At its Windows event, Microsoft, alongside Nvidia, argued that agents need an operating system built for them. It moved Microsoft Execution Containers to general availability, gave agents their own identities, tied management to Agent 365 and Defender, and added hybrid intelligence that mixes local and cloud models. The pitch is credible, but we would have liked to have seen support for many of their claims.
Microsoft’s vision of Windows PCs as secure homes for agents. (Source: Microsoft presentation)
The headline at Microsoft’s October 7 Windows event was the Nvidia RTX Spark laptop platform, which we covered separately here. The longer story was software. Microsoft spent most of the event arguing that AI agents, software that acts on a user’s behalf, need an operating system designed to contain, identify, and manage them. Pavan Davuluri, Microsoft corporate vice president and head of Windows and Devices, built the case on three pillars shown on one slide: a secure platform for agents, hybrid intelligence, and AI in the flow of human ambition, all resting on powerful silicon and devices.
Davuluri broke the secure platform pillar into three parts: containment, identity, and manageability. This article follows that order and then covers the platform features around it.
Containment: Microsoft Execution Containers
Microsoft Execution Containers, or MXC, moved to general availability on Windows 11. Microsoft described it as a runtime sandbox for agents, with a spectrum of isolation that runs from a process and a session to Windows Subsystem for Linux (WSL) commands, a micro VM, a full VM, and Windows 365 in the cloud. The idea is that the level of containment can change with the tool and the task.
Figure 1. The MXC containment spectrum. (Source: Microsoft presentation)
Microsoft showed a long list of partners building on MXC, including Anthropic, Box, Egnyte, Heidi, LM Studio, Manus, Nvidia, OpenAI, OpenClaw, Perplexity, Raycast, Replit, and Simular. On the panel, OpenShell integration with MXC came up. Microsoft CEO Satya Nadella set the goal.
“We need it to make the desktop the most secure place for agents to execute,” Nadella said.
Identity: Agents are not users
The second part is identity. Microsoft gives each agent an identity separate from the user who launched it, and said Windows enforces attribution for every agent action. Using Microsoft’s Divya Venkataramu, director of product marketing, as an example, in practice, an action by “Divya’s Agent” is logged as the agent’s, not Divya’s. Microsoft said only Windows enforces this strongly at the operating system level. That is a competitive claim, and Microsoft did not mention any other operating systems by name in this regard.
Figure 2. Windows enforces attribution for every agent action. (Source: Microsoft presentation)
Manageability: Agent 365 and Defender
The third part is manageability. Microsoft said Windows brings enterprise manageability to agents through Agent 365, with Windows, Microsoft Security, and Agent 365 presented as an end-to-end platform for securing agents. An administrator sets a policy once, and it applies on every device. The Agent 365 admin center in the demo listed registered agents, active users, and time saved.
The demo that mattered the most was security. Venkataramu asked an agent in the GitHub Copilot app to update Python from instructions at a web address. The page carried a hidden prompt injection. Windows flagged it, and the app warned that the URL contained malicious instructions and blocked it. A second request, to summarize a SharePoint file, returned “access denied” for the agent, while the user retained access. Microsoft Defender then showed the event as an incident titled Prompt Injection on multiple agents, with the agent, the PC, and the copilot process in one graph.
Figure 3. Microsoft Defender shows a prompt injection incident involving an agent. (Source: Microsoft presentation)
It was a clean demo of a known attack—an important foundation needed to start collaborating with agents on our personal and business devices. When this feature is used by the masses, it would be very interesting if Microsoft shared a report with detection rates or false positive figures.
Hybrid intelligence: Local models do real work
The second pillar noted above, hybrid intelligence, is where software routes work between cloud and local models. Microsoft showed three parts: intelligent routing, highly capable local models, and a performant runtime.
On models, Microsoft announced Microsoft AI (MAI) Code 1.1 Flash, a coding model of more than 130 billion parameters, quantized to three bits with an 80% smaller footprint and a 256K context window for local coding. Microsoft’s chart put it at 72.6% on SWE-Bench Verified, ahead of Haiku 4.5, GPT 5.4 mini, and GPT OSS. The chart is Microsoft’s own, and it leaves out frontier models. Microsoft said Nvidia is working on a new Nemotron model, shown as more than 70 billion parameters and launching October 15, that fits in about 20 GB at 2 bits, which Microsoft called ideal for RTX Spark. It also showed DeepSeek V4 Flash, a 284 billion-parameter model squeezed to 1.6 bits to fit in 60 GB of memory. Microsoft did not say how quality loss from compression was measured.
Figure 4. Microsoft’s SWE-Bench Verified chart for MAI Code 1.1 Flash. (Source: Microsoft presentation)
On the runtime side, Microsoft announced llama.cpp on Windows ML, with high-level task APIs for generative AI development, and said Windows ML deploys models across GPU, CPU, and NPU.
