Windows bets on "hybrid intelligence": local and cloud AI agents, with beefed-up security

Microsoft has unveiled a sweeping update for Windows centered on what it calls "hybrid intelligence": a model in which AI agents can run locally on the PC when it makes sense to do so, or turn to the cloud when they need to, all under a security and management framework designed specifically for how agents operate (as opposed to traditional applications). The announcement, signed by Pavan Davuluri, executive vice president of Windows + Devices, and published on October 7, 2026, combines platform changes, new AI models optimized to run locally and a wave of new hardware, from mini PCs to desktop supercomputers.

The underlying argument is that agents —unlike conventional software— can run continuously, use tools, write code, access files and act across multiple systems without constant human supervision. That demands, according to Microsoft, a new security model built on three pillars: containment (what an agent can touch), identity (who or which specific agent acted) and management (how that activity plugs into corporate policy and oversight tools). The centerpiece of containment is Microsoft Execution Containers (MXC), which today reach general availability on Windows 11. MXC lets organizations define which files and which networks an agent can touch, with those policies enforced in real time during execution, something traditional sandboxes were not designed to handle because containment needs change with every instruction or tool call. For individual users, these safeguards are part of the agent experience itself. MXC works across several operating systems, but on Windows it integrates more deeply, offering everything from process and session isolation to WSLc, virtual machines and Windows 365 for Agents, and it connects with Microsoft Agent 365 and Intune so companies can set policies, monitor risks and govern agents at scale.

The list of agents that already support MXC includes OpenAI's Codex, GitHub Copilot, OpenClaw, Replit, LM Studio, NVIDIA's OpenShell and Unsloth AI. Microsoft says many others will add support soon: Anthropic's Claude Code, Box, Egnyte, Heidi Health, Hermes Agent (from Nous Research), Manus, Perplexity, Raycast and Simular, among others. As an additional new feature, Muse for Windows —a personal AI agent from Meta— will arrive soon as a native Windows application with MXC integration, broadening the range of agents officially available on the system.

On the models that run on the device itself, Microsoft returns to MAI Code 1.1 Flash, introduced at its Build conference, a model with 137 billion total parameters (6.8 billion active) designed for real programming tasks. It is now bringing it to the PC itself using 3-bit precision, which cuts the model's size by nearly 80% while maintaining code quality and supporting a local context window of 256,000 tokens. Other models join it: an upcoming NVIDIA Nemotron model with more than 70 billion parameters, quantized to 2 bits to take up little more than 20 GB of memory, and DeepSeek V4 Flash, with 284 billion parameters, optimized to run with speed and intelligence on devices equipped with RTX Spark. The stated goal is to bring capabilities until now considered frontier-level to local PCs without exhausting memory or system resources, leaving room for the user's other tasks.

To decide when to process locally and when in the cloud, Microsoft relies on GitHub HydraFusion, the intelligent routing system GitHub launched this year to send each task to the right model in the cloud. That intelligence now extends to Windows so HydraFusion can also take advantage of models running on the device itself, making tokens (and therefore the AI budget) go further. This hybrid intelligence capability will arrive in experimental preview in the GitHub Copilot app, the GitHub Copilot CLI and Visual Studio Code later in October. In parallel, Microsoft is announcing llama.cpp support in Windows ML, its scalable runtime for deploying models on GPU, NPU and CPU, which broadens the catalog of available open-source models and makes it easier to experiment quickly with new ones as they appear.

All of this translates into concrete changes for Copilot on Windows, which was recently reorganized into three experiences: Home, Code and Autopilot. On Copilot+ PCs, Copilot will start drawing on hybrid intelligence through three capabilities: local context (with the user's permission, it can understand files and recent activity on the machine), local actions (it can carry out tasks such as organizing files, diagnosing the device, troubleshooting, scheduling or completing workflows directly on the PC) and local models (it can use AI running on the machine itself, combining it with the cloud when needed). In Home, this makes it possible to turn files already being worked on into collaboration-ready materials; in Code, it helps build native Windows applications from a single prompt, run code more safely thanks to MXC and use local models to speed up projects and control token spending; and in Autopilot —described as a persistent, proactive personal agent— it brings local context, local models and the ability to act so the agent keeps working on the user's behalf while they do something else. Microsoft says these hybrid-intelligence-powered Copilot features will begin rolling out over the coming months on Copilot+ PCs.

