Microsoft’s agentic OS wants to help users become sysadmins of their own lives

Microsoft Ignite 2025 has demonstrated just how important agentic systems are to the company’s commercial plans. And it's clearly fighting on multiple fronts: while the announcement of Agent 365, an enterprise platform for deploying and managing agents, provides an insight into how the company will bring the technology to corporate customers, the news that AI agents will be available in the Windows 11 taskbar suggests Microsoft is thinking carefully about how to make agents a reality for consumers too. 

Despite an agentic Windows being criticized by some, there’s undoubtedly clear commercial logic — and not just because Microsoft has made huge bets on the infrastructure of AI. Consumers are, after all, professionals too; making the technology available to everyday users and giving them the opportunity to experiment with it with little overhead could help accelerate enterprise adoption.

Why is Microsoft bringing agents to Windows?

While it’s important to note the feature is currently only available to an exclusive set of insiders (who have early access to new features), the aim is ultimately to encourage new kinds of behavior that makes Windows a stickier proposition for users and, in turn, an ecosystem for third party agents. 

From one perspective, this new feature gives users the opportunity to what I can only describe as sysadmin their lives. In other words, write script-like automations with agents to run particular tasks on their machine in the background. That could mean personal actions like summarizing messages or booking tickets, but it’s not hard to see how these features could be particularly powerful in a professional setting. They could allow users to automate tedious workplace tasks not only quickly but also far cheaper than the recent generation of automation platforms like Zapier. All you’ll need to do is open your laptop.

Clearly, getting individual users used to agents and experiencing them for themselves could, if the feature is successful, create a bottom up army of evangelists for everything else agentic the company has planned.

What does an agentic Windows mean for organizations?

For organizations of all kinds — particularly those selling to consumers — this new feature is worth monitoring because it could mark the start of a change in customer behavior away from interfacing with apps to using agents for all kinds of activities. 

This isn’t to say this will happen fast, or even that it will happen at all; the point is more that this has the potential to represent a significant change in how consumers interact with brands and services. 

If this does indeed come to pass, the organizations that will win are those on the front foot when it comes to optimizing for agentic systems. The commercial advantage will be the ability to be discovered and used by agent systems: what we think of as a front end may well evolve.

Criticism and the risks of agents

The impact of this feature, of course, remains to be seen. There’s been plenty of criticism and pushback against Microsoft’s agentic push in recent months; that’s likely to increase if this is the direction of travel. 

One of the most significant issues is around security; the feature is, after all, essentially letting a bot rummage through your files and system. For its part, Microsoft has acknowledged this: “Agentic AI applications” the company writes in its support document, “introduce novel security risks, such as cross-prompt injection (XPIA), where malicious content embedded in UI elements or documents can override agent instructions, leading to unintended actions like data exfiltration or malware installation.”

Talking to my Thoughtworks colleague Ben O’Mahony about the story today, he noted that “it definitely opens up a lot more attack vectors.” He mentioned the recent NX s1ngularity supply chain attack (from September), where AI CLI tools like Claude Code and Gemini were used to write code to expose secrets and trash the system.

Microsoft appears to believe it can mitigate risks by making it non-default and instructing users that they need to be aware of the security risks if they turn it on. Whether this is a convincing way for a major technology company to think about security is something for another discussion.

Control and convenience

There’s also a question about what this means for developers. Gergely Orosz, writer of the popular The Pragmatic Engineer newsletter, believes this could alienate developers: “ [an agentic Windows] doesn’t look like anything a builder who wants OS control could choose,” he wrote on X.

Ben O’Mahony agrees there’s not a great deal of value for developers. “I think Developers could already do much of this — the feature is aimed at general users,” he said. However, he did see some benefits: I’d definitely use it for launching different applications and maybe moving data between them — so, data from excel into word for instance. Building small, specific applications might also be interesting too.”

Perhaps the issue for the future isn’t so much how user behavior might change but where we want to use agents to automate and where we want control. Major vendors will clearly have a view that’s very different to experienced technologists: but what will consumers think?