Experimental Agentic Features

In this article

• Why security matters

• Agent security and privacy principles

• Enable experimental agentic features

• App access in agent workspace

• File access in agent workspace

• Known issues

Why Security matters

Agentic AI has powerful capabilities today—for example, it can complete many complex tasks in response to user prompts, transforming how users interact with their PCs. As these capabilities are introduced, AI models still face functional limitations in terms of how they behave and occasionally may hallucinate and produce unexpected outputs. Additionally, agentic AI applications introduce novel security risks, such as cross-prompt injection (XPIA), where malicious content embedded in UI elements or documents can override agent instructions, leading to unintended actions like data exfiltration or malware installation. We recommend you read through this information and understand the security implications of enabling an agent on your computer. 

As we begin to build agentic capabilities into Windows, our commitment is to include robust security and privacy controls that empower customers to explore their potential confidently with the support of clear guidance and appropriate guardrails driven by these goals.

1. Non-repudiation : All actions of an agent are observable and distinguishable from those taken by a user.

2. Confidentiality: Agents that collect, aggregate or otherwise utilize protected data of users meet or exceed the security and privacy standards of the data which they consume.

3. Authorization : Users approve all queries for user data as well as actions taken.

Agentic security and privacy principles

Securing AI agents requires a robust set of principles that ensure they act according to user intent while safeguarding their data.

1. Agents are autonomous entities. They are susceptible to attack in the same ways any other user or software components are. Their actions must be able to be contained.

2. Agents must be able to produce logs outlining their activities. Windows should be able to verify these actions with a tamper-evident audit log.

3. Agents should provide a means to supervise their activities. Many activities of agents are aggregate plans containing multiple steps. Users should be able to review the steps and approve the plan and monitor the execution of the plan. Agents must be able to explicitly request a user’s authorization or decision where necessary.

4. Agents should always act under the principles of least privilege and must not be granted permissions or capabilities exceeding that of the initiating user, including administrative rights. Authorized agent privileges should be granular, specific and time bound. Agents must only be able to access sensitive information (e.g. credit card data) in specific, user-authorized contexts such as for carrying out specific actions, such as when interacting with specific applications, or on specified websites.

5. Entities on the system – admin, local system, etc. – should not have special access to an agent other than the owner which it acts on behalf of.

6. Windows is designed to help agents adhere to Microsoft's commitments made in the Microsoft Privacy Statement and Responsible AI Standard . Windows will support agents in processing data only for clearly defined purposes, ensuring transparency, and trust. See the Microsoft Privacy Report for detail on our commitments to advancing AI responsibly while safeguarding privacy and other fundamental rights.​​​​​​​​​​​​​​

Agent development and AI-related security continue to be a fast-moving field of research with active participation from Microsoft in partnership with the broader security community. As part of Microsoft’s Secure Future Initiative commitment, helping users, businesses and developers address these challenges is our top priority as people begin to interact with agents as part of their daily workflows.

Enable Experimental Agentic Features

The experimental agentic features setting is off by default. This feature has no AI capabilities on its own, it is a security feature for agents like Copilot Actions. Enabling this toggle allows the creation of a separate agent account and workspace on the device, providing a contained space to keep agent activity separate from the user.  

The experimental agentic features setting is currently in preview, for the purposes of gathering and learning from feedback to refine the experience. During its preview period, we will continue to add more granular security and privacy controls before it is made generally available.  

Copilot Actions, currently in preview for Windows Insiders in Copilot Labs, uses this functionality, for more information see Copilot on Windows: Copilot Actions begins rolling out to Windows Insiders | Windows Insider Blog.  

This setting can only be enabled by an administrative user of the device and once enabled, it’s enabled for all users on the device including other administrators and standard users.   

​​​​​​The experimental agentic feature setting enables:

• The creation of agent accounts that provide agents with their own separate account on your device when acting on your behalf. Windows is using a phased approach to add stricter rules for agent accounts in upcoming releases.

• The creation of the agent workspace where agents can work in parallel with a human user, enabling runtime isolation and scoped authorization. This provides the agent with capabilities like its own desktop while limiting the visibility and accessing the agent has to the user’s desktop activity.

• Agentic apps like Copilot can request and get access to these six commonly used folders in your user profile directory while running in the agent workspace: Documents, Downloads, Desktop, Music, Pictures, and Videos.

Steps to enable experimental agentic features:

1. Sign in to Windows with an administrator account

2. In the Settings app on your Windows device, select System > AI Components > Experimental agentic features​​​​

App access in agent workspace

When running in the agent workspace, the agentic app has access to the apps that are available to all users by default. To limit access, you can install apps for specific users or specifically for your agents.

File access in agent workspace

Agentic accounts have limited access to your user profile directory (C:\Users\<username>\) while operating in the agent workspace. If an agent needs access to files in that directory, Windows grants read and write access to the following known folders: Documents, Downloads, Desktop, Videos, Pictures, Music when the setting is enabled. You may have these folders in the standard location, or you may have redirected them elsewhere on the filesystem.

To limit access to these folders, turn the experimental agentic feature setting off.

1. In the Settings app on your Windows device, select System > AI Components > Experimental agentic features

2. Turn the setting off

Agent accounts have access to any folders that all authenticated users have access to, e.g. public user profiles.

Known Issues

You may face these issues on build 26220.7262:

• Windows will not sleep while Copilot has active conversations.

  • Workaround: Close any Copilot Actions conversations or close Copilot by selecting it from the tray, right clicking it and selecting "Quit".

• You may see a warning "Someone else is still using this PC. If you shut down now, they could lose unsaved work." when trying to shut down or restart your Windows device due to active Copilot Actions conversations.

  • Workaround: Close any Copilot Actions conversations or close Copilot by selecting it from the tray, right clicking it and selecting "Quit".

• Enterprise users with Endpoint Privilege Management may see Intune managed profiles created for the Agent User accounts that are not cleaned up when the Copilot Action conversation is closed or the application exits. These profiles typically end with a dollar sign, i.e.: _$, and are located alongside the Agent User accounts in the Windows users folder (typically c:\users).​​​​​​​

  • Workaround: Microsoft is aware of this issue and is working on a fix that will clean up leftover Intune profiles. ​​​​​​​

​​​​​​​