Skip to content
Today
Sign in

Updated · 5 min read

Your brief · Builder lens · Sunday

Nadella says to assume the AI model is compromised as Microsoft ships OS-enforced agent permissions

Microsoft made Execution Containers generally available on Windows on October 7th and listed its Decision-1 scoring model at $0.042 per million input tokens. In an October 10 post, Satya Nadella wrote that systems should start from the assumption that the model is compromised. claims 1, 2, 5 and 6

1 · Agent containment

Execution Containers enforce an agent's file and network policy at runtime, outside the agent's control

  1. · Execution Containers

    At Build, Microsoft introduced the MXC SDK in early preview claim 8

  2. · Decision-1 and rivals

    Cloudflare introduced its Clef models, with open weights and deployment through Workers AI claim 9

  3. · Execution Containers

    MXC became generally available on Windows, 127 days after the early preview claims 2 and 10

  4. · Decision-1 and rivals

    Srivastava announced Decision-1 as a tool for routing, classification, prioritization, verification and workflow control claim 11

  5. · Nadella's post

    Nadella posted on X that systems should assume the model is compromised and contain it claims 1 and 6

Timeline: MXC early preview at Build on June 2; Cloudflare Clef on October 1; MXC generally available on Windows October 7, 127 days later; Decision-1 announced October 9; Nadella's post on X October 10.
DateStoryEventSource
Tue Jun 2Execution ContainersAt Build, Microsoft introduced the MXC SDK in early previewclaim 8
Thu Oct 1Decision-1 and rivalsCloudflare introduced its Clef models, with open weights and deployment through Workers AIclaim 9
Wed Oct 7Execution ContainersMXC became generally available on Windows, 127 days after the early previewclaims 2 and 10
Fri Oct 9Decision-1 and rivalsSrivastava announced Decision-1 as a tool for routing, classification, prioritization, verification and workflow controlclaim 11
Sat Oct 10Nadella's postNadella posted on X that systems should assume the model is compromised and contain itclaims 1 and 6

Nadella called for controls and safeguards located outside the model. He also wants every significant action recorded in a way that is tamper-proof and human-readable. MXC lets developers set the file paths and network destinations a workload may use, and enforces that policy at runtime, outside the agent's control. claims 3, 7, 12 and 13

MXC is an SDK dependency that builds into an application, with Rust, .NET and Node SDKs documented. The microVM backend is marked experimental. On macOS the only backend listed is the process container. claims 14, 15 and 16

Microsoft listed Codex, GitHub Copilot, OpenClaw, Replit, LM Studio, NVIDIA OpenShell and Unsloth AI among products that support MXC. Its announcement does not quantify usage or customer deployments. Windows 365 support is generally available, while Entra-based separation of agent and user activity is described as coming soon. claims 17, 18 and 19

dev.to's write-up states that Nadella's points are recommendations, not implementation details. claim 20

From Satya Nadella wants AI agents designed as if the model were already compromised, Microsoft makes Execution Containers generally available for OS-enforced agent permissions and Microsoft's Decision-1 turns the check before an agent acts into a scored Foundry call

2 · The pre-action check

A Decision-1 check that fills the full input window costs about $0.0014 at list price

An agent can ask whether a proposed tool call meets a rubric, then proceed, retry or escalate based on the score. Developers can also use the scores to send an uncertain case for human review. claims 24 and 25

Microsoft reports median latency 35 times faster than GPT-6 Sol. Its internal results, from Xbox Research sorting more than 10,000 feedback items and the Copilot team assessing AI responses, are also Microsoft-reported. claims 26 and 27

Cloudflare's Clef models have open weights, and OpenAI's Decisions API is in public beta. Microsoft says Decision-1 is coming to OpenRouter soon but gives no date. claims 9, 28 and 29

From Microsoft's Decision-1 turns the check before an agent acts into a scored Foundry call

3 · Human review

In Google's AMIE study, a human intervened in six of the 98 conversations

6conversations where a human intervened, of the 98 patients who consulted amie before urgent care, claims 30 and 31
6 of 98 conversations where a human intervened, claim 30
A human intervened in 6 of the 98 AMIE conversations.
MeasureValueSource
Conversations where a human intervened6claim 30
Patients who consulted AMIE before urgent care98claim 31
Share6 of 98claim 30

Supervising physicians monitored the interactions in real time. They spotted one hallucination and added clinical information in five conversations. AMIE's differential diagnoses matched the doctors' final diagnoses 90% of the time. claims 32, 33 and 34

