Microsoft was testing a Windows 11 feature that gives artificial-intelligence agents a separate environment in which to operate alongside a person. The experimental Agent Workspace appeared in Windows 11 build 26220.7262 for participants in the Dev and Beta channels of the Windows Insider program, according to testing by Windows Latest.
A new switch for experimental agent functions appeared under AI Components in the System area of Settings. The control could create an additional workspace, although the agent feature itself was not operational in the tested build. Microsoft was therefore exposing an early implementation to testers rather than releasing a finished capability to ordinary Windows users.
Each agent is intended to receive its own Windows account, desktop, permissions and runtime. That separation would allow automated tasks to continue while the person uses the main desktop. Microsoft described the approach as parallel work with isolated execution and narrowly assigned authorization, limiting what an agent can observe or change. Actions are also meant to be logged so users can review activity.
The workspaces nevertheless need selected access to local resources to complete tasks. Windows Latest found read-and-write permissions for familiar directories such as Downloads, Desktop, Videos, Pictures and Music when the experimental control was enabled. Because Windows tracks these as known folders, their locations can still be found after a user redirects them elsewhere. Agents may also require access to installed applications, with options to install software for a specific account.
The feature is optional and disabled by default. Separate agents can have different rules, so permission assigned to one does not automatically extend to another. This design differs from Windows Sandbox, which uses hardware-backed virtualization and a separate kernel, has no access to personal folders and discards its activity when closed. Agent Workspace is intended to be lighter, but it preserves enough local access to act on the user's behalf.
Microsoft's own interface warned that the experimental functions could affect performance. Background jobs may consume memory and processor time, though the company said normal agents would use limited resources and did not publish benchmark figures. More demanding agents could require more capacity.
The test presents a clear tradeoff. Local agents need useful permissions, yet those permissions enlarge the consequences of faulty or malicious behavior. Account separation, audit logs and per-agent limits provide controls, but the security model was still being refined. With the switch confined to Insider builds and the underlying function unavailable in the observed version, broader release timing and final safeguards remained unspecified.
Those limits matter during testing.
