Microsoft just told you the operating system is not where your agents are controlled.

Containment is going cross-platform. A threat actor showed this week what that does and does not cover. By Eric Yehle.

One policy, many enforcement engines

Microsoft Execution Containers (MXC) was introduced at Build in June and has been in early preview since July. It is easy to file under “Windows security.” That undersells it. The open-source project (MIT license) runs on Windows, Linux and macOS, takes a single JSON policy and a TypeScript SDK, and hands enforcement to whichever backend the host offers: AppContainer-based process containers and Windows Sandbox on Windows, Bubblewrap and LXC on Linux, Seatbelt on macOS, with micro-VM options (Hyperlight, NanVix) underneath.

The ecosystem is already wide. GitHub Copilot CLI’s local sandbox is built on MXC. NVIDIA’s OpenShell, OpenAI Codex, OpenClaw, Nous Research’s Hermes and Manus are listed as partners. Microsoft’s own framing, from Dana Huang and Logan Iyer, is that containment bounds what agents can access and do.

Read the architecture rather than the marketing. The policy is the portable object. The operating system is a replaceable backend. Microsoft has, in effect, conceded that the OS is no longer the trust boundary for agentic work. The boundary is whatever policy someone wrote, and whichever engine happens to enforce it.

The caveats are Microsoft’s own

The project’s README states that no MXC profile should currently be treated as a security boundary, and that SDK-generated default policies are overly permissive. Independent write-ups of the repository documentation add that enforcement is uneven across platforms: denied-path rules are not yet supported on Windows, and network host filtering is cooperative rather than enforced on Linux and macOS. macOS support is described as experimental. Audit and learning modes exist so teams can tune policy before enforcing it, which means the same policy file can be run in a mode that observes rather than blocks.

For a CISO this is the practical finding. “We use MXC” does not tell you what is enforced. It tells you a policy exists. What it guarantees depends on the OS, the backend, the mode, and whether anyone verified it.

CrowdStrike: an attacker’s agents, outside anyone’s container

On October 7 CrowdStrike Intelligence published analysis of a campaign against South Korean financial organizations that ran from late September into early October and resulted in exfiltrated data. Open directories on attacker infrastructure exposed Claude Code session histories, ARTEX configuration files and Claude memory files. ARTEX is a recently released open-source agentic penetration-testing tool developed in China.

The details worth a CISO’s attention:

• ARTEX ran against DeepSeek v4.1-flash as its primary model, supplemented with GLM-5.3 and Grok 4.6, with Claude Code sessions driven by a Chinese-language pentest prompt kept in a CLAUDE.md file.
• Reporting cited by CrowdStrike says one bank’s loan-progress inquiry service for brokers was breached, and at another an employee mobile work-support system. CrowdStrike says the number of affected organizations is not confirmed.
• CrowdStrike assesses with moderate confidence that the actor is a Chinese speaker and financially motivated. It has not attributed the activity to a named adversary. The post includes personal details found in one session; CrowdStrike says they cannot be definitively tied to the actor, so this brief does not repeat them.
• The actor also asked Claude where Korean breach data is sold.

CrowdStrike’s own conclusion is that adversaries will keep folding AI tooling into their operations to raise tempo. The pattern is commodity assembly: an open-source agent framework, several interchangeable models, rented proxies. No frontier lab was required.

Containment answers one question

Put the stories side by side. MXC answers “what can this agent touch?” It does that for agents you run, on hosts you manage, under a policy you wrote. It does nothing about an attacker’s agents on infrastructure you will never see. And even for your own agents, it says nothing about whether an action inside the permitted space should happen.

An agent with valid identity, inside a correctly configured sandbox, can still send the right payment to the wrong counterparty or touch the wrong production target. Every control above passes. That is the authenticated-but-not-authorized gap this brief has followed for months, and the Windows announcement does not close it. It moves it up a layer.

Five questions

1. When you say an agent is contained, which backend enforces it on each OS we run, and which policy rules are not enforced on each?
2. In what mode is the policy running in production today, and what stops it being switched from enforce to observe?
3. Who authors and versions the policy, and who can show which version was in force when a given action ran?
4. When fresh intelligence says a destination or counterparty has become unsafe, how does a running agent with valid permissions lose the ability to finish a consequential action?
5. Is the record of an action produced by a party independent of the agent and the platform that enforced it?

Next step. If these questions are ones your team cannot answer today, the Escalation Baseline is a fixed-scope, two-week engagement that finds out. Details at authoritygap.ai.

• CrowdStrike Intelligence, “Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance,” October 7, 2026 — crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance
• Microsoft MXC repository and documentation — github.com/microsoft/mxc
• Help Net Security, “Microsoft wants to keep your AI agents from going rogue,” July 7, 2026 — helpnetsecurity.com/2026/07/07/microsoft-execution-containers-ai-agents-constraints
• InfoWorld, Simon Bisson, “Running AI agents in sandboxes with Microsoft Execution Containers” — infoworld.com/article/4215416
• InfoQ, “Windows Platform Security and the Race to Secure AI Agents,” June 2026 — infoq.com/news/2026/06/windows-security-agents
• Microsoft platform research notes on MXC and Entra agent identity — microsoft.github.io/entrabot/platform-learnings/mxc-windows-sandbox

NexusRiver · Eric Yehle · TLP:AMBER