Agents are getting an operating system

Facts are attributed and linked to their sources. The analysis and opinions are the author's own.

What it is

At a Windows event in San Francisco on 7 October, NVIDIA reports, Microsoft announced general availability of Microsoft Execution Containers (MXC), OS-level infrastructure that lets agents run safely and persistently in the background under operating-system control. Microsoft's Pavan Davuluri said: "We are building these primitives directly into Windows, so agents can be secured, observed and governed."

The same event launched NVIDIA's RTX Spark for Windows laptops and compact desktops, combining a Blackwell RTX GPU with a Grace CPU, with up to 128GB of unified memory and one petaflop of FP4 AI performance; laptops were due on 16 October. NVIDIA also previewed DGX Station for Windows, with 748GB of coherent memory and up to 20 petaFLOPS of FP4 compute.

A day later Google Cloud announced the Gemini agent, which it calls a universal agent for work. Google says it plans work, uses skills and tools, connects to customers' business systems, chooses the best model for the job, and has built-in cost controls and the security, administration and governance enterprise customers require.

Why it matters

Three of the largest platforms made the same move: the agent stops being an app you visit and becomes a service the platform hosts, schedules and constrains. Microsoft's wording is telling: secured, observed and governed. Those are operations words, not product words.

Secured, observed and governed: those are operations words, not product words. That is the tell.

My essay on many agents argued that capability and risk will live in the orchestration and the checks between components. An OS-level container is exactly such a check. So is a cost control. So is local compute, which changes the data question: a model running on a laptop does not send data to the cloud, but it also sits outside the controls a central team can see.

This is the move I expected, and it is welcome. In most organisations the hard part of deploying an agent is not the model. It is permissions, identity, logging, and the question 'what happens if it runs at 3 a.m. and something goes wrong?'. Putting agents inside an operating-system container, or inside a cloud platform with administration and governance built in, gives those questions a home.

It also changes who is accountable. When agents were demos, the owner was whoever built the demo. When an agent runs persistently on a fleet of laptops or across a company's business systems, it needs the same ownership model as any production service: a named owner, an on-call path, a change log, and a way to turn it off quickly.

The local-compute angle deserves more thought than it usually gets. A capable model on a laptop is good for privacy, latency and cost. It is also a model the central risk team may not know exists. The answer is not to ban it, but to make registration easy and invisible operation hard.

What I'd watch

• Logs that a risk team can read. 'Observed' only helps if the observation is in a form an auditor can use.
• Local agents in regulated firms. Powerful on-device models are a privacy gain and a shadow-IT risk at the same time.
• Whether 'chooses the best model for the job' comes with a record of which model made which decision.

Sources

1. NVIDIA, Microsoft Kick Off a New Beginning for Windows PCs With RTX Spark and AI Agents. NVIDIA Blog, 7 Oct 2026.
2. Google Cloud launches Gemini agent. Google (blog.google), 8 Oct 2026.