Enterprises are racing to lock down AI agents that run on Windows desktops. On June 1, 2026, Microsoft and NVIDIA announced a set of low‑level security and containment features designed to treat AI agents as first‑class operating‑system entities. The move aims to prevent rogue agents—nicknamed “OpenClaw” in internal briefings—from escaping their sandbox and affecting critical workloads. In this post we unpack what “agent‑native security primitives” could mean for developers, explore concrete scenarios, and outline how you can start preparing your applications for the upcoming Windows changes.

---

Why Windows Needs Agent‑Specific Protection

The rise of autonomous agents

Modern AI agents are no longer just chat‑bots. They can browse files, invoke system APIs, and even orchestrate other processes. When such capabilities are exposed on a workstation, a compromised or malicious agent can act like a privileged user, making traditional file‑based or user‑account permissions insufficient.

The OpenClaw analogy

In recent internal threat‑modeling exercises, security teams referenced a hypothetical “OpenClaw” agent that could:

1. Read sensitive configuration files (e.g., Kubernetes kubeconfig, Azure CLI tokens).
2. Spawn child processes with elevated rights.
3. Persist across reboots by registering services.

OpenClaw illustrates a worst‑case where an agent bypasses user‑level isolation and directly manipulates the OS. The new primitives aim to stop exactly that.

---

What Are “Agent‑Native Security Primitives”?

While Microsoft’s official blog only hinted at “new Windows security and containment primitives,” NVIDIA’s reveal during the RTX Spark launch gave a few clues:

Primitive	Likely Functionality
Agent Isolation Containers (AIC)	Lightweight containers that run at the same privilege level as the OS kernel but enforce strict syscall filtering for agents.
Secure Agent Tokens (SAT)	Cryptographically bound tokens issued to an agent at launch, ensuring that only authorized code can request privileged resources.
Policy‑Driven Execution Guard (PDEG)	A policy engine that evaluates each agent action (file access, network call, registry write) against a declarative security manifest supplied by the developer.
Hardware‑Assisted Attestation (HAA)	Leverages NVIDIA’s RTX Spark secure enclave to attest that an agent’s binaries have not been tampered with before execution.

These building blocks resemble the sandboxing model used for UWP apps, but they are purpose‑built for AI agents that need frequent, low‑latency access to system resources.

---

Practical Implications for Developers

1. Define an Agent Security Manifest

When you package an AI agent for Windows, you’ll now provide a JSON manifest, e.g.:

The OS will enforce these rules at runtime. Any attempt to read outside the declared paths will raise a SecurityPolicyViolation error, which you can catch and log.

2. Obtain a Secure Agent Token

Before launching the agent, call the new Windows API CreateSecureAgentToken:

The token ties the process to the manifest and ensures that the OS can track the agent’s actions.

3. Leverage RTX Spark for Attestation

If your solution runs on a machine equipped with NVIDIA’s RTX Spark, you can request a hardware attestation via the NvidiaAttestAgent library. The attestation blob proves to a remote server that the agent binary matches the signed hash stored in the manifest, mitigating supply‑chain attacks.

---

Migration Path for Existing Agents

1. Audit current permissions – Identify which files, registry keys, and network endpoints your agent already accesses.
2. Create a minimal manifest – Start with the exact list from step 1, then tighten it over time.
3. Test in an Agent Isolation Container – Windows will provide a developer‑preview container runtime (aic.exe) to simulate the production environment.
4. Gradually adopt Secure Agent Tokens – Existing installers can be updated to request a token only when a user opts into the new security model.
5. Monitor policy violations – Use the Windows Event Log channel Microsoft-Windows-AgentSecurity/Operational to collect telemetry.

---

Sample Workflow: Deploying a Secure Copilot

1. Build the agent binary and sign it with your code‑signing certificate.
2. Generate the manifest (copilot.manifest.json).
3. Package with an installer that runs:
   powershell
4. Enable RTX Spark attestation (optional):
   cpp
5. Deploy via Group Policy or Microsoft Endpoint Manager, ensuring that the target machines run Windows 11 23H2 or later (the version that will ship the primitives).

---

Key Takeaways

• Agent‑native primitives will give Windows the ability to sandbox AI agents at the OS level, closing gaps left by traditional user‑account security.
• Developers must author a security manifest that declares every resource the agent needs, enabling fine‑grained policy enforcement.
• Secure Agent Tokens bind the agent process to its manifest, making it impossible for a malicious actor to elevate the agent without detection.
• RTX Spark hardware attestation provides cryptographic proof of binary integrity, crucial for supply‑chain security.
• Migration is incremental: start with a permissive manifest, then tighten rules while using the new developer‑preview container tools.

---

Looking Ahead

Microsoft and NVIDIA plan to ship the primitives as part of the Windows 11 23H2 update, with a developer preview expected later this year. As the ecosystem adopts these features, we can anticipate a shift toward “agent‑first” design patterns—much like we did with mobile apps a decade ago. Preparing your AI workloads now will not only improve security but also future‑proof them for the next generation of intelligent operating systems.

---

Source: NVIDIA, MS tease tighter agent-native security primitives in Windows