 7, 2026, as has Windows 365 support for cloud PCs. According to Microsoft, tools including GitHub Copilot, OpenAI Codex, Replit, LM Studio, and Unsloth AI already support the technology, while support for Anthropic Claude Code, Perplexity, Manus, and other services is still to come.
Other features are only announced: An Intune policy that allows IT administrators to manage MXC process containers for MXC-integrated agents on Windows 11 is due "soon," according to Microsoft. The ability to distinguish agent activity from user activity via Microsoft Entra in Microsoft Agent 365 is also announced but not yet implemented; according to Heise Online, the Entra integration required for this should follow "shortly."
The Surface Laptop Ultra, fully unveiled on October 7, features Nvidia's RTX Spark chip and has been available for preorder since that day for $2,599, according to Engadget. It will be available beginning October 16, according to Fortune. The desktop equivalent, the Surface RTX Spark Dev Box, will cost $5,999 according to Fortune and ship in November, while Tom's Hardware cites October 16 as the delivery date.
Nvidia CEO Jensen Huang called the RTX Spark chip "a beast" at the presentation. Microsoft also promotes the laptop with performance comparisons against Apple's MacBook Pro with M5 Pro chip: With selected pre-production models featuring 64GB of memory, the first token output is up to 2.1 times faster according to Windows Latest; on selected RTX Spark PCs, AI image generation is up to 4.3 times faster and AI video generation up to 6.2 times faster. Microsoft showed no direct processor performance comparison, however, according to Windows Latest.
Copilot will in future use local context from the PC, act on behalf of users, and incorporate local AI models to use computing power more efficiently, according to Microsoft. According to Heise Online, using local content and the described local actions requires user approval. The company gives the example of automatically compiling tax-relevant documents from emails and local drives, packaging them in a zip file, and drafting an email to a tax advisor that users only need to send. According to Heise Online, Copilot+ PCs will receive these features in the coming months.