Microsoft and Nvidia Move Windows Toward a Local Runtime for AI Agents

What ships on the hardware side

RTX Spark systems are designed to bring larger local AI workloads to Windows laptops and small desktops. Nvidia said the platform combines an Nvidia Blackwell RTX GPU with up to 6,144 cores and an up to 20-core Nvidia Grace CPU, connected at 600 GB/s.¹ The company said RTX Spark can deliver up to one petaflop of FP4 AI performance and up to 128 GB of unified memory, allowing some large models to run without sending data to the cloud.¹

Microsoft’s Surface Laptop Ultra uses the same RTX Spark foundation. Microsoft said the device supports up to 128 GB of unified memory, up to one petaflop of AI performance and local models exceeding 120 billion parameters.⁴ Surface Laptop Ultra starts at $2,599, with availability beginning October 16. The Surface RTX Spark Dev Box is listed at $5,999 and is scheduled to begin shipping to U.S. customers in November.⁴

The broader RTX Spark PC lineup includes systems from ASUS, Dell, HP, Lenovo, MSI and Microsoft Surface. Microsoft said those laptops are available for preorder and begin shipping October 16.³ Tom’s Hardware also reported that Surface Laptop Ultra, Surface RTX Spark Dev Box and partner RTX Spark systems were available for preorder, with laptops from several manufacturers shipping October 16.⁷

Microsoft is also previewing a higher-end tier: DGX Station for Windows. Nvidia said the deskside system uses the GB300 Grace Blackwell Ultra Desktop Superchip, with 748 GB of coherent memory and up to 20 petaFLOPS of FP4 AI compute, enough to run models at up to trillion-parameter scale locally.¹

That product is not the mainstream laptop story, but it shows the direction of travel: Windows desktops are being positioned as local AI infrastructure for developers, researchers and enterprises.

What ships on the software side

The central Windows change is Microsoft Execution Containers, or MXC. Microsoft describes MXC as a policy-driven execution layer for untrusted code or dynamically generated workloads. In agent scenarios, developers can use it to contain model-generated output, plug-ins, tools, the agent harness or the full agent workload.²

MXC is now generally available and is meant to define what an agent can access at runtime, including files, network destinations, tools and user-interface resources.² The policy is kept outside the agent workload’s control, so the model or generated code cannot expand its own permissions.²

Microsoft presents this as a necessary boundary for agents because they can operate differently from traditional applications. They may run continuously, use tools, write code, read and modify files, and act across systems without a user watching each step.³ Microsoft’s argument is that an agent should not inherit the full authority of the signed-in user simply because it is acting on that user’s behalf.²

MXC supports multiple containment levels. Process containers provide lighter-weight sandboxing across Windows 11, macOS and Linux. Windows-only session containers run an agent in a separate operating-system-isolated session, with its own local agent identity and isolated desktop, clipboard, user interface and input boundaries. Windows Subsystem for Linux containers support Linux-first toolchains on Windows, while experimental microVMs provide stronger hardware-backed isolation for higher-risk workloads.²

For developers, the immediate integration model is a JSON configuration schema and SDK that declares workload requirements. Microsoft says MXC then maps those requirements to the appropriate containment backend.²

For IT teams, the important distinction is that organizational policy can further constrain what developers request. Microsoft said Intune policy support for MXC process containers on Windows 11 is coming, allowing administrators to control how container creation requests are evaluated and what resource boundaries are enforced.²

Persistent agents, local context and routing

Microsoft’s Windows strategy relies on more than faster local inference. The company is designing for agents that can keep working in the background and combine local context, local models and cloud models.

In its Windows strategy post, Microsoft said Copilot will gain local context, local actions and local models on Copilot+ PCs, with user permission. The company said its Autopilot experience is intended to become a persistent, proactive and personal agent that can continue working while the user focuses elsewhere.³

Those Copilot hybrid intelligence features are expected to begin rolling out on Copilot+ PCs in the coming months, meaning not every capability announced with the strategy is available immediately.³

The same local-plus-cloud approach is expected to affect developer workflows. Microsoft said GitHub HydraFusion will be extended to Windows so GitHub Copilot can route work to local models when appropriate and to cloud models when needed, with an experimental preview later in October.³ Axios reported that Microsoft’s pitch is partly economic: developers want more intelligence than cloud budgets can comfortably support, so the company is emphasizing a hybrid model that uses local compute where it can be effective.⁵

Security model: containment first, identity next

Microsoft’s security model has three stated pillars: containment, identity and manageability.²³ MXC provides the containment layer available now. It can govern file-system access, network connectivity, process settings and whether a workload can interact with the desktop.²

The identity layer is partly still ahead. Microsoft said Windows will soon enable Microsoft Entra to distinguish agent activity from user activity in Microsoft Agent 365.² The goal is attribution: security teams should be able to determine which agent took an action and apply controls to that agent without necessarily blocking the human employee’s access.²

Manageability is also being tied to Agent 365 and Intune. Microsoft said Agent 365 controls will extend to local on-device agents, letting IT manage MXC containers, apply policies and monitor agent activity.² HotHardware reported that Microsoft positioned Agent 365 as an enterprise control plane for discovering, monitoring and governing agents across Windows and cloud environments, with integrations involving Entra, Defender and Purview.⁶

MXC also includes operational modes intended to help organizations build least-privilege policies. Enforcement mode blocks ungranted access. Learning mode blocks and records denied activity. Permissive mode allows activity while recording what policy would have denied, helping developers and administrators observe what resources an agent tries to use before tightening controls.²

Why it matters for enterprises

The announcement does not eliminate the need for cloud AI. Microsoft’s own framing is hybrid: local models for responsiveness, cost control and data locality; cloud models for tasks that need broader or more powerful capability.³

But the center of gravity changes if Windows PCs can host local models with more than 120 billion parameters, keep agents running in isolated sessions, and route work between local and cloud models under policy control.³⁴

For developers, the near-term question is whether MXC becomes a standard packaging and execution target for Windows agents, especially coding agents and tool-using assistants. Microsoft said GitHub Copilot, OpenAI Codex, Replit, LM Studio and other agents or frameworks already support MXC, with more support planned.²

For security teams, the question is whether Microsoft’s controls are strong and observable enough for real enterprise deployment. The company is drawing a line between the user and the agent, and between the agent’s objective and its authority. If implemented consistently, that separation could reduce the risk of local agents overreaching into files, networks or credentials they do not need.

That is the bigger shift behind the device launch. RTX Spark gives Windows PCs more local model capacity. MXC gives agents a place to run under operating-system control. Together, Microsoft and Nvidia are trying to make Windows a managed local runtime for AI agents, not just a client that sends prompts to the cloud.