The trial had no comparison group and does not establish how AMIE would perform without supervision. Decision-1's catalog entry also leaves thresholds and human review to the integrating application for employment, credit, housing, healthcare or legal-rights matters. claims 35 and 36

From Google's AMIE chatbot interviewed 98 patients before urgent-care visits in a Lancet study and Microsoft's Decision-1 turns the check before an agent acts into a scored Foundry call

4 · Paying for inference

A free voice-controlled demo is spending over $1,000 a day on AI as players arrive

Voice is the game's only control. Gemini listens to the commands, with ChatGPT as the fallback. Hitting Gemini's usage limits pushed the game onto ChatGPT Realtime Mini 2.1, and players saw delayed responses and wrong inputs. claims 39, 43 and 44

Easy Fox plans local models for players with capable hardware. Self-hosting has conditions of its own in Qwen's image release. Qwen-Image-2.1-Turbo's BF16 weights occupy about 14 GB, and commercial use needs a separate license from Qwen. claims 45, 46, 47 and 48

From Easy Fox takes a bank loan to cover its free Steam demo's $1,000-a-day AI bill and Qwen-Image-2.1-Turbo cuts sampling to eight steps under a research-only license

5 · Funding the build-out

Waymo's first debt financing is a $5 billion term loan from 13 named lenders

Waymo's loan, equity round and valuation

Bars in billions of dollars: Waymo's term loan $5 billion, its equity investment $16 billion, and the valuation from that raise roughly $126 billion. Values in $ billion.
RowValuePart ofSource
Term loan, Waymo's first debt financing$5 billion—claim 49
Equity investment closed earlier in 2026$16 billion—claim 51
Valuation from the equity raiseroughly $126 billion—claim 52

Goldman Sachs was sole lead bookrunner, with PIMCO, Blackstone and Sixth Street as lead syndicated lenders. Waymo said proceeds will support expansion of its ride-hailing service across domestic and international markets. Neither Alphabet nor Waymo's other equity partners provided a corporate guarantee on the loan. claims 55, 56, 57 and 58

Dev.to wrote: "Equity investors buy a vision; lenders buy a cash-flow story." Regulatory timelines remain uncertain in new jurisdictions, and any high-profile safety incident could freeze Waymo's expansion overnight. claims 59 and 60

From Waymo's first loan draws 13 named lenders, led by PIMCO, Blackstone and Sixth Street

6 · Open questions

An OpenRouter date, backend maturity, license terms and the loan's terms would change the picture

Slower-moving

From Microsoft's Decision-1 turns the check before an agent acts into a scored Foundry call, Microsoft makes Execution Containers generally available for OS-enforced agent permissions, Satya Nadella wants AI agents designed as if the model were already compromised, Easy Fox takes a bank loan to cover its free Steam demo's $1,000-a-day AI bill, Qwen-Image-2.1-Turbo cuts sampling to eight steps under a research-only license and Waymo's first loan draws 13 named lenders, led by PIMCO, Blackstone and Sixth Street

End of brief

You’re caught up.

The Builder brief checks for new reporting at and changes only when the stories move.

Get the Builder edition by emailBrowse all 323 stories

Drawn from 7 of the 323 stories published in the last 24 hours, citing 63 claims.

The claims behind this

Each figure above cites the claim it rests on, verbatim from the story that reported it.

  1. [1]

    Nadella wrote that systems should start from the assumption that the model is compromised, and should contain it.

    Satya Nadella wants AI agents designed as if the model were already compromised

  2. [2]

    Microsoft made Microsoft Execution Containers (MXC), its policy-driven system for restricting what AI agents and other untrusted workloads can access, generally available on Windows on October 7th.

    Microsoft makes Execution Containers generally available for OS-enforced agent permissions

  3. [3]

    MXC selects a containment backend and enforces the policy at runtime, outside the agent's control.

    Microsoft makes Execution Containers generally available for OS-enforced agent permissions

  4. [4]

    Microsoft wants Windows to supply the operating-system boundary around agents, rather than leave developers to rely on instructions given to the model or limits inside an agent application.

    Microsoft makes Execution Containers generally available for OS-enforced agent permissions

  5. [5]

    Microsoft lists Decision-1 input tokens at $0.042 per million, with output tokens free.

    Microsoft's Decision-1 turns the check before an agent acts into a scored Foundry call

  6. [6]

    Nadella made the comments in a post on X on October 10, 2026 (a Saturday morning, per mezha.net).

