Microsoft MXC: preview sandboxing with a security warning
Scoped recheck: 24 October 2026. The README still warns that audit mode turns off all sandbox security. The security-boundary warning this post first quoted was in the README's early-preview notice. GitHub history shows that notice was removed in a commit titled "Remove preview disclaimer from README" dated 6 October 2026 (UTC), and we did not find it in the current README or policy specification, so it is no longer quoted. No isolation guarantee is implied. Original publication date unchanged.
Microsoft Execution Containers, or MXC, is open-source code for running untrusted workloads through containment backends. Its README warns that audit mode turns off all sandbox security and marks several backends experimental. A sandbox label is not a guarantee of isolation, so verify enforcement yourself.
Official publisher artwork hosted by its publisher. Official source. Independent guide, not affiliated or sponsored. Artwork and trademarks belong to their owners.
What does MXC do?
MXC presents execution settings through a JSON configuration schema and a TypeScript SDK. It is intended for workloads such as model output, plugins and tools.
A sandbox tries to limit what a process can reach. A configuration file describes those limits; it does not prove that every backend enforces every field. Earlier versions of the README described an early preview under ongoing development; the current README does not repeat that line.
Backends are different
The repository lists Windows, Linux and macOS routes, including process containment, Bubblewrap, LXC, Seatbelt and several experimental options such as microVM and Windows Sandbox backends.
The supported-OS table gives different version, architecture and runtime requirements. Linux needs the matching backend runtime. The README marks the Windows Sandbox, microVM and Hyperlight backends as experimental. Do not read cross-platform as identical enforcement on every computer.
Filesystem, network and UI policies
The README describes policies for file access, network access and UI restrictions. It also notes backend-dependent host filtering and cooperative proxy support on Linux and macOS.
Before testing, read the backend's support table and the current policy specification. A flag that is accepted in a schema may not carry the same isolation guarantee everywhere.
The audit-mode trap
The documentation says audit runs a policy in permissive mode: denied operations are logged but allowed to continue. It warns that release-build audit mode does not enforce AppContainer restrictions for the duration of the run.
That is a policy-authoring feature, not a safe mode for hostile execution. A log saying an operation would be denied is different from actually blocking it.
Understand a session lifecycle
The SDK describes provision, start, execute, stop and deprovision operations for session sandboxes. Those names describe setup and cleanup, not proof that cleanup will happen after every failure.
For a test harness, plan timeouts, resource limits, process shutdown and disposal separately. Keep secrets, valuable files and privileged credentials outside the test environment.
A cautious developer evaluation
- Read the current README, licence and policy documentation.
- Choose a disposable environment with no sensitive files or active credentials.
- Check the exact OS version, architecture and backend runtime.
- Use harmless test code to understand the behaviour first.
- Define minimal filesystem and network permissions.
- Test allowed and denied actions independently of the schema.
- Do not enable permissive audit mode while expecting enforcement.
- Inspect logs and verify that child processes and session resources stop.
- Do not move to hostile or production workloads until your own tests justify it.
This guide did not compile MXC, run code, test an escape or verify backend isolation. It is a reading-based preview review.
Free, paid and India verdict
The repository declares MIT licensing. That allows use under the licence terms, but does not pay for your machine, operating system, VM resources or hosted execution.
We did not test installation on an Indian device, organisational approval or a managed cloud environment. This is developer infrastructure, not a ready-made consumer antivirus or a guarantee that an AI agent cannot damage files.
What changed since the original post?
The original README warning about security boundaries could not be found in the current README on 24 October 2026, so we no longer quote it. The audit-mode warning and experimental-backend notes are confirmed. We add backend and runtime differences and a separation between policy intent and verified enforcement.
Frequently asked questions
Is it safe because Microsoft publishes it?
Publishing a project does not prove its isolation. The README says audit mode turns off all sandbox security and some backends are experimental.
Does audit mode block denied actions?
The documented permissive mode logs them but allows them to proceed.
Are all backends equivalent?
No. Read the backend-specific support and requirements.
Was an escape test performed?
No. No code was run for this guide.
Sources: Official MXC repository · Official policy specification. Checked 7 October 2026.
Scoped recheck: MXC README, policy specification. Checked 24 October 2026. The policy page moved from its earlier path; the link now points to the current 1.0.0 policy document.