Microsoft's new tax-demo shortcut is also a permissions test. Copilot found local documents, renamed them, zipped them, attached the archive to an email, and prepared the message for sending. The Verge's account of the demonstration focused on the convenience. The harder consequence for anyone building or administering Windows software is that an AI assistant now needs authority across files, applications, and communications to complete the job.
Microsoft paired that demonstration with two different product moves. Copilot will gain local context, local actions, and access to models running on a PC, while Microsoft Execution Containers, or MXC, is now generally available as a policy layer for agent workloads. Microsoft's Windows announcement presents them under one idea called hybrid intelligence. Read closely, though, they are at different stages and answer different security questions.
A useful demo with unanswered permission questions
In the onstage example, Copilot's Autopilot mode searched folders for documents requested by an accountant, renamed the files, made a zip archive, and drafted an email with the archive attached. According to The Verge, Microsoft said features powered by hybrid intelligence would come to Copilot over the next couple of months.
The company's own timetable is a little more specific about eligible hardware and no more specific about the date. Microsoft says the features are expected to begin rolling out to Copilot+ PCs in the coming months. The same post says Copilot will use local content and recent activity with the user's permission, take actions across Windows, and choose between local and cloud models as needed.
That description leaves several operational details open. Microsoft's announcement does not define whether a user grants access per file, per folder, per task, or for a longer session. It does not describe a confirmation screen for attaching a newly created archive, an activity log for personal users, or a single place to revoke an earlier grant. Those omissions do not prove the controls are absent. They mean the published material does not yet let developers or administrators evaluate them.
The distinction matters because the demo joins several individually ordinary operations into one consequential sequence. Finding a tax form is a read. Renaming and zipping are writes. Attaching the result moves the data into another application and prepares it to leave the machine. A permission model that treats the whole chain as one vague approval would give the agent far more room than one that scopes every resource and destination. Microsoft's separate container work addresses this problem at the workload level.
Containment moved from promise to product
Microsoft describes MXC as an execution layer for untrusted code, generated output, plugins, tools, an agent harness, or an entire agent. Its policy sits outside the workload, so code running inside cannot grant itself additional access. Developers declare the files, network destinations, commands, and interface access a workload needs. MXC selects a container backend to enforce that boundary.
The available isolation depends on the host and the risk. A process container works across Windows 11, macOS, and Linux using each system's native sandbox. Windows also gets a session container with a separate account, desktop, clipboard, input boundary, and active session. WSL containers cover Linux-oriented toolchains on Windows, while a MicroVM option is still experimental. The MXC repository lists additional backends and marks the experimental ones rather than presenting every container as equivalent.
The policy can make one source tree writable, expose another path as read-only, and deny personal folders. It can also block network access and the interactive desktop. Microsoft's example is a coding agent that may edit a website repository and read production configuration, but cannot change that configuration. The restriction is enforced outside the model, generated code, plugin, and tool, according to the MXC launch post.
Microsoft gives policy authors more than an allow-or-deny switch. Enforcement mode blocks access outside the declared boundary. Learning mode blocks and records denied operations in a JSON activity report. Permissive mode records access that policy would have denied while allowing the workload to continue, which can expose missing rules before enforcement. Microsoft warns that permissive operation still remains subject to other operating-system and organizational restrictions.
There is a sharper warning in the open-source repository's README. Its separate --audit option turns off sandbox security for the workload being analyzed and should never run untrusted code. That is the sort of footnote a production team needs: a diagnostic path meant to help write policy can remove the protection that policy is supposed to provide.
GA covers only part of the control plane
MXC's containment layer is generally available. Agent identity and fleet management are on a later schedule. The company says Windows will soon let Microsoft Entra distinguish agent activity from user activity in Microsoft Agent 365, while Intune policies for managing MXC process containers on Windows 11 are also described as coming soon. Microsoft's platform post therefore divides the security model into something administrators can deploy now and pieces that have not yet arrived.
Current integrations have their own split. Microsoft says GitHub Copilot, OpenAI Codex, OpenClaw, Replit, LM Studio, and Unsloth AI already support MXC. Anthropic Claude Code, Box, Egnyte, Hermes Agent, Perplexity, Raycast, and others are on a future-support list. The wording is important for procurement or rollout decisions: a named partner is not necessarily shipping an MXC integration today.
MXC itself is an SDK dependency rather than a universal switch that automatically wraps every agent on Windows. Its repository offers Rust, .NET, and Node packages, a versioned JSON schema, and samples. The application specifies a command, containment rules, and a backend. MXC validates the request and launches the workload. An agent developer still has to integrate the SDK and choose a policy, while an organization can add tighter constraints later.
That arrangement gives software teams a practical least-privilege route. It also creates a failure mode Microsoft calls out directly: organizational policy may block a resource the agent legitimately needs. The company's guidance says an agent should explain the denial, request an appropriate action when supported, or choose a safe alternative instead of failing silently. Opaque failures create pressure to grant broader access just to make the errors disappear, so that behavior will need testing.
Copilot's own boundary remains the test
Microsoft's two announcements do not say that the tax-document demonstration ran inside MXC. The Windows post says Copilot's Code experience can run code with MXC support, and it describes MXC integrations for several outside agents. It does not connect MXC to Autopilot's local-file actions or state that the Home and Autopilot experiences use the same container policy. Treating those claims as interchangeable would fill in a security detail Microsoft has not published.
The phrase "local model" also does not settle where data goes. Microsoft's hybrid design explicitly routes work between models on the PC and services in the cloud. Its announcement says this can preserve cloud capability while reducing token use, but it does not provide a task-by-task data-flow description for Copilot's local context. A file can be discovered locally while later reasoning or an application action still involves a network service. Users will need a visible account of those transitions.
Microsoft has time to supply that account before the wider Copilot rollout. Useful documentation would name the default file scope, show when a task pauses for confirmation, explain whether outbound destinations can be restricted, and expose a readable history of agent actions. Enterprise buyers will also need dates for Entra attribution and Intune management, since those features determine whether security teams can separate an agent's behavior from the employee who launched it.
A zip file is an easy demo because everyone can see the saved steps. The release test is harder: when that archive contains tax records, Windows should make the file boundary, network destination, acting identity, and final approval just as visible. Watch the first Copilot+ PC preview for those controls, and for a clear statement on whether Copilot's own local actions receive the same OS-enforced containment Microsoft now offers other agent developers.