    Satya Nadella wants AI agents designed as if the model were already compromised

  7. [7]

    Developers define which resources a workload may use, including file paths and network destinations.

    Microsoft makes Execution Containers generally available for OS-enforced agent permissions

  8. [8]

    At Build on June 2nd, Microsoft introduced the MXC SDK in early preview, initially describing a cross-platform execution layer for Windows and Windows Subsystem for Linux.

    Microsoft makes Execution Containers generally available for OS-enforced agent permissions

  9. [9]

    Cloudflare introduced its Clef models on October 1st, with open weights and deployment through Workers AI.

    Microsoft's Decision-1 turns the check before an agent acts into a scored Foundry call

  10. [10]

    MXC went from early preview at Build on June 2 to general availability on October 7 in 127 days, about four months.

    Microsoft makes Execution Containers generally available for OS-enforced agent permissionsComputed: Days from June 2 to October 7 = 28 (rest of June) + 31 (July) + 31 (August) + 30 (September) + 7 (October) = 127

  11. [11]

    In his October 9th announcement, Srivastava describes Decision-1 as a tool for routing, classification, prioritization, verification and workflow control.

    Microsoft's Decision-1 turns the check before an agent acts into a scored Foundry call

  12. [12]

    Nadella called for controls and safeguards to be located outside the model itself.

    Satya Nadella wants AI agents designed as if the model were already compromised

  13. [13]

    Nadella said every meaningful or significant action of the model should be recorded in a way that is tamper-proof and human-readable.

    Satya Nadella wants AI agents designed as if the model were already compromised

  14. [14]

    The MXC source repository describes MXC as an SDK dependency that builds into an application and documents Rust, .NET and Node SDKs.

    Microsoft makes Execution Containers generally available for OS-enforced agent permissions

  15. [15]

    Microsoft's launch materials describe process containers for Windows, macOS and Linux; Windows-only session containers and WSL containers; and microVMs on Windows and Linux marked experimental.

    Microsoft makes Execution Containers generally available for OS-enforced agent permissions

  16. [16]

    On macOS, the only backend listed in Microsoft's launch materials is the process container.

    Microsoft makes Execution Containers generally available for OS-enforced agent permissionsComputed: Filter the c8 backend list for macOS: process containers (Windows, macOS, Linux) = yes; session containers (Windows only) = no; WSL containers (Windows only) = no; microVMs (Windows, Linux) = no. Result: process containers only.

  17. [17]

    In a separate October 7th Windows platform announcement, Microsoft listed Codex, GitHub Copilot, OpenClaw, Replit, LM Studio, NVIDIA OpenShell and Unsloth AI among products that support MXC.

    Microsoft makes Execution Containers generally available for OS-enforced agent permissions

  18. [18]

    Microsoft's announcement does not quantify usage or customer deployments of MXC.

    Microsoft makes Execution Containers generally available for OS-enforced agent permissions

  19. [19]

    Windows 365 support for MXC is generally available, allowing agents to run on Cloud PCs alongside users' existing work; Entra-based separation of agent and user activity and extensions to Agent 365 controls for local agents are described as coming soon.

    Microsoft makes Execution Containers generally available for OS-enforced agent permissions

  20. [20]

    dev.to's write-up states that Nadella's points are recommendations, not implementation details.

    Satya Nadella wants AI agents designed as if the model were already compromised

  21. [21]

    A single Decision-1 check that fills the full 32,768-token input window costs about $0.0014 at list price.

    Microsoft's Decision-1 turns the check before an agent acts into a scored Foundry callComputed: 32,768 tokens x $0.042 / 1,000,000 tokens = $0.00137616, about $0.0014 (output free)

  22. [22]

    Microsoft's Foundry listing says the model accepts text inputs of up to 32,768 tokens and returns JSON.

    Microsoft's Decision-1 turns the check before an agent acts into a scored Foundry call

  23. [23]

    One thousand maximum-length Decision-1 checks cost about $1.38 at list price.

    Microsoft's Decision-1 turns the check before an agent acts into a scored Foundry callComputed: 1,000 x $0.00137616 = $1.37616, about $1.38

  24. [24]

    An agent can ask whether a proposed tool call meets a rubric, then proceed, retry or escalate based on the score.

    Microsoft's Decision-1 turns the check before an agent acts into a scored Foundry call

  25. [25]

    Developers can use Decision-1 scores to route a support ticket, check an agent's proposed action, or send an uncertain case for human review.

