Intel / article

How will AI change operating systems? Part 2: Windows

Source: newsletter.pragmaticengineer.com
Author: Gergely Orosz
Date: Published Sep 22, 2026

Context

Microsoft's in-development controls put operating-system restrictions around the programs an AI runs. In Gergely Orosz's interview-based report, Microsoft Execution Containers take policies describing permitted file, network, user-interface and execution access, then use existing containment mechanisms to run tools within those boundaries.

The design lets developers choose different levels of isolation according to the operation. Starting a restricted process and starting a virtual machine carry different startup costs and degrees of separation. The report describes technology still under development, but its architectural point is concrete: an agent's ability to act can be constrained through execution policy.

Key takeaways · AI-distilled

Windows Task Manager now distinguishes agent users from human users via Entra ID identity, showing an agent account like 'V9-G4' alongside a human user, with the same observability tools applied to both.
Microsoft Defender is becoming 'agent aware,' scanning for known local agent activity the way it scans for viruses, per the Windows team.
Independent reverse-engineering by Origin Technology found Windows' On-Device Agent Registry (ODR) proxies between clients and servers rather than just brokering discovery, letting Windows inspect agent-tool traffic; Microsoft hasn't confirmed this.
Windows ML, DirectML's successor, is built on the open ONNX format rather than DirectX, so it runs across GPUs, NPUs, and CPUs from any vendor, adding hardware support via downloadable Execution Providers instead of driver updates that took six months to adopt.
A pre-release Surface laptop with NVIDIA GPUs ran a local Qwen model hooked to GitHub Copilot at about 40 per second, in a demo Microsoft's Scott Hanselman showed the publication.

Terms in this piece · Glossary

AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
MCP — The Model Context Protocol — an open standard that lets any AI assistant plug into any tool or data source without custom integration code.
token — The chunk of text a model reads and writes in — roughly three-quarters of a word — and the unit AI usage is billed in.

Read the source newsletter.pragmaticengineer.com