In a GitHub Copilot demo, Microsoft’s Kayla Cinnamon, senior technical program manager, ran agents on a Surface RTX Spark Dev Box using the local MAI model. Task Manager showed the GPU as an Nvidia RTX Spark with a 6,144-core Blackwell GPU. The agents investigated three open issues in the Windows Terminal repository without changes or posts to GitHub, and one session sent 1.6 million tokens locally. Hybrid intelligence in the GitHub Copilot app, powered by GitHub’s HydraFusion routing, starts October 15.
Windows and Copilot learn to act
Microsoft also changed how Windows itself works. Taskbar search gains thousands of quick actions, such as switching to dark mode, turning on Do Not Disturb, taking a screenshot, or sending a text message, starting this fall on Windows 11 PCs.
Copilot now has a Hybrid Intelligence switch with three permissions: access your files, take actions on Windows apps and settings, and use local models to run tasks on the PC, at no extra cost. Copilot has three core experiences, Home, Code, and Autopilot, with Home combining chat and cowork. In an Autopilot tax demo, the agent found the accountant’s request, searched Downloads, Documents, Desktop, OneDrive, and Pictures, and organized and renamed the files using local models, which Microsoft said kept tax details off the cloud. It then zipped them and drafted a reply with the zip attached. Nothing was sent until the user approved it. In a Code demo, Copilot built native Windows apps that ran in an MXC local sandbox.
Figure 5. The Hybrid Intelligence permissions in Copilot. (Source: Microsoft presentation)
An ecosystem of agents
Microsoft showed third-party agents too, naming Hermes Agent, OpenClaw, and Perplexity. In a Perplexity demo of Portable Computer, which we covered recently here, a local agent resized a folder of photos and built an offline gallery with light and dark modes. Microsoft announced a simplified OpenClaw setup with a Windows native gateway, a new get started experience, and a mini desktop PC, an always-on device for running agents.
Microsoft also tied this to hardware tiers. It said over 40% of PCs being built for business are Copilot+ PCs and that over 2 trillion inferences run locally every month. It introduced a Builder tier for high-performance PCs that bring local and cloud AI together. Microsoft did not detail the requirements.
Figure 6. Microsoft’s Copilot+ PC adoption claims. (Source: Microsoft presentation)
What do we think?
What Microsoft showed is a vision for the long term. It starts with examples that run today (starting October 15) on selected applications that are enabled today, on newly introduced, selected hardware. How quickly it becomes broad, widely adopted usage depends on the resources invested in enabling applications, and on new generations of hardware that scale down from the premium price points and profiles it serves today. Starting from the top and scaling down is a smart strategy considering this is a technology that is coming from the cloud. Many disruptions happen while scaling from the bottom up; local agentic AI is not one of them.
The first local touch point for AI is obviously the workstations segment, with multiple tiers of systems like DGX Station → x86 + multiple discrete GPUs → DGX Spark. Now RTX Spark is the first breaking point into the average user, who wants to explore what AI can do for them, with privacy and control. Yes, RTX Spark’s average system price points are high enough to call for mass adoption, but before RTX Spark, the only client solution for local AI was a workstation. By comparison, premium laptops based on RTX Spark are reasonable for the value they provide and the features they offer. As memory supply improves and prices come back to earth, (call me an optimist) this same platform will reach more and more users.
All the work Windows is doing is welcome, but there is no standardized way to measure agent management. It is a spectrum of features, and without a standard, claims of the strongest enforcement are hard to compare. We are glad to see Windows push the envelope. Creating the new Builder tier, even if vaguely defined, it’s Microsoft acknowledging that this level of performance and capabilities go beyond what a Copilot+ PC can do with an NPU. RTX Spark is what always came to mind when I imagined an AI PC.
There are things we still do not know, and time will help us understand these new features better. We do not know how MXC behaves under attack outside a demo, or what it costs in performance. Microsoft did not say how MXC and Agent 365 treat agents that were not built by Microsoft or its partners. And the panel hinted at a larger issue. Nadella described a world in which people delegate to agents.
“I use the computer. My agents use the computer,” Nadella said. Trust in that world, multiple speakers said, depends on containment at every level, agent identity, observability, and governance.
We agree the separation of the user and the user’s agents is brilliant and necessary, so we all learn to work alongside our agents. In the same way we would not let a child use our phone with access to our banking applications, we do not want agents accessing information they do not need and are not authorized to use to complete a task. We have read in the news what happens when agents get creative.
For corporate adoption, security and manageability will need to be on par with x86, with long support cycles. These features are a step in that direction, and one we believe in, if we want to start letting agents move from an experimenting phase to a one of collaboration, partnership, and an extension of ourselves.
– The Workstation Cavalry
AND IF YOU LIKED WHAT YOU READ HERE, DON’T BE STINGY, SHARE IT WITH YOUR FRIENDS.
Disclaimer: This article is not financial advice. The content is for informational purposes only. The author may own shares in companies mentioned, and readers should not consider this article a recommendation to buy, sell, or hold any assets.