Microsoft’s Build 2026 keynote barely mentioned how smart its AI models are. Instead, the company spent its biggest developer event of the year on containers, identity systems and governance plumbing, betting that whoever owns the environment agents run in will matter more than whoever owns the model powering them.
That omission was the strategy. But the pitch arrives with a complication the keynote never addressed: Amazon, Google, Salesforce and ServiceNow had already shipped comparable agent platforms months before Microsoft took the stage in San Francisco, and Microsoft’s own adoption numbers show its unmatched distribution inside enterprises is not translating into agents workers actually choose to use.
Microsoft Puts Agents Inside a New Windows Container
On June 2, 2026, Microsoft unveiled Microsoft Execution Containers at Build 2026, a policy-driven execution layer built directly into Windows and the Windows Subsystem for Linux. Developers and IT teams can now declare exactly what an agent is allowed to touch, files, networks, specific applications, and the Windows kernel enforces those boundaries while the agent runs rather than trusting the agent’s own code to behave.
The design responds to a real problem. Autonomous agents that can read files, execute code and chain multi-step tasks have outpaced the security frameworks meant to contain them. The original Tirias Research analysis of Build 2026 points to OpenClaw’s early release as the case study: without operating-system-level limits, its agents overreached in ways that alarmed enterprise security teams.
MXC is meant to close that gap using a lighter-weight, hypervisor-backed isolation layer than a traditional container, with near-native startup times built for agent workloads. OpenClaw itself now runs inside MXC boundaries on Windows, and NVIDIA’s OpenShell secure runtime uses the same containers while layering in its own policy management and PII obfuscation.
- MXC (Microsoft Execution Containers) – a declarative, OS-enforced boundary system for AI agents, shipping first in preview on Windows 11 version 24H2 Enterprise and Pro editions, with Windows Server 2027 to follow.
Windows has taken security black eyes before that complicate the “most trusted platform” pitch. Microsoft only recently closed a Secure Boot shim flaw that sat open for 13 years, a reminder that OS-level trust claims carry a long history to live up to.
Four Rivals Already Built the Same Layer
The part of the Build 2026 story that got the least attention outside the keynote hall is timing. Microsoft was not first. It may not even be second.
Amazon Bedrock AgentCore went generally available in October 2025, months ahead of Build, and its software development kit had already logged more than 1 million downloads by the time Microsoft announced MXC. Google folded its Agentspace product into a rebranded Gemini Enterprise around the same stretch, giving customers access to more than 200 models including rival labs like Anthropic. Salesforce shipped Agentforce 360, its fourth version of Agentforce inside twelve months. ServiceNow built its own AI Control Tower for governing agents across a business.
| Company | Agent Platform | Signature Move | Status |
|---|---|---|---|
| Microsoft | Agent 365 / MXC / Azure AI Foundry | OS-level execution containers built into Windows itself | Preview, announced June 2026 |
| Amazon | Bedrock AgentCore | Framework-agnostic runtime with Cedar-based policy engine | Generally available since October 2025 |
| Gemini Enterprise | Absorbed Agentspace, bundled access to 200-plus models | Replaced Agentspace in late 2025 | |
| Salesforce | Agentforce 360 | Fourth Agentforce release in 12 months, per-resolution pricing | Generally available |
| ServiceNow | AI Control Tower | Tokenized pricing tied to governance-centric orchestration | Live |
Every pitch uses nearly identical language: build, deploy and govern agents at scale. The implementations differ, but the ambition does not. Each company wants to be the layer enterprises cannot easily rip out.
Does Microsoft’s Distribution Edge Actually Convert?
Microsoft’s real advantage is not technical. Millions of companies already pay for Windows, Microsoft 365, Azure and Entra, so Copilot enters as an add-on to an existing bill rather than a new vendor to vet. That edge shows up in seat counts, but it fades once employees get an actual choice of tools.
Microsoft told investors on April 29, 2026, that paid Microsoft 365 Copilot seats had grown to 20 million, up from 15 million just three months earlier, the fastest quarterly seat growth the company has reported since launch. GitHub Copilot separately reached 4.7 million paid subscribers, up roughly 75% year over year. Microsoft’s overall AI business run rate surpassed $37 billion in its third fiscal quarter of 2026, up 123% year over year, and Azure grew 40% in the same period.
- 20 million paid Microsoft 365 Copilot seats disclosed April 29, 2026, up from 15 million the prior quarter.
- $37 billion Microsoft AI business annual run rate in fiscal Q3 2026, up 123% year over year.
- $190 billion in AI infrastructure capital spending Microsoft has guided to for calendar 2026.
But bundling is not the same as being chosen. When employees at companies that also license ChatGPT or Gemini have a free pick of tools, Copilot’s active usage share drops to roughly 8%. When Copilot is the only assistant an employer makes available, adoption jumps to 68%. The gap between those two numbers is the entire distribution argument in miniature: Microsoft wins by default, not by preference, and Build 2026 is a bet that owning the execution layer matters more than owning that preference.
