TECHNOLOGY
Microsoft Publishes MXC, an Open Sandbox for Running Untrusted Code on Windows, Linux and macOS
MXC is a Microsoft project on GitHub that lets apps run untrusted code, such as AI model output, plugins and tools, inside isolated containers. It offers several containment backends behind one policy model and SDKs for Rust, .NET and Node.
Image: IntraGoals Media
Microsoft has put a project called MXC on GitHub. It is a sandboxed code execution system, meaning it runs code in a sealed-off space so that code can't freely touch the rest of the computer. It works on Windows, Linux and macOS.
The code MXC is meant for is untrusted code: output from AI models, plugins and tools. A developer builds MXC into their own app as an SDK dependency. The app then tells MXC three things: the container type, the containment rules and the command to run.
MXC checks the request, picks a backend and launches the workload in the resulting container. A backend is the underlying isolation technology. Options range from operating-system process sandboxes to full virtual machines. The project says these sit behind one containment model and typed SDKs.
On Windows 11 (x64 and ARM64), the default backend is processcontainer. Others include windows_sandbox, wslc, microvm, hyperlight and isolation_session. Windows Sandbox, microvm and hyperlight are marked experimental. On Linux (x64 and ARM64), the default is bubblewrap, with lxc, microvm and hyperlight also listed. On macOS, the backend is seatbelt.
Rules are written as JSON, in versioned container-creation requests and security policies. The filesystem policy uses lists of read-only, read-write and denied paths. The network policy covers proxy support, outbound controls and host filtering, which depends on the backend. A UI policy controls clipboard, display and GUI access.
MXC also supports a state-aware lifecycle. A developer can provision, start, execute, stop and deprovision persistent containers. SDKs are available for Rust, .NET and Node, with versioned APIs for one-shot and state-aware runs. The Node and .NET packages include the native runtime. The Rust crate builds the SDK, engine and chosen backends into the app.
The project's Node example builds a request with a command, a network setting that denies outbound traffic by default, and a 30-second timeout. It then calls spawn to run it. Teams that can't embed the SDK can use platform-specific executor binaries such as wxc-exec.exe, which accept JSON requests. The project suggests this route for testing.
The README warns that apps may hit access problems at first, until the containment rules are tuned. A --debug flag prints MXC diagnostic output. An --audit mode helps policy authors find access-denied failures and rebuild a ProcessContainer policy for a trusted tool. On supported Windows releases it records what the workload accessed. The README warns that audit mode turns off all sandbox security, so it should never be used with untrusted code.
On privacy, official Microsoft builds can send optional diagnostic telemetry. It stays off unless the individual run opts in, the Windows user has consented, administrative policy allows it, and the app enables the option. An administrator can block telemetry but cannot give consent for the user. Local open-source builds are not set up to send telemetry to Microsoft, and telemetry does nothing on non-Windows platforms.
Building from source needs Rust pinned to version 1.93, Node.js 24 or later with npm, and the toolchain for the chosen backend.