Microsoft used its first live hardware event in two years to recast Windows itself as a place where AI agents live — and, just as importantly, where they are caged.

The centrepiece for developers is Microsoft Execution Containers, or MXC, which the company says is available to developers now. Rather than a single sandbox, MXC works as a policy layer that routes an agent's compute into whichever isolation backend fits the workload: a process container, a session container, a WSL container, or an experimental hardware-backed MicroVM. Administrators can see which agents are running and set guardrails on what each one may touch. Microsoft says the capability will reach every Windows 11 user, not just buyers of its new machines; CEO Satya Nadella framed it as the natural next step for a platform. "One of the things we realized in the last 3-4 years is that just having a model doesn't do much for anything," he said. "You really do need to orchestrate, and you need to have memory outside of the model."

Copilot gets a rebuilt interface with three tabs: Home for talking to models, Code for prompting widgets and Windows applications into existence, and Autopilot for supervising agent tasks. A new Windows Search experience, shipping later this year, is meant to execute system-level actions — changing display settings, for instance — straight from the search bar instead of walking a user through Control Panel.

Under the banner of "Hybrid Intelligence," Microsoft is also pushing local-first inference: the new Surface Laptop Ultra and the RTX Spark Dev Box can allocate unified memory per application and ship with native support for local frameworks such as llama.cpp. The machines are expensive — the laptop starts at $2,599 and the dev box at $5,999, with prices rising to roughly $5,900 depending on memory and storage, and Microsoft is offering up to $1,000 off for MacBook Pro trade-ins. Dell announced its own RTX Spark machine, the XPS 16 Creator Edition, at $3,800, and ASUS opened pre-orders for its ProArt P16 and P14 on the same day.

The OS announcements are the part that outlasts the hardware cycle. If agents are going to be handed file systems, settings and applications, then the sandbox, the permission model and the audit trail become the platform's real product — and the reason Microsoft is trying to answer the safety question before regulators or enterprise buyers ask it. Ars Technica notes the open questions that remain: whether users accept an OS that proactively acts on their behalf, and whether the containment story holds up under adversarial pressure. The first independent look arrives with reviews of the Surface Laptop Ultra, which ships Oct. 16.

Sources