For more than a decade, Surface has been shaped by the people pushing technology further. Creators rendering complex scenes. Developers building what doesn't exist yet. Designers moving between ideas, models, code, and content. Makers whose work demands more from their devices because they're constantly pushing boundaries. Over time, we've learned something important: the people who choose Surface aren't just using technology for tasks; they're shaping what's next. Today, we're opening pre-orders for two new devices built for that reality: Surface Laptop Ultra and Surface RTX Spark Dev Box. These new Surface devices bring to life the broader Windows vision for hybrid intelligence we’re sharing today, combining the power of the PC and the cloud to help people do more with AI.

Surface Laptop Ultra: Made for world makers

Surface Laptop Ultra started with a clear ambition: How can we better serve the needs of creators, developers, and AI builders? The answer wasn’t simply a faster laptop. It meant fundamentally rethinking what a high-performance Windows PC could be. It started with a deep partnership to optimize Windows to take full advantage of NVIDIA’s RTX Spark™ Superchip. We then designed an entirely new device around the platform from the ground up. Mechanical, electrical, thermal, acoustic, material engineers, and industrial designers worked together from the beginning to fully realize the potential of the RTX Spark. The result is our most powerful Surface Laptop ever, built for demanding creative, technical, and AI workloads.

One superchip. One complete system.

Designed around NVIDIA RTX Spark, Surface Laptop Ultra unites an NVIDIA Blackwell RTX GPU with up to 6,144 cores, an NVIDIA Grace CPU with up to 20 cores, and up to 128 GB of unified memory.¹ Run AI models exceeding 120B parameters locally, with up to 1 petaflop of AI performance.² Move between creative work, development, and immersive gaming without missing a beat. Keep more of your work on-device, with less reliance on the cloud and access to the CUDATM ecosystem and full Windows AI stack.³

Power is only the beginning

Power only matters if it lasts. That's why we designed a new thermal architecture that delivers up to 2.5x more thermal power capacity than our current Surface Laptops. In a chassis less than 18 mm thin and under 4.5 lb⁴, Surface Laptop Ultra was built for sustained performance. The 15-inch PixelSense™ Ultra touchscreen is the brightest, sharpest, and most vivid display we've ever put on a Surface Laptop.⁵ It’s designed to empower professionals to review footage frame by frame, annotate designs, explore datasets, and interact directly with their work. It delivers the brightest peak HDR of any laptop⁶, up to 25% brighter peak HDR than MacBook Pro M5⁷, and the color accuracy creators trust. The touchpad is 30% larger, with advanced haptics for precise control across demanding creative workflows.⁸ Storage is user-removable, so you can upgrade, replace, or secure your own storage.⁹ Surface Laptop Ultra is available in Platinum and Nightfall, so it looks as sleek and sophisticated as it runs.¹⁰ It also features our most complete port selection yet, led by something entirely new: Magnetic Connect, the world’s first built-in magnetic USB-C® charging on a laptop. The included charging cable attaches magnetically to the right-side USB-C port and releases easily. The port remains fully functional for video, data, and other USB-C devices. Other ports include: · Two additional USB-C ports · HDMI · USB-A · An SD card reader · A 3.5 mm headphone jack Drive up to three 4K displays¹¹. Import footage without adapters. One device. Every connection you need.

Built for real work. Always ready to play.

Creative professionals get a display they can trust, graphics acceleration when projects get demanding, and up to 128 GB of unified memory to provide headroom for multitasking across demanding creative and local AI workflows. Developers can use local models with GitHub Copilot to bring agentic coding on device. They can prototype agents, review code, test larger models, and keep development tools running side by side. When the work is done, the same RTX Spark architecture that accelerates creative and AI workloads also powers a great gaming experience. Ray tracing, DLSS and NVIDIA Reflex in supported titles, together with the deep and growing catalog of games on Windows on Arm, mean the machine you rely on during the day can keep delivering when it’s time to play.

