Microsoft builds a Rust sandbox for containing AI agents

Microsoft started building mxc, a Rust sandbox for containing AI agents, on February 6. Most harnesses that hand a coding agent shell access run it inside its own Docker container. mxc is Microsoft's attempt at a first-party alternative to that pattern, built for teams that don't want a container fleet just for isolation. How well that isolation holds matters for anyone letting an agent run shell commands unsupervised.

It describes itself in one line, "policy-driven, layered isolation and containment," with no launch post and no product page behind it. The repo carries 88 open issues against just 30 open pull requests, an unusually issue-heavy ratio for a project with no marketing behind it.

A first-party Microsoft repo doesn't typically draw that many open issues from people who starred it once and moved on. It points to teams already running mxc against real agent setups and filing bugs faster than Microsoft is closing them out.