The announcement came in the middle of a product event in which Microsoft unveiled new laptops and chips, and it was easy to miss amid the hardware. But it was the most consequential thing the company said all day: Copilot, the assistant that lives inside Windows, is being given operating-system-level permission to read local files and take actions across applications.
The change, announced on October 7 at Microsoft’s Windows and Surface event, marks a shift in what the assistant is allowed to do without asking. Until now, file reads and writes in Windows have generally required a user to confirm them one by one. Under the new arrangement, that authority is handed to the assistant itself.
The move is part of a broader redesign that Microsoft calls a hybrid intelligence architecture for Windows 11. The company’s own code model, MAI Code 1.1 Flash, will run partly on the device and partly in the cloud, and the assistant will be able to reach across the operating system to act on a user’s behalf.
The Verge and The Register both flagged the same point in their coverage: the permission that users used to grant explicitly is now being delegated to the assistant. That is a real change in the trust model, and it is the part of the announcement that will get the most scrutiny.
Microsoft’s argument is that an assistant that cannot touch files is an assistant that cannot do much. The whole premise of an agent, software that acts rather than merely answers, is that it needs to read, write and click. The company has spent the past year moving Copilot from a chat window toward an agent, and this is the step that makes the agent real.
The trade-off is the one that runs through every recent AI product: capability against control. An assistant with operating-system access can automate real work, but it can also make mistakes at scale, and those mistakes are harder to undo when they happen inside a user’s files rather than inside a chat window.
Microsoft has said it will build safeguards into the system, and the hybrid model is part of that design. Keeping some inference on the device reduces what has to be sent to the cloud, and the company argues that the model’s integration with Windows gives it a better sense of context and limits than a third-party assistant would have.
The competitive stakes are high. Apple and Google have their own assistants, and both have been cautious about how much system access they grant. Microsoft is betting that a more capable assistant, even with more risk, is what enterprise customers actually want, and it is pushing Windows in that direction faster than its rivals.
The Surface event was, in part, the hardware that carries that bet. The new flagship laptop, the Surface Laptop Ultra, is built around an Nvidia chip that Microsoft says runs local AI models twice as fast as Apple’s MacBook Pro M5 on some tasks. The message is that Windows is becoming a place where AI runs natively, on the device and in the system.
For users, the practical question is what changes when they sit down at a Windows machine. The assistant will be able to move files, fill forms and act across applications without a prompt for each step. Some will find that a relief. Others will find it unsettling, and Microsoft is about to learn which group is larger.
The change arrives as the industry has begun to treat agents as the next thing after chatbots. A chatbot answers; an agent acts. That distinction is why every major software company is now working on assistants that can reach into email, calendars, files and payments, and it is why the operating system has become the next battleground. Whoever controls what an assistant can touch controls how much of daily work it can absorb.
The security question is not theoretical. Researchers have shown repeatedly that a model given the power to run commands can be nudged into running the wrong ones, either through a malicious prompt or a simple mistake. The safeguards Microsoft builds around Copilot will determine whether the new permissions are read as progress or as a new surface for attack.
For enterprises, the promise and the risk arrive together. A workforce whose assistants can read files and move data between applications is a more productive workforce, but it is also one where a single misconfigured assistant can do damage that used to require a person sitting at the keyboard. Microsoft is betting that customers will take that trade, and that the ones who refuse will come around once their competitors have not.
The company has not said exactly when the new permissions roll out, and it has left room to adjust the safeguards before they do. But the direction is set, and it is a direction that gives software, for the first time in Windows’ history, the same reach over the machine that its user has.