Surface RTX Spark Dev Box

Surface Laptop Ultra moves with you. Surface RTX Spark Dev Box gives developers, AI engineers, and technical teams powerful AI compute at their desks. Also built around NVIDIA RTX Spark Superchip, this developer-first powerhouse brings massive local AI compute to a compact small form factor, giving developers more control over where workloads run and how resources are used. When experimentation happens locally, teams can iterate faster, reduce cloud dependency, and reserve cloud resources for the workloads that truly need them. Dev Box offers developers:

• Up to 1 petaflop of AI performance and 128 GB of unified memory on your desk
• Support for AI models exceeding 120B parameters with large context windows²
• Local inference, evaluation, and experimentation at interactive speeds
• The same powerful NVIDIA RTX Spark platform that powers Surface Laptop Ultra

Ready to go out of the box The goal is simple: less time configuring your environment, more time building. As part of the Project Zenith family of devices, Surface RTX Spark Dev Box comes ready with the tools, runtimes, and environments developers use most, including Visual Studio Code, Git, GitHub CLI, GitHub Copilot, WSL, Python, Node and more.

Run AI agents where they work best

Give developers the freedom to move faster with agents, while keeping access, compute, and cost under control. Windows is the OS for agents, and Surface is the hardware for Windows. Microsoft Execution Containers provide containment for agents, while upcoming Windows capabilities will use Microsoft Entra to distinguish agent activity from user activity and extend Microsoft Agent 365 controls to local agents on-device. With NVIDIA RTX Spark and up to 128 GB of unified memory, Surface Laptop Ultra and Surface RTX Spark Dev Box can run demanding models and agent workflows locally, including GitHub Copilot tasks that investigate builds and propose fixes, while Microsoft Dev Box adds cloud capacity when needed.¹ The result is governed, scalable AI development without spending a cloud token on every step. Commercial configurations of Surface Laptop Ultra are available for pre-order today.

Break up with your MacBook

If you've outgrown the compromises of a traditional professional laptop, we'll help make the switch. Level up to Surface Laptop Ultra and get up to $1,000 cash back when you trade in an eligible MacBook Pro.¹² We're confident that once today's creators and developers experience everything Surface Laptop Ultra has to offer, they won't look back. Learn more about the offer here.

Reserve yours today

Starting today, pre-order Surface Laptop Ultra starting at $2,599 (MSRP) from Microsoft.com or select retailers worldwide, with availability beginning October 16. At Microsoft Store, explore the full lineup of configurations and accessories, with free shipping, easy returns, flexible payment options, and Microsoft support. If you’re looking for a commercial device, explore Surface Laptop Ultra for Business. Surface RTX Spark Dev Box is available for pre-order for $5,999 (MSRP), exclusively on Microsoft.com in the U.S. and will begin shipping to customers this November.