If Microsoft is correct, the future AI battle will not be fought primarily over models. It will be fought over the agent stack.
Kevin Hein, a senior analyst at Tirias Research who covers the AI and semiconductor ecosystem, made that argument after attending Build 2026 virtually. His firm’s read is that agent identity, memory and governance, not benchmark scores, decide who wins the next decade of enterprise computing.
Gartner Doubts Half of These Bets Survive to 2028
Not every agent platform gets to a second act. Gartner forecasts that over 40% of agentic AI projects will be canceled by the end of 2027, citing rising costs, unclear returns and weak risk controls.
Anushree Verma, a senior director analyst at Gartner, described most current deployments as “early stage experiments or proof of concepts that are mostly driven by hype and are often misapplied.” Gartner also flags widespread “agent washing,” where vendors rebrand old chatbots and robotic process automation tools as agentic AI without the underlying autonomy to back it up.
That caution cuts two ways for Microsoft. A shakeout would thin the field of platforms competing for the same enterprise budget, which favors whichever vendor enterprises already trust with their existing systems. It would also validate the Gartner view that most of the agentic AI market being built right now, including pieces of Microsoft’s own stack, is still unproven at production scale.
Who Becomes a Tool Instead of a Destination
The Build 2026 keynote’s most consequential idea was that applications are becoming tools agents call rather than destinations humans open. Taken seriously, that idea threatens far more than Microsoft’s rivals in cloud infrastructure. It threatens the entire software layer sitting on top of it.
If an agent inside Copilot or Agentforce can complete a workflow by calling five different tools instead of a person clicking through five different apps, the competitive value of any single app’s interface starts to erode. That is precisely why the companies most exposed are not staying quiet.
- Databricks rolled out Agent Bricks and a broader Custom Agents stack rather than ceding orchestration to a cloud partner.
- Palantir is leaning on ontology-driven operations, a structurally different bet than a generic agent runtime.
- UiPath and Boomi are both positioning themselves as the management layer for agents built on someone else’s infrastructure.
- Nvidia shipped its own containment tools, OpenShell and NemoClaw, at its most recent GTC rather than leaving agent security entirely to Microsoft.
None of these companies want to become a tool invoked by somebody else’s agent. Each is trying to make sure its own product is the thing doing the calling. Microsoft’s asset list for this fight, Windows, Azure, Entra, GitHub, Teams, SharePoint and Microsoft 365, is genuinely wide. It is also not the only wide asset list in the room. Alphabet’s own AI stock case rests on a similar argument about Search, Android, Chrome and Google Cloud all reinforcing each other.
The Agent Stack War Has No Declared Winner Yet
Microsoft is not short on capital to fight this out. The company has guided to roughly $190 billion in AI infrastructure spending for calendar 2026, and it recently began deploying AMD’s newest Helios server racks inside Azure to widen its compute options beyond Nvidia alone.
What Build 2026 actually proved is narrower than the keynote implied. Microsoft has a coherent, well-funded plan to make Windows, Azure and Microsoft 365 the place agents live. It does not yet have the field to itself, and its own usage data shows employees given a real choice do not automatically pick Copilot. The agent stack war has several credible entrants, and none of them, including Microsoft, has won it yet.
Frequently Asked Questions
What is Microsoft Execution Containers, or MXC?
MXC is a policy-driven execution layer built into Windows and WSL that lets IT teams declare what an agent can access, with the Windows kernel enforcing those limits at runtime. It ships first in preview on Windows 11 version 24H2 Enterprise and Pro editions, needs a CPU with virtualization-based security and second-level address translation, and integrates with Microsoft’s Agent 365 governance product, bringing Defender, Entra, Intune and Purview protections to locally running agents starting in preview in July 2026.
Is Microsoft Copilot losing market share to ChatGPT and Gemini?
Among paid AI subscribers tracked by Recon Analytics, Copilot’s share fell from 18.8% in July 2025 to 11.5% by January 2026, a roughly 39% contraction, with Gemini passing Copilot in November 2025. Microsoft’s seat growth inside its own bundled Microsoft 365 base has stayed strong even as that independent, freely-chosen share has slipped.
What do AWS and Google offer instead of MXC?
Amazon’s Bedrock AgentCore uses a Cedar-based policy language and gives each agent its own isolated session with execution windows lasting up to eight hours, built for teams that want to bring their own framework rather than adopt Microsoft’s. Google’s Gemini Enterprise, the rebuilt successor to Agentspace, bundles access to more than 200 models, including third-party options like Anthropic’s Claude, inside one managed platform.
How many AI agent vendors does Gartner consider legitimate?
Gartner estimates only about 130 vendors, out of thousands claiming agentic AI capabilities, offer genuine autonomous functionality rather than rebranded chatbots or automation tools. The firm still expects the technology to mature, projecting that by 2028 roughly 15% of routine work decisions will involve agentic AI and a third of enterprise software will embed agentic features.
