Computers rarely continued working after people left. When you closed your laptop for a meal, documents paused where the cursor blinked; emails remained in drafts. But in the future envisioned by AI agents, computers will no longer wait quietly for their owners. They can look up information, fill out forms, write reports, and even book dinner reservations while you're in meetings. By the time you return to your screen, work has already advanced several steps. This sounds wonderful, but the problems begin right there. If the AI opens the wrong file, sends an unpublished plan to the wrong person, or deletes a file it deemed "duplicate" that you can never recover, whose operation counts?
When an AI can read the hard drive, access the browser, email, and enterprise systems, what makes us trust it will only do the one thing it was told?
Microsoft's recent answer is intriguing. Before letting AI truly enter Windows, it first built an isolation room for these agents. Over the past two years, people have grown accustomed to chatting with AI on their computers. It answers questions, rewrites copy, summarizes web pages, but in most cases its capabilities remain within relatively safe boundaries. You paste content to it, it processes that content; you don't hit send, it usually does nothing. Even when errors occur, the most common consequence is just an unreliable passage of text on screen.
Agents change that boundary. They no longer just wait for humans to deliver materials; they seek out materials, invoke tools, and complete operations themselves.
Microsoft launches AI execution containers to strengthen security
To organize an expense report for you, it might need to open your email to download invoices, recognize amounts in images, then log into the company finance system to submit; to complete a coding task, it not only writes code but reads project files, runs commands, installs dependencies, even searches the internet for documentation. The more AI resembles a real assistant, the closer its required permissions come to those of a real person sitting at the computer. The old computer permission model wasn't designed for this. Photo editors need photos, video conferencing needs microphones — users at least roughly know what they've allowed.
But agents face not a fixed function but a series of ad-hoc actions. Today it reads the downloads folder to make a spreadsheet; tomorrow it touches the entire hard drive to "help clean your computer."
A simple "allow access" hardly explains how long authorization lasts, how much can be done, or where data goes. This is why AI safety is shifting from "will it hallucinate" to "will it act recklessly." A chatbot answers a question wrong, and the user still has a chance to catch the problem before acting; once an agent turns answers directly into operations, errors can leap off the screen onto real files, accounts, and funds. Giving AI the ability to act while retaining the old logic of one-time, long-lived permissions is like handing a temp assistant your house keys and only saying "don't mess around."
On October 7, Microsoft officially launched Microsoft Execution Containers — execution containers for AI agents. The name sounds technical, but the problem it solves isn't hard to understand.
Instead of letting an agent roam freely across the entire computer, you first bring it into a separate studio, placing only the files, tools, and network access needed for the task. It can write code, run programs, and process data in that room, but it can't, on a vague instruction, reach over and pull open every drawer next door. Microsoft divides this mechanism into three parts. Isolation limits the data and system resources the agent can touch; identity distinguishes whether an operation comes from the user or the AI working on their behalf; management lets enterprises set rules, monitor risks, and revoke permissions.
The real key isn't "locking it up," but making AI actions identifiable, traceable, and revocable.
Identity is especially critical. When humans and AI share the same account and permissions, accountability quickly blurs. Was that email sent by the user personally, or by the AI acting on an overly broad instruction? Did the program crash accidentally, or did the agent terminate it deliberately? If the system can't tell the difference, even perfect logs struggle to answer the most basic questions. Giving AI its own identity is like issuing a temp worker a time-limited access badge. It still acts on your behalf, but doesn't need your full powers; when the task ends, the badge expires, and if risk appears, it can be frozen independently.
This mechanism isn't as flashy as generating images or auto-writing code, but it decides whether AI stays on the demo stage or earns entry into the computers that actually hold work and life. Microsoft isn't the only company starting to install this lock. Previously, Apple also said it would add more explicit controls for high-sensitivity permissions like full disk access, for the same reason: AI agents may access emails, messages, browsing history, and vast amounts of private files. The two companies chose different technical paths, but the direction is already closely aligned. Operating systems can no longer treat AI as just another app, because it can both invoke apps and span multiple apps to complete a task.
Past permission management asked "can this app access photos?"; future permission management must keep asking "why is it accessing, what can it access, is this allowed just once or forever?"