---

¹ Memory varies by configuration. 128GB total system memory in a unified memory architecture dynamically shared between CPU and GPU. Maximum amount addressable by the GPU depends on system configuration and workload and is less than the total. ² Based on theoretical FP4 performance of 1 petaflop using the sparsity feature. See: NVIDIA Corporation - NVIDIA and Microsoft Reinvent Windows PCs for the Age of Personal AI. ³ CUDA™ is a registered trademark of NVIDIA Corporation. ⁴ Might vary depending on manufacturing processes. ⁵ Surface display has rounded corners within a standard rectangle. When measured as a standard rectangular shape the screen is 15” diagonally (actual viewable area is less). Touchscreen is optimized for touch interaction only. Pen input and compatibility with Surface Pen, Surface Slim Pen, or similar accessories is not supported. ⁶ Peak HDR brightness of 2,000 nits, measured over a 10 percent window with HDR content. Comparison against laptops commercially available as of October 2026. Sustained and SDR brightness are lower. Actual brightness varies with content, settings, and conditions. ⁷ Based on peak HDR brightness comparing Surface Laptop Ultra to MacBook Pro M5 Pro published specifications as of October 1st, 2026. ⁸ Compared to Surface Laptop 8th Edition ⁹ Replacement components and service options vary by market and over time. Repairs should follow the Microsoft Service Guide. Device damage caused during repair may not be covered by warranty unless required by law. ¹⁰ Colors available on selected models only. Available colors, sizes, finishes, and processors may vary by store, market, and configuration. ¹¹ External monitor support requires compatible displays, cables, and accessories. See Surface tested peripherals page for compatibility information. ¹² Offer valid with purchases of qualifying new Surface Laptop Ultra device between October 7, 2026 - November 23, 2026 after trade-in of a qualifying device, where customer submits the online trade-in claim for their used device, plus proof of purchase for new device, during the Promotion Period. Available only through the Microsoft Store online in the United States and Canada. Amount of additional cash back varies depending on device purchased and value of trade in; see FAQ for more details. To be eligible for the cash back, customer must mail in the qualifying trade-in device within 15 days of completing the online trade-in process. To be eligible for trade-in, (i) customer must own the qualifying device, (ii) the device must power on, (iii) the battery must hold a charge (the device must not be required to be plugged in to operate), and (iv) the device must be in fully functional, working condition and not have broken or missing components, a cracked display or screen, liquid damage, modification(s) or the device warranty seal broken. The device cannot be password protected and must include its original chargers, accessories, and hard drive. Trade-in value depends on device type and condition after inspection by Teladvance. All trade-ins and reimbursements are subject to Teladvance's sole discretion and approval. Devices determined to not meet eligibility criteria may be shipped back to the customer or recycled. Recycled devices are not eligible for cash back. All trade-ins are final. See Microsoft Store Trade-in Program for steps and requirements. Not valid on prior orders or purchases; cannot be transferred or otherwise redeemed for cash or gift cards, or credit towards other devices or products. May not be combined with other offers. Void where prohibited or restricted by law. Microsoft reserves the right to modify or discontinue offers at any time. Limit of 1 offer per customer.

Agents are unlocking enormous productivity gains for customers, but their ability to work across files, networks, and applications can introduce new security risks. This can leave customers feeling like they only have two choices: give agents unrestricted access and hope nothing goes wrong or block them and lose the productivity benefits they provide. Neither option is acceptable. That’s why we’re building Windows platform capabilities to help run and manage agents more securely, starting with:

• Containment: limiting what an agent can access and do.
• Identity: distinguishing an agent’s activity from a person.
• Manageability: giving organizations the tools to govern access and monitor agent activity.

Microsoft Execution Containers (MXC), now generally available, provides the containment layer. Developers and IT administrators define the resources, like files and network destinations an agent can use and MXC uses the appropriate container to enforce those policies at runtime.   Windows will also soon enable Microsoft Entra to help distinguish agent activity from user activity, ensuring users can remain productive even when agent access needs restrictions and extend Microsoft Agent 365 controls to local agents on-device, enabling IT teams to manage MXC containers, apply policies, and monitor agent activity.

Why agents need a managed execution boundary 

An agent cannot be its own security authority. It must run within a boundary defined by the developer or organization and enforced independently of the agent itself. Consider a coding agent asked to update a website. The agent needs read and write access to the website repository and access to the development tools required to build and test the change. It may need to read production server configuration to understand how the application is deployed, but it should not be able to modify that configuration. Without a managed execution boundary, the agent may decide that changing the server configuration is the fastest way to complete the task and potentially break the production site. The action can be reasonable from the agent's perspective and still exceed the authority the developer intended to grant. Containment creates that managed boundary: the agent can read and write the repository, read the server configuration, but is not authorized to access anything else unless access has been granted. If the agent attempts to modify the server configuration, the containment environment is designed to prevent the operation regardless of what the model, generated code, plugin, or tool decides to do.

What is Microsoft Execution Containers (MXC)? 

