What changed
Microsoft announced general availability of Execution Containers for Windows 11 on October 7, 2026. This OS feature lets you run AI agents in a sandbox: you declare which files, networks, and credentials an agent can access, and Windows enforces those limits. The agent runs as a separate user with strict permissions. It can't escalate its own access.
Microsoft also opened preorders for Surface Laptop Ultra, powered by Nvidia's RTX Spark chip. The base model starts at $2,599 with 24GB unified memory. Top configuration with 128GB costs $5,899. Ships October 16. The pitch: run AI models with over 120 billion parameters locally, no cloud bill.
What you can do with it this week
If you run Windows 11, Execution Containers are available now via a system update. You can use them to test AI agents—code generators, document processors, customer service bots—without giving them free rein over your files. Declare what the agent needs access to, nothing more. If it only processes invoices, lock it to the invoices folder.
For teams considering the Surface Laptop Ultra or similar RTX Spark devices from Dell, HP, Lenovo, Asus, and MSI (all shipping Oct 16), the case is narrow: you need to run large AI models locally, your data can't leave your premises, and the $2,599+ price fits your budget. For most small teams, the cloud is still cheaper.
What to keep in your own hands
Running AI locally sounds like you own the data, but check the defaults. Which folders can the agent read by default? Does it phone home for updates or logging? When you close the laptop, does the agent stop or keep running in the background? Set explicit permissions before you let the agent touch customer files, financial records, or proprietary documents. And watch the memory: a 24GB machine won't run the biggest models. Confirm the model you want actually fits before you buy the hardware.