Arriving alongside execution containers is a computer that illustrates the point well. The Surface Laptop Ultra maxes out at 128GB of unified memory, officially capable of running models with over 120 billion parameters locally. Tasks that once had to live in the cloud are starting to stay on personal computers. For privacy-conscious users, this seems the most intuitive answer: data doesn't leave the device, so it's naturally more secure. But "local" solves the problem of data leaving the device; it doesn't automatically solve what AI can touch inside the device.
A fully offline agent that can read the entire hard drive and run arbitrary commands can still accidentally delete files or extract information from directories it shouldn't enter. Moving the model from server to computer merely shortens the distance data travels; what truly determines the security boundary remains permissions, isolation, and operation logs.
Local AI also brings another easily overlooked cost: price. The Surface Laptop Ultra ranges from US$2,599 (approx. HK$20,272) to US$5,899 (approx. HK$46,012); high-memory versions are clearly not mass-market products. Nvidia's DGX Spark, aimed at local AI development, also raised its price to US$6,950 (approx. HK$54,210) due to rising memory costs. The larger the model, the more memory and bandwidth it needs, so "keeping data in your own hands" is becoming an expensive hardware configuration rather than a capability everyone can afford.
This could create a slightly awkward situation. Those who can afford high-performance computers can keep more sensitive tasks local; ordinary users continue relying on cloud models, trading convenience for platform privacy policies. Local AI isn't just a performance distinction — it may become a new privacy price gap. If truly usable local models only exist on devices costing thousands of dollars, that sense of security remains a commodity only a few can afford.
Local and cloud aren't mutually exclusive. Microsoft advocates a hybrid mode: simple tasks stay on device, complex tasks go to the cloud. It's more realistic, but makes boundaries more complex: users need to know not just which files AI read, but which parts were sent to the server, and what operations the returned results triggered. Future trustworthy AI computers can't just print "on-device processing" on the box; they must explain the full data path.
One isolation room isn't enough. Execution containers are a good start, but they don't automatically make all AI operations safe. Isolation shrinks the blast radius of accidents, but can't judge for the user whether the task itself is reasonable. An agent allowed only into a designated folder could still send the wrong version of a file; even if it can't read credit card passwords, it could place a wrong order on an already-logged-in shopping site. Security isn't just drawing a line for AI; it's letting people see which line it's about to cross.
Consumer AI truly needs an authorization system finer than "allow" or "deny." Users should grant task-level permissions, not permanently green-light entire apps; irreversible operations like payments, deletions, and public posts need pre-execution confirmation; systems should also leave logs ordinary people can understand, showing what AI opened, modified, and sent. Once a task deviates from expectations, there must be a direct stop button and the most complete possible undo capability. These designs will make AI seem less fluid than in demo videos. The launch-event spectacle of "say one sentence, hundreds of coffees already ordered" is impressive, but a truly reassuring product might have to pause before the two-hundredth coffee is paid for, telling you the quantity, delivery address, and total amount.
An extra confirmation may seem to reduce efficiency, but it preserves the fact that humans remain the final decision-makers. Autonomous driving needs brakes, dashboards, and accident logs; AI that can operate computers for people needs the same.
Truly mature automation doesn't remove humans from the process entirely; it brings them back at the moment consequences must be borne. Since the birth of the personal computer, the most stable rule has been waiting for human commands. Mouse still, keyboard silent, the machine just sits there. Agents are rewriting that rule. Future computers will act continuously while we sleep, meet, and commute — they won't just store our lives, they'll intervene in them. When that time comes, a computer's most important capability may not be how fast the model runs, but whether it can give actions boundaries, give permissions reasons, and give errors a chance to be stopped.
This isolation room Windows built for AI is therefore not just a developer-facing technical update. It reminds everyone that the mark of AI truly entering daily life isn't that it learned another new skill, but that the operating system finally started taking it seriously as a threat. Because only when a computer knows when to say "no" to AI can users confidently hand over more tasks. We keep discussing what things we'll still need to do ourselves in the future. Perhaps the answer isn't continuing to click every button ourselves, but retaining the power to decide which buttons can be pressed for us.
AI can live in the computer and keep working after people leave, but that room should have a door, a lock, and a switch that always stays in human hands.
Item Specifications Processor Surface Laptop Ultra maxes out at 128GB unified memory Price From US$2,599 (approx. HK$20,272) to US$5,899 (approx. HK$46,012)