    Microsoft's Decision-1 turns the check before an agent acts into a scored Foundry call

  26. [26]

    Microsoft reports median latency 35 times faster than GPT-6 Sol and 4.5 times faster than Quyet-1.0-Large.

    Microsoft's Decision-1 turns the check before an agent acts into a scored Foundry call

  27. [27]

    Xbox Research used Decision-1 to sort more than 10,000 feedback items, and Copilot's team used it to assess AI responses; these results are Microsoft-reported.

    Microsoft's Decision-1 turns the check before an agent acts into a scored Foundry call

  28. [28]

    OpenAI's Decisions API is in public beta, returning typed answers for fixed questions.

    Microsoft's Decision-1 turns the check before an agent acts into a scored Foundry call

  29. [29]

    Microsoft plans to bring Decision-1 to OpenRouter; its announcement says OpenRouter access is coming soon, without giving a date.

    Microsoft's Decision-1 turns the check before an agent acts into a scored Foundry call

  30. [30]

    A human intervened in six of the 98 conversations.

    Google's AMIE chatbot interviewed 98 patients before urgent-care visits in a Lancet studyComputed: 1 hallucination caught + 5 conversations with added clinical information = 6

  31. [31]

    In a real-world clinical study, 98 patients consulted AMIE, Google's research diagnostic AI chatbot, ahead of urgent care visits.

    Google's AMIE chatbot interviewed 98 patients before urgent-care visits in a Lancet study

  32. [32]

    Supervising physicians monitored the interactions in real time.

    Google's AMIE chatbot interviewed 98 patients before urgent-care visits in a Lancet study

  33. [33]

    Supervisors spotted one hallucination and added clinical information in five conversations.

    Google's AMIE chatbot interviewed 98 patients before urgent-care visits in a Lancet study

  34. [34]

    AMIE's differential diagnoses matched the doctors' final diagnoses 90% of the time.

    Google's AMIE chatbot interviewed 98 patients before urgent-care visits in a Lancet study

  35. [35]

    This trial had no comparison group and doesn't establish how AMIE would perform without supervision.

    Google's AMIE chatbot interviewed 98 patients before urgent-care visits in a Lancet study

  36. [36]

    The Foundry catalog warns that Decision-1 should not be the sole automated decision-maker for consequential matters involving employment, credit, housing, healthcare or legal rights; integrating applications need to set thresholds, human review and safeguards.

    Microsoft's Decision-1 turns the check before an agent acts into a scored Foundry call

  37. [37]

    "We are currently spending over $1,000 per day on AI services for the demo," the team wrote on its Steam update.

    Easy Fox takes a bank loan to cover its free Steam demo's $1,000-a-day AI bill

  38. [38]

    Easy Fox, the developer of the free, AI-powered Steam demo Teach My Little Sister How To Drive, has taken out a bank loan as more players tried the title.

    Easy Fox takes a bank loan to cover its free Steam demo's $1,000-a-day AI bill

  39. [39]

    Voice is the game's sole control method; AI recognizes the player's commands and translates them into instructions for the virtual little sister.

    Easy Fox takes a bank loan to cover its free Steam demo's $1,000-a-day AI bill

  40. [40]

    At a sustained $1,000 a day, AI spending on the demo is at least $30,000 a month.

    Easy Fox takes a bank loan to cover its free Steam demo's $1,000-a-day AI billComputed: $1,000 per day x 30 days = $30,000; the studio says 'over' $1,000, so this is a floor

  41. [41]

    SteamDB showed an average player count of under 10 until late August, around 50 players by late September, and a peak of 431 on October 1.

    Easy Fox takes a bank loan to cover its free Steam demo's $1,000-a-day AI bill

  42. [42]

    Easy Fox said the number of players trying the game has grown over 20 times, more than it expected.

    Easy Fox takes a bank loan to cover its free Steam demo's $1,000-a-day AI bill

  43. [43]

    The game uses Google Gemini to listen to voice commands and generate responses, with ChatGPT serving as a fallback system.

    Easy Fox takes a bank loan to cover its free Steam demo's $1,000-a-day AI bill

  44. [44]

    The increased number of users caused the game to hit usage limits on Google Gemini, forcing it to fall back on the less capable ChatGPT Realtime Mini 2.1 model, which led to player issues such as delayed responses and wrong inputs.

    Easy Fox takes a bank loan to cover its free Steam demo's $1,000-a-day AI bill

  45. [45]

    Easy Fox plans to introduce local AI models for players with capable hardware so the game does not have to rely on external services, which can run into limits.

