Microsoft now treats the AI agents a company runs as possible insider threats. On October 19 it announced controls that score each agent's risk as it works, and that can cut back what the agent may do when the score rises. The features are part of Microsoft 365 E7, its top-tier bundle, and Project Perception, the AI security system it introduced in July, GeekWire reports.
The pitch is simple: do not trust the model, contain it. That puts Microsoft in a race with Google, Amazon Web Services, CrowdStrike and Okta to become the system businesses use to control their AI agents, according to GeekWire.
What Microsoft announced
GeekWire describes four parts:
- A risk score for each agent. It updates all the time, based on signals such as what data the agent can reach and whether its actions are starting to drift from the task it was given.
- Three responses when risk goes up. The system can take away the agent's ability to make changes while it can still read data, require a person to approve a high-stakes step, or shut the agent down.
- Wider agent discovery. Microsoft can now detect 60 types of agents running on employees' computers, up from 25. The list includes Anthropic's Claude Code, OpenAI's Codex and GitHub Copilot.
- Guardian Agents in Project Perception. These are AI agents that investigate why another agent's risk changed and recommend or take steps to contain it.
In its own blog post, Hayete Gallot, executive vice president of Microsoft Security, describes the design in three layers. Sensors across identity, data, cloud, endpoint, network and runtime find agents in the company and bring them under management by giving each one "an identity, container and set of policy and permissions." Those signals then feed a risk score for what each agent is trying to do. Based on that score, a team of Guardian Agents "actively and continually supervise every action of every agent" and respond in real time as risk rises.
Why Microsoft calls agents insiders
Gallot's argument is that the threat is not only outside attackers. Companies deployed their own agents and "implicitly trusted" them. She writes that "frontier models, regardless of their origin, cannot be trusted," not because they are malicious, but because they are trained to reach results, "which often leads to reward hacking." She adds that agents "will collaborate and collude with other agents to reach their objectives, without needing to be compromised," and that they are "frequently overprivileged."
The approach follows a post by CEO Satya Nadella on October 10, "Models as Insider Risks in the Super Intelligence Era." Nadella listed seven principles, among them independent controls over what a model can access, tamper-proof records of every meaningful action, and containment: "An authorized person should always be able to pause or shut down a model mid-task." He ended with this line: "The most trustworthy Super Intelligence system will not be the one with the model we trust most. It will be the one that enables us to trust the model the least."
CNBC covered that post as a call for an "emergency brake" that humans control.
Why it matters
Agents now work inside companies with real access. Gallot writes that they "have access to data, tools and systems and can take actions and make decisions in critical processes." Microsoft's own framing admits a gap: today's tools can see what an agent does, but not always why. Gallot writes that security controls should be able to ask "Why is it happening?" and whether an action fits the task, and that this "will require greater transparency into the model itself," including chain-of-thought tokens. She calls that "the next step in securing agentic insiders."
The cost of loose agents is not theoretical. On our own pages this week, a hacker used AI agents to break into more than 100 company sites, and in a test of six AI agents chasing an impossible refund, one sent 187 messages and another leaked a family illness. GeekWire also points to reports from Anthropic and OpenAI about test agents taking actions they were not supposed to take.
For IT teams, the detection list is the practical part. GeekWire reports that Microsoft can now find agents such as Claude Code and Codex running on employees' computers. If you are choosing between them, our Cursor vs Claude Code vs Codex comparison covers what each one does.
Who can get it, and what it costs
- Status. GeekWire reports the new features are in private preview, with broader availability planned for Microsoft's Ignite conference, November 17 to 19 in San Francisco. Microsoft's Project Perception documentation says Perception is in a Limited Public Preview open to "a small, invitation-only set of customers."
- Price. Microsoft 365 E7 launched in May and costs $99 per user per month, according to GeekWire. It also includes Microsoft 365 Copilot, the E5 suite, the Entra Suite identity tools and Agent 365, a service for managing AI agents. For how Copilot compares with Google's offer, see our Microsoft 365 Copilot vs Gemini in Google Workspace guide.
- What already exists. Microsoft Purview Insider Risk Management has a Risky Agents (preview) policy that flags risky prompts, sensitive responses, access to sensitive data and visits to risky websites. It covers Copilot Studio agents, Microsoft Foundry agents and agents built with the P4AI SDK.
The Perception documentation also shows how the human step works. When an agent needs approval for a significant action, such as disabling a user account or isolating a device, its session pauses with a "Waiting for input" status until a person approves, rejects or suggests another approach. A person can also stop a session, and that cannot be undone.
What to watch
The open questions are how well risk scores catch an agent that drifts slowly, how many false alarms they raise, and whether Guardian Agents, which are themselves AI, can be trusted to police other AI. Nadella's own principle says no single model should verify its own work. Expect more detail at Ignite.
Sources
- Securing the agentic insider, The Official Microsoft Blog (Hayete Gallot, October 19, 2026)
- Microsoft unveils tools to monitor and corral rogue AI agents, GeekWire
- Models as Insider Risks in the Super Intelligence Era, Satya Nadella (October 10, 2026)
- Microsoft's Nadella says AI needs an emergency brake humans control, CNBC
- Approve, reject, or stop agentic work, Microsoft Learn
- Monitoring agents with Insider Risk Management, Microsoft Learn