On hardware, the company is rolling out a full lineup aimed at different agent work profiles. For desktop mini PCs, already used as always-on machines for long-running agents, Microsoft promises simplified setup in a few clicks from first boot, versus the current terminal-based process; for OpenClaw users it is introducing a native Windows gateway with MXC integration to keep agents safely contained, with the intention of extending this experience to more devices over time. Copilot+ PCs remain the lineup designed for everyday use: according to the company, collectively they run more than two trillion local inferences per month, improving features such as search, image processing and video calls, and today more than 40% of laptops built for businesses fall into this category.

A step above are "Builder PCs," aimed at developers, creators and makers who need high-performance local compute, unified memory and optimized AI experiences. This category kicked off in June with the joint Microsoft and NVIDIA introduction of the RTX Spark, and it now expands with a family of machines already available for pre-order: the Surface Laptop Ultra (the most powerful Surface to date, with up to 128 GB of unified memory and the ability to run models of more than 120 billion parameters locally, with a 15-inch touchscreen and a new thermal architecture), the Surface RTX Spark Dev Box, and equivalent machines from ASUS (ProArt P16 and P14), Dell (XPS 16 Creator Edition), HP (OmniBook Ultra 16), Lenovo (Yoga 9n 2-in-1) and MSI (Prestige N16 Flip AI+). All of these RTX Spark machines begin shipping on October 16, except the Surface RTX Spark Dev Box, which will reach U.S. customers in November; RTX Spark-based mini PCs and dev boxes will arrive later this year. Microsoft is presenting performance comparisons against a 16-inch MacBook Pro with Apple's M5 Pro chip: up to 2.1 times faster in time to first token, 4.3 times faster in AI image generation and 6.2 times faster in AI video generation, figures attributed directly to the company and pending independent validation.

At the top of the lineup are the "AI supercomputers" based on NVIDIA DGX Station, which will come to Windows later this year using the NVIDIA GB300 Grace Blackwell Ultra desktop superchip. According to the announcement, these machines combine data-center performance with enterprise-grade security and management, making it possible to run frontier models of more than a trillion parameters locally, such as Llama 4 Maverick, Kimi K2.6 or DeepSeek V4 Pro: capabilities that previously required renting a cloud cluster. Microsoft proposes two concrete uses: as a "personal AI supercomputer" for highly demanding engineering, science and research workloads, and as a scalable "token factory" capable of serving 32 or more agents simultaneously for teams of developers, engineers or researchers, thereby cutting cloud token consumption and keeping sensitive data inside the organization's environment, managed with the same tools they already use for the rest of their Windows fleet. The first machines of this kind will be the Dell Pro Precision with GB300 and the HP ZGX Fury AI Station, both expected later this year, with other OEM partners to follow.

Beyond the big announcements on agents and hardware, Windows is also adding everyday improvements. Windows Search in the taskbar debuts thousands of "actions" that make it possible to go from "finding" to "doing" without opening another application: turning on dark mode, "Do Not Disturb" or airplane mode, dimming the screen, muting the sound, minimizing or arranging windows, or sending a text message with a phrase like "text Elisa that I'll be there soon." Microsoft also says it will integrate the new Copilot into taskbar Search for quick answers without leaving that flow.

Taken together, the announcement portrays Microsoft's strategy for responding to two simultaneous pressures: on one hand, the rising cost of running ever-larger AI models exclusively in the cloud, which the company itself acknowledges is outstripping customers' budgets; on the other, the need to give companies control, traceability and governance over agents acting autonomously inside their systems. The bet on massive local compute —backed by the deal with NVIDIA around RTX Spark and DGX Station— also works as a competitive response to Apple on laptop AI performance, and to the third-party agent ecosystem (OpenAI, Anthropic, Meta and Perplexity, among others) that Microsoft is seeking to accommodate within Windows rather than competing with using Copilot alone. The challenge for the coming months will be to see whether these promises of performance, security and gradual rollout on Copilot+ PCs hold up in practice, since much of what is described —from Copilot's hybrid capabilities to broader third-party MXC support— is still presented as coming "in the next few months" or in preview, not as capabilities already generally deployed.