    Easy Fox takes a bank loan to cover its free Steam demo's $1,000-a-day AI bill

  46. [46]

    Alibaba's Qwen team released Qwen-Image-2.1-Turbo on October 9th, offering downloadable model weights for image generation and editing with a recommended eight-step sampling schedule.

    Qwen-Image-2.1-Turbo cuts sampling to eight steps under a research-only license

  47. [47]

    The 7-billion-parameter visual-generation model's BF16 weights occupy about 14 GB.

    Qwen-Image-2.1-Turbo cuts sampling to eight steps under a research-only licenseComputed: 7e9 parameters x 16 bits (BF16) / 8 bits per byte = 14e9 bytes, about 14 GB

  48. [48]

    The model card links to Qwen's Research License Agreement, which permits use, reproduction and modification for noncommercial research or evaluation; commercial use requires a separate license from Qwen.

    Qwen-Image-2.1-Turbo cuts sampling to eight steps under a research-only license

  49. [49]

    Waymo closed a $5 billion term loan, its first debt financing.

    Waymo's first loan draws 13 named lenders, led by PIMCO, Blackstone and Sixth Street

  50. [50]

    Pulse2.com names 13 lenders in total on the loan.

    Waymo's first loan draws 13 named lenders, led by PIMCO, Blackstone and Sixth StreetComputed: 3 lead lenders (c3) + 3 significant lenders (c4) + 7 additional lenders (c5) = 13

  51. [51]

    The debt financing follows a $16 billion equity investment Waymo closed earlier in 2026.

    Waymo's first loan draws 13 named lenders, led by PIMCO, Blackstone and Sixth Street

  52. [52]

    The $16 billion equity raise valued Waymo at roughly $126 billion, with Alphabet maintaining its majority position.

    Waymo's first loan draws 13 named lenders, led by PIMCO, Blackstone and Sixth Street

  53. [53]

    The $5 billion loan is about 4% of the roughly $126 billion valuation.

    Waymo's first loan draws 13 named lenders, led by PIMCO, Blackstone and Sixth StreetComputed: 5 / 126 = 0.0397, about 4%

  54. [54]

    The $5 billion loan is about 31% of the $16 billion equity round.

    Waymo's first loan draws 13 named lenders, led by PIMCO, Blackstone and Sixth StreetComputed: 5 / 16 = 0.3125, about 31%

  55. [55]

    Goldman Sachs served as the sole lead bookrunner for the transaction.

    Waymo's first loan draws 13 named lenders, led by PIMCO, Blackstone and Sixth Street

  56. [56]

    PIMCO, Blackstone and Sixth Street participated as lead syndicated lenders in the financing.

    Waymo's first loan draws 13 named lenders, led by PIMCO, Blackstone and Sixth Street

  57. [57]

    Waymo said proceeds from the term loan will support the continued expansion of its fully autonomous ride-hailing service across domestic and international markets.

    Waymo's first loan draws 13 named lenders, led by PIMCO, Blackstone and Sixth Street

  58. [58]

    Neither Alphabet nor Waymo's other equity partners provided a corporate guarantee on the loan.

    Waymo's first loan draws 13 named lenders, led by PIMCO, Blackstone and Sixth Street

  59. [59]

    Dev.to wrote: "Equity investors buy a vision; lenders buy a cash-flow story."

    Waymo's first loan draws 13 named lenders, led by PIMCO, Blackstone and Sixth Street

  60. [60]

    Regulatory timelines remain uncertain in new jurisdictions, and any high-profile safety incident could freeze Waymo's expansion overnight.

    Waymo's first loan draws 13 named lenders, led by PIMCO, Blackstone and Sixth Street

  61. [61]

    The MXC repository labels several backends experimental, which RuntimeWire says reinforces that general availability for MXC does not mean every isolation option has the same maturity.

    Microsoft makes Execution Containers generally available for OS-enforced agent permissions

  62. [62]

    Microsoft CEO Satya Nadella called for safeguards that give an authorised person the ability to pause or shut down an AI model in the middle of a task.

    Satya Nadella wants AI agents designed as if the model were already compromised

  63. [63]

    "For the paid release, we plan to account for expected AI usage in the game's price," the team said. "Players will not be charged separately for their individual AI token usage after purchasing the game."

    Easy Fox takes a bank loan to cover its free Steam demo's $1,000-a-day AI bill