Microsoft Execution Containers (MXC) is a policy-driven execution layer for untrusted code or dynamically generated workloads. In agentic scenarios, developers can use MXC to contain model-generated output, plugins, tools, agent harness, or the entire agent. This limits what the agent workload can access by containing the scope of the impact if something goes wrong.   Developers declare the resources a workload requires, such as files and network destinations, and MXC enforces the resulting boundary with the appropriate container. The policy remains outside the agent workload’s control, so the agent or generated code cannot grant itself additional access. MXC also separates workload requirements from platform-specific containment details, greatly simplifying the developer experience. Developers integrate with a unified JSON configuration schema and multi-language SDK, while MXC maps the requested controls to the selected backends on Windows, macOS, or Linux. Developers can apply the same containment model wherever an agent needs to run – from a local device to the cloud. With Windows 365 support for MXC now generally available, developers can run agents alongside their existing work on Cloud PCs, using the right isolation model to help keep agent execution separate and secure.

Choose the containment level that fits the workload 

Different workloads require different levels of isolation. A coding agent working in a repository may prioritize low latency and responsiveness, while an agent processing sensitive data or running untrusted code may require stronger isolation. MXC provides a spectrum of containment options so developers and organizations can select the right level of isolation for each workload. Only Windows supports a session container, which runs an agent on the user’s device in a separate, OS-isolated session with its own local agent identity and isolated desktop, clipboard, UI, and input boundaries.

Backend	Availability	Best suited for	Important characteristics
Process container	Windows 11, macOS, and Linux	Lightweight containment for responsive workloads, including model-generated code and tool execution.	Uses the platform-appropriate process sandbox, including AppContainer on Windows, Seatbelt on macOS, and Bubblewrap on Linux.
Session container	Windows 11 only	Long-running agents and automation that need a desktop or stronger separation from the interactive user.	Runs under a distinct Windows account and session, separating the agent's desktop, clipboard, UI, input, and active session from the user.
WSL container (WSLc)	Windows 11 only	Linux-first agent toolchains and workloads that depend on the Linux package and development ecosystem.	Provides a Linux execution environment through WSL.
MicroVM	Windows 11 and Linux, experimental	Higher-risk workloads that benefit from a hardware-backed virtualized boundary.	Provides hardware-enforced isolation and full Linux workload compatibility.

Each containment backend has distinct security properties and workloads should be evaluated for fit with containment backend.

How MXC policy defines workload boundaries 

MXC helps users and organizations delegate more work to agents while limiting them to the resources required for each task. Instead of giving an agent the full authority of the signed-in user, developers and IT can define an OS-enforced boundary around the agent’s workload.  For the website scenario, an MXC policy could give a coding agent read and write access to its local source-code repository and access to required development tools such as Git, while preventing access to personal locations such as the user’s Documents folder. The policy could also block inbound and outbound network connections and access to the interactive desktop.  

Policy area	What it controls
Containment	The isolation environment in which the workload runs, such as a process or session container.
Process	The command, arguments, working directory, environment, and other settings used to start the workload.
File system	Locations the workload can modify, locations it can read without changing, and locations it cannot access.
Network	Inbound and outbound connectivity, including whether the workload can connect to services through the host’s loopback interface.
User interface	Whether the workload can access or interact with the desktop and related UI resources.

Adding MXC support is straightforward for agent developers – you can easily use your favorite coding agent to integrate the MXC SDK and draft an initial workload policy, then review, test, and refine the resulting controls.

How workload and organizational policy work together 

Agent developers declare the resources their agentic workloads may need. Organizations can also apply additional constraints through management policy, like with Microsoft Intune management policy. This allows the same agent to operate within different enterprise boundaries without requiring the agent developer to encode the organization's security posture into the application. Containment becomes more valuable when organizations can apply it consistently. Intune policy will soon be available to manage MXC process containers used by MXC-integrated agents on Windows 11. These policies will offer IT administrators control over how Windows evaluates container creation requests made by agents, and the resource boundaries that are enforced by those containers. Agent developers should design their workloads to operate within boundaries that may be more restrictive than the default configuration. If organizational policy blocks a resource, the agent should explain that the task could not be completed within the available permissions, request an appropriate user or administrator action when supported, or choose a safe alternative. It should not silently fail.

Observe and refine policy before enforcing it 

Writing a least privilege policy can be difficult when you do not yet know every resource an agent workload requires. Only on Windows, MXC process containers can produce an agent activity report showing which resources a workload attempted to use to help craft a least-privilege policy. MXC supports three operating modes:  

Mode	Ungranted access	Activity Report	Intended use
Enforcement	Blocked	No	Run the workload with its production policy
Learning	Blocked and recorded	Yes	Diagnose failures and verify that the policy grants only required access
Permissive	Allowed and recorded	Yes	Observe agent activity without enforcing policy

In Enforcement mode, MXC applies the policy without activity report. Granted operations proceed, and operations outside the boundary are restricted. In Learning mode, MXC continues to enforce the configured boundary. An operation that has not been granted is blocked and recorded in a JSON activity report. This lets developers or IT reproduce containment failures and understand which resources the workload attempted to access. In Permissive mode, MXC records access that the policy would have denied but allows the operation to continue. This is useful during policy authoring because the workload can be completed while developers or IT collect evidence about the resources it uses. Permissive mode does not bypass other applicable operating system or organizational restrictions. When you bring an agent into an MXC container for the first time, the policy may block capabilities that the workload legitimately needs. These denials reveal where the boundary needs adjustment, helping you grant the required access without unnecessarily expanding the agent’s reach.

Agent identity & attribution 

Containment answers what an agent may do. Identity helps determine which agent performed an action. Coming soon, Windows will allow Microsoft Entra to distinguish agent activity from user activity in Microsoft Agent 365. This separation will allow security teams to evaluate an agent's behavior and risk independently from the person using the device. If an agent becomes compromised or violates policy, security controls will target the agent's access to protected resources without blocking the employee’s access. As organizations deploy more agents, one misbehaving agent does not have to interrupt the employee’s access or productivity. Agent-level attribution also improves investigation and governance. Administrators will be able to use Agent 365 to understand which agents are running, associate activity with a specific agent, investigate risky behavior, and apply policy to individual agents or groups of agents instead of relying only on user-level or device-level context.

Agents using MXC today 

NVIDIA has integrated OpenShell into MXC, complementing MXC with policy controls for agent access to files and inference services; advanced network controls; credential management, and for enterprises, OCSF auditing. Leading agents and agent frameworks already support MXC, including GitHub Copilot, OpenClaw, OpenAI Codex, Replit, LM Studio, and Unsloth AI. Many others will be releasing support for MXC: Anthropic Claude Code, Box, Egnyte, Heidi Health, Hermes Agent by Nous Research, Manus, Perplexity, Raycast, and Simular amongst others. For people using AI every day, these safeguards are part of the agent experience itself, giving users a more secure way to work with these tools. GitHub Copilot, Codex, and Replit agent scenarios demonstrate how MXC supports a demanding developer workflow. A coding agent needs access to the project repository, development tools, and commands required to complete a task, but it should not automatically gain access to unrelated files or network destinations. MXC preserves the capabilities the agent needs while enforcing clear boundaries around the rest of the system. Learn more about how GitHub Copilot uses MXC for sandboxed execution in this blog post. 

Get started and share feedback 

With containment, identity, and manageability built into the platform, Windows helps agents run more securely while giving developers and IT control over what they can access and do. MXC continues to improve as we expand containment backends, policy authoring, manageability, observability, and more supported scenarios in the containers. You can get started today with the MXC SDK, configuration schema, documentation, and samples in the MXC repository. If you encounter unexpected behavior or have ideas for improving the experience, open an issue on GitHub and help